LLMBase

Legal

Privacy Policy

Last updated: October 2026

1. Introduction

LLMBase, operated by Eyloo GmbH, provides AI chat, model comparison, inference APIs, and related AI tools. This Privacy Policy explains how we process personal data when you use our website, account area, applications, and services.

We process personal data in accordance with the GDPR and applicable German data protection law. For business customers, our Data Processing Agreement provides the processor terms, technical and organizational measures, subprocessor information, retention commitments, and professional secrecy protections.

2. Controller and Contact

The controller responsible for the processing described in this Privacy Policy is:

Eyloo GmbH
Im Hemchen 29
56410 Montabaur
Germany
Email: privacy@llmbase.ai

3. Data We Process

Depending on how you use LLMBase, we process the following categories of data:

  • Account Data: name, email address, authentication data, workspace membership, plan, and account settings.
  • Customer Content: prompts, files, messages, chat history, API inputs, generated outputs, and workspace content you submit or create.
  • Operational Metadata: model selections, timestamps, request identifiers, token and usage counters, feature interactions, error events, rate-limit data, and security logs.
  • Billing Data: subscription, invoice, payment, tax, and transaction information.
  • Support Data: messages, diagnostics, attachments, and contact details you provide when requesting support.
  • Website and Analytics Data: page activity, referrer and campaign parameters, cookie preferences, device information, browser information, and approximate location derived from technical request data.

4. AI Processing and Model Use

4.1 Model-Hosting Providers

Requests from LLMBase Chat and the LLMBase Inference API are processed by model-hosting providers that run the requested models. These providers process prompts and responses to generate the output under their own terms. They may be established or process data outside the European Economic Area, including in the United States, Singapore, and the People's Republic of China. Through our configuration, requests are forwarded only to provider endpoints that, according to the information available to us on the providers' data policies, do not use inputs for training. Some of these providers still retain inputs for periods they determine; such retention is separate from use for training.

4.2 Optional External Model Paths

LLMBase may make optional external, lab, or proprietary model paths available in the product. We do not name those optional providers in this Privacy Policy. Customer Content is sent to those paths only where you select the path, activate the relevant provider or account setting, or give feature-specific approval.

For optional external, lab, or proprietary model paths, LLMBase sends only the content, model settings, and technical parameters needed to produce the selected response. LLMBase account identifiers, session tokens, billing data, and internal analytics identifiers are not included in the model prompt unless technically necessary for the specific feature.

4.3 No Model Training by LLMBase

We do not use Customer Content to train, fine-tune, or evaluate AI models, or to develop or improve our own models, request routing, or services. This applies to prompts, uploaded files, chat messages, generated outputs, and API payloads. Quality testing, monitoring, and model selection use only synthetic test inputs and Operational Metadata that does not contain Customer Content. Processing by model-hosting providers is described in section 4.1.

We may use Operational Metadata to operate, secure, debug, bill, and improve the usability of the service, including capacity planning and product analytics. Operational Metadata is not used to train, fine-tune, evaluate, or improve AI models.

5. Purposes and Legal Bases

We process personal data for the following purposes and legal bases:

  • Contract performance (Art. 6(1)(b) GDPR): to provide accounts, workspaces, AI features, API access, subscriptions, support, and requested product functionality.
  • Legitimate interests (Art. 6(1)(f) GDPR): to secure the service, prevent misuse and fraud, maintain reliability, debug errors, understand product usage, and improve the usability of the service without using Customer Content for AI model training or evaluation.
  • Legal obligations (Art. 6(1)(c) GDPR): to comply with tax, accounting, commercial, security, and legal requirements.
  • Consent (Art. 6(1)(a) GDPR): for optional cookies, marketing communications, and optional features that require consent. You can withdraw consent at any time with effect for the future.

