Data Protection

Privacy Policy

Effective Date: May 15, 2026 — Last Updated: August 15, 2026

This Privacy Policy is drafted in compliance with Algerian Law No. 18-07 of June 10, 2018 on the protection of natural persons with regard to the processing of personal data.

1. Scope of This Policy

This Privacy Policy applies to all personal data collected and processed through the DEVUP AI platform (devupai.com), including the website, AI inference API Gateway, developer dashboard, and all associated services.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, in accordance with Article 7 of Law 18-07.

2. Personal Data We Collect

2.1 Data You Provide Directly

• Account Information: Email address, name (if provided), and authentication credentials (password hash or OAuth provider identifier such as GitHub).
• Billing Information:Payment method details (processed securely through local payment gateways — CIB, Eddahabia, BaridiMob). DEVUP AI does not store full card numbers.
• Support Communications: Any information you provide when contacting our support team.
• Uploaded Files: Any files you upload to the Platform, such as audio references.

2.2 Data Collected Automatically

• API Usage Metadata: Timestamps, token counts (prompt and completion), model used, response latency, HTTP status codes, and cost per request. This metadata does NOT include the content of your prompts or completions.
• Technical Data: IP address, browser type, device type, operating system, and referral URL when accessing the dashboard.
• Session Data: Authentication tokens and session identifiers necessary for secure access.

2.3 Data We Do NOT Collect

DEVUP AI does NOT collect, store, or retain the text content of your API prompts or completions. Text request and response content is never written to our database. Text inference content is transmitted to third-party inference providers for processing and is not retained by DEVUP AI. Image, video, and audio generation endpoints necessarily produce a file; that file is written to private object storage so it can be delivered, and is served only through a signed URL that expires 300 seconds after the response. Transient runtime error output may appear in server logs for operational troubleshooting.

3. Legal Basis for Processing

In accordance with Articles 7 and 9 of Law 18-07, we process your personal data on the following legal bases:

• Contractual Necessity (Article 7): Processing is necessary for the performance of the contract between you and DEVUP AI (i.e., providing the AI inference Service as described in our Terms of Service).
• Consent (Article 7): Where required, you provide explicit consent at the time of account registration or data collection.
• Legitimate Interest: Processing necessary for the legitimate interests of DEVUP AI, such as fraud prevention, platform security, and service improvement, provided these interests do not override your fundamental rights.
• Legal Obligation: Processing required to comply with Algerian tax, commercial, or regulatory obligations.

4. Purposes of Data Processing

Your personal data is processed for the following purposes:

• Account creation, authentication, and management.
• Providing, maintaining, and improving the AI inference gateway service.
• Billing, invoicing, and transaction processing in Algerian Dinar (DZD).
• Usage metering and real-time analytics displayed on your dashboard.
• Platform security, abuse detection, and rate limit enforcement.
• Responding to your support requests and communications.
• Complying with legal and regulatory obligations under Algerian law.

5. AI Model Training — No-Training Guarantee

DEVUP AI does not train, fine-tune, or develop AI models. Your data is never used for model development. Third-party inference providers are prohibited by their own published terms of service from training on customer data.

6. Data Flow

The data flow for every inference request is as follows:

• Step 1 — Transmission:Your API request is transmitted over an encrypted TLS connection to a third-party inference provider. No identifying data is included — your email address, IP address, and account identifier are never transmitted with inference requests.
• Step 2 — Processing: The provider processes the request and returns a response.
• Step 3 — Metering: DEVUP AI records operational metadata (model, status, token counts, latency, cost) for billing. Text request and response content is not stored.

DEVUP AI does not control provider-side data handling. Providers may retain request data briefly for operational purposes in accordance with their own published policies.

7. Data Sharing and Third-Party Disclosure

DEVUP AI does not sell, rent, or trade your personal data. We may share limited data with the following categories of recipients:

• Third-Party Inference Providers: Inference requests are transmitted to third-party inference providers for processing. No identifying data is transmitted with these requests.
• Payment Processors: Billing data is shared with local payment processors (SATIM network for CIB/Eddahabia) to process your payments securely.
• Hosting Providers: Technical data may be processed by our hosting providers (Hetzner, Supabase) for the purpose of delivering the Platform dashboard and API gateway.
• Legal Authorities: We may disclose personal data if required to do so by law, regulation, or valid legal process issued by a competent Algerian authority.