Online cancellation (“Cancel contracts here”)

If you cancel a contract via our cancellation page, we process the details you provide (email address, contract type, type and requested date of cancellation, reason if any) and the date and time of receipt in order to match your cancellation to your contract, execute it, confirm receipt and the end date to you, and be able to prove the cancellation. The legal bases are our statutory obligations under Section 312k of the German Civil Code (Art. 6(1)(c) GDPR) and the performance or termination of the contract (Art. 6(1)(b) GDPR); retention as evidence is based on our legitimate interest in establishing or defending legal claims (Art. 6(1)(f) GDPR). To protect against automated abuse, this page uses Cloudflare Turnstile (Cloudflare, Inc., USA), which receives your IP address and technical browser characteristics (Art. 6(1)(f) GDPR; transfers based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses). We accept your cancellation even if this check fails. To limit abusive requests we store only a keyed hash (HMAC) of your IP address instead of the address itself and delete it after 24 hours (Art. 6(1)(f) GDPR). If a cancellation is executed without signing in, we also send the confirmation to the email address on file for the customer account, so the account holder can recognise and undo a cancellation they did not make (Art. 6(1)(b) and (f) GDPR). No web analytics runs on the cancellation page. We delete cancellation records 3 years after the end of the calendar year in which the contract ended, unless longer statutory retention periods apply.

6. Processors, Subprocessors, and Transfers

We use carefully selected processors and subprocessors for hosting, authentication, database infrastructure, security, analytics, billing, support, and optional AI model paths. Business customers can review the current subprocessor list in the Data Processing Agreement.

  • Cloudflare, Inc. (USA) – hosting, database, security, email delivery
  • Hetzner Online GmbH (Germany) – infrastructure and file storage
  • Hanko GmbH (Germany) – authentication
  • Stripe, Inc. (USA) and RevenueCat, Inc. (USA) – payments and in-app purchases
  • Functional Software, Inc. (Sentry, USA; US region) – error monitoring
  • PostHog Inc. (USA; EU cloud) – product analytics in Chat
  • Zoho Corporation (Zoho Mail, USA) – email mailboxes
  • MVP Stack LLC (Piqo) – web analytics
  • Pirsch Analytics (Emvi Software GmbH, Germany)

When you use search, lookup, or research tools in LLMBase Chat, queries derived from your conversation (for example search terms, place names, or links) are sent to the relevant external service, such as search, map, weather, scholarly, or documentation services. The Data Processing Agreement (Annex A) lists these services.

Where processing outside the European Economic Area is necessary, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, transfer impact assessments, encryption, access controls, and data minimization. Inference by model-hosting providers can involve processing in third countries (see 4.1). Optional external, lab, or proprietary model paths additionally require product selection, account activation, or feature-specific approval.

We configure analytics and security tools to reduce personal-data exposure where practical, including IP truncation or minimization, access controls, limited retention, and cookie controls where required.

7. Security and Confidentiality

We implement technical and organizational measures designed to protect personal data, including encrypted transport, access controls, role-based permissions, monitoring, logging, backup controls, vulnerability management, and confidentiality obligations for personnel with authorized access.

Access to Customer Content is limited to what is necessary for providing, securing, supporting, or legally administering the service.

8. Retention

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required by law:

  • Account Data: retained while the account is active and deleted or anonymized within 30 days after account closure, unless legal retention duties apply.
  • Customer Content: retained according to product settings and feature behavior, and deletable where supported in the product.
  • Chat history: when you use LLMBase Chat with an account, we store your conversations, chat titles, uploaded files, and the text extracted from those files so you can continue your conversations later. We keep them until you delete the chat or your account. You can delete individual chats at any time, and deleting your account deletes all of your chats. Chats you use without an account are stored only in your browser.
  • Workspace content: files, their extracted text, and instructions you add to a Workspace are stored until you delete them, the Workspace, or your account.
  • Inference API requests: LLMBase does not store prompts, inputs, outputs, or tool content of requests to the LLMBase Inference API (api.llmbase.ai) in its application databases or logs after the response is completed. Requests are processed by model-hosting providers (see 4.1); some of these providers retain inputs for periods they determine under their own terms. This commitment applies only to the Inference API, not to LLMBase Chat or Workspaces.
  • Operational Metadata: retained for limited periods needed for security, debugging, billing, analytics, and service reliability.
  • Billing Data: retained for statutory tax and accounting periods, generally up to 10 years under German law.
  • Support Data: generally retained for up to 3 years unless a longer period is needed for legal claims or compliance.

9. Professional Secrecy and Protected Content

Where customers process professional secrets or similarly protected information through LLMBase, we treat that content as confidential Customer Content. Our Data Processing Agreement includes additional professional secrecy obligations, confidentiality controls, access restrictions, breach notification duties, and deletion commitments.

10. Cookies and Analytics

We use essential cookies and similar technologies for authentication, session security, preferences, fraud prevention, and service operation. Until you accept functional cookies, we load Piqo in cookieless mode for website analytics. In this mode, Piqo does not set a Piqo visitor cookie and uses a daily rotating pseudonymous identifier for visitor and session measurement. If you accept functional cookies, Piqo uses a first-partypiqo_visitor cookie to keep visitor identity stable across sessions and support payment-source attribution. Your functional choice also enables optional advertising conversion measurement and other optional features where indicated.

You can manage cookie preferences through the cookie banner and your browser settings. Disabling essential cookies may affect service functionality.

Web analytics with Pirsch Analytics

To analyse use of our website and measure how many visitors complete a sign-up or purchase, we use Pirsch Analytics, a service of Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany, which processes data on our behalf under a data processing agreement (Art. 28 GDPR) on servers in Germany (Hetzner Online GmbH, Nuremberg and Falkenstein).

Pirsch does not set cookies or store information on your device. For page views and certain events, our servers send Pirsch your IP address, user agent, browser language, technical information sent by your browser (browser brand, device type, operating system), the page visited (without personal parameters), the referring website and campaign parameters (e.g. utm_source, utm_medium, utm_campaign). Events are: completed sign-up, login, started and completed purchase or credit top-up, setup and completion of automatic top-up and each automatic top-up, a scheduled cancellation, and interactions on our public pages such as selecting a plan on the pricing page, clicks on calls to action (e.g. "Get started") and clicks on links to other websites. Your browser sends these interactions to our server, which forwards them to Pirsch together with the data listed above. Depending on the event we also send: for purchases and top-ups the product, plan, billing type, amount and currency; for cancellations the product area, the cancelled plan and where the cancellation was made (e.g. account settings); for interactions the selected plan or the clicked element and the target page. We do not send your name, email address, user ID or customer ID to Pirsch. So that a login is counted only once per session, we store an irreversible hash of the session identifier on our servers for at most 35 days. So that a purchase is still counted if you do not return to our website after paying or the payment is confirmed later, we temporarily store your IP address, user agent and browser language on our servers when checkout starts, and delete them once the purchase event has been sent to Pirsch or the checkout has been abandoned or expired, at the latest after 14 days.

Pirsch creates a hash from IP address, user agent, the current date and a site-specific salt as a pseudonymous visitor identifier that changes daily, so visitors cannot be recognised for more than 24 hours or across websites. Pirsch does not store the IP address, in whole or in part; it only derives an approximate location (country, city) using a local database. Pirsch stores the user agent separately from page views for up to three months. We keep the statistics for as long as needed for product decisions, at most 24 months.

The legal basis is our legitimate interest in privacy-friendly reach and conversion measurement (Art. 6(1)(f) GDPR). You may object at any time on grounds relating to your particular situation (Art. 21 GDPR), e.g. by emailing privacy@llmbase.ai.

11. Your GDPR Rights

Subject to the legal requirements, you have the right to access, rectify, erase, restrict, object to processing, receive data portability, and withdraw consent where processing is based on consent.

To exercise your rights, contact privacy@llmbase.ai. We will respond within the period required by GDPR.

12. Children's Privacy

LLMBase is not intended for children under 16 years of age or the applicable age of digital consent in your jurisdiction. We do not knowingly collect personal data from children.

13. Changes

We may update this Privacy Policy to reflect product, legal, technical, or operational changes. We will post the updated version with a new "Last updated" date and provide additional notice where legally required.

14. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of personal data violates data protection law.

For Rheinland-Pfalz, the competent supervisory authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Website: www.datenschutz.rlp.de