8. International Data Transfers

In accordance with Articles 44–45 of Law 18-07, DEVUP AI discloses the following regarding international data transfers:

Your inference data (the content of your API requests and the resulting model outputs) is transmitted to third-party inference providers located outside of Algeria for the sole purpose of performing AI inference. No identifying data accompanies these transfers. These transfers are governed by the following safeguards:

• Contractual Necessity: These transfers are necessary for the performance of the contract between you and DEVUP AI, as the core inference service requires compute capacity not available domestically at the required scale.
• No Identifying Data: Inference requests transmitted abroad contain no email address, IP address, or account identifier.
• Encryption: All data in transit is encrypted using TLS.
• Provider Terms: Third-party inference providers are bound by their own published terms of service, which prohibit training on customer data. DEVUP AI does not control provider-side retention.

Account data, billing records, usage metadata, and uploaded files are stored on infrastructure provided by Supabase, hosted in the European Union (Ireland). DEVUP AI selects providers that maintain adequate data protection standards consistent with the requirements of Law 18-07.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy:

• Account Data: Retained for the duration of your account and for thirty (30) days after account deletion to allow for recovery.
• API Usage Logs (Metadata Only): Retained for twelve (12) months for billing reconciliation and analytics, then automatically purged.
• Billing Records: Retained for ten (10) years as required by Algerian commercial and tax regulations.
• Inference Data (Text Prompts/Completions): Not retained. Text request and response content is never written to our database.
• Generated Media Files:Files produced by image, video, and audio endpoints are written to private object storage and are reachable only via a signed URL that expires after 300 seconds. Generated image files and files uploaded for editing are deleted automatically thirty (30) minutes after creation. Generated video files are not covered by this automated schedule and are retained until removed manually. Image and video results requested with response_format "b64_json" are returned inline and are not written to storage, so no retention period applies to them.

10. Data Security Measures

In accordance with Article 41 of Law 18-07, DEVUP AI implements appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit using TLS.
• API key hashing using SHA-256 (raw keys are never stored).
• Scoped JWT authentication with automatic token expiration and rotation.
• Role-based access control (RBAC) for administrative functions.
• Rate limiting and anomaly detection to prevent unauthorized access.
• Application-layer access control and request isolation on the inference gateway.

11. Your Rights Under Law 18-07

Under Algerian Law 18-07, you have the following rights regarding your personal data:

• Right of Access (Article 34): You have the right to request confirmation of whether your personal data is being processed and to obtain a copy of such data.
• Right of Rectification (Article 35): You have the right to request the correction of inaccurate or incomplete personal data.
• Right of Erasure (Article 36): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Object (Article 37): You have the right to object to the processing of your personal data for legitimate reasons relating to your personal situation.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at support@devupai.com. We will respond to your request within thirty (30) days as required by Law 18-07.

12. Regulatory Framework — Algerian Data Protection Authority (ANPDP)

DEVUP AI processes personal data in accordance with the regulatory framework established by the Algerian National Authority for the Protection of Personal Data (ANPDP), the independent authority created under Article 22 of Law 18-07 to oversee data protection compliance in Algeria. DEVUP AI is committed to meeting the standards set by this framework.

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the ANPDP. We encourage you to contact us first at support@devupai.com so that we may attempt to resolve your concern directly.

13. Cookies and Local Storage

The Platform uses strictly necessary cookies and local storage for:

• Authentication: Session cookies to maintain your logged-in state.
• Security: CSRF tokens and authentication state.

DEVUP AI does not use advertising cookies, third-party tracking pixels, or behavioral analytics cookies. No data is shared with advertising networks.

14. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that personal data has been collected from a child under 18, we will take steps to delete such data promptly.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. We will notify you of material changes by posting the updated Policy on the Platform and updating the "Last Updated" date.

Your continued use of the Service after the publication of the revised Privacy Policy constitutes your acceptance of the changes.

16. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the People's Democratic Republic of Algeria, in particular Law 18-07 on the protection of personal data.

Any dispute arising from this Policy shall be submitted to the exclusive jurisdiction of the competent Courts of Algiers.

17. Data Controller — Legal Notice and Contact Information

The data controller responsible for the processing of your personal data on the DEVUP AI platform is:

• Full Name: BAL Mohamed Abdessalem
• Legal Status:Auto-entrepreneur — Artificial Intelligence Systems Development
• Registration Number: 100605190202125689
• Platform:DEVUP AI — devupai.com
• Email: support@devupai.com

For matters concerning the regulatory framework governing data protection in Algeria, refer to the ANPDP (Algerian National Authority for the Protection of Personal Data).