Privacy Policy

At SAMNIS Solutions s.r.o. (BACR), your privacy is extremely important to us. We are a European company serving users across Europe, and we are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws. Transparency is central to how we operate, and we use your data for the purposes described in this policy. We earn revenue from subscriptions and services, including SPRINT engagements, not from selling or otherwise monetizing your personal data.

BACR uses both models it hosts itself and third-party models accessed through OpenRouter. Depending on the model and routing, an AI request is processed by BACR-hosted infrastructure or sent through OpenRouter to a third-party provider. Processing locations depend on the infrastructure and provider and may include countries outside the European Economic Area (EEA), including the United States. Being an EU company does not mean that all processing takes place in the EU. See Section 4a for details.

The data controller for your personal data is SAMNIS Solutions s.r.o. (BACR), registered and based in Prague, Czechia. If you have any questions about this Privacy Policy or would like to exercise your rights, you can contact us.

We may collect and process the following categories of personal data to provide and improve our services:

• Account & Authentication Data: We use Google OAuth (Sign in with Google) to authenticate you. When you sign in, Google shares a limited set of profile information with us, typically your name, email address, and profile picture, and a unique account identifier. This information originates from your Google account (the source of the data). We never receive or store your Google password. This data is used to create and secure your account and manage your subscription.
• Prompt & Content Data: The prompts, messages, and inputs you submit to interact with the AI. These are handled under a strict Zero-Data-Retention approach (see Section 4a).
• App-Activity Logs: Operational events used to monitor application reliability and security. These logs do not record model queries, user-submitted content, or account/profile data. They are separate from the account and communication records described in this policy.
• Early-Access & SPRINT Request Data: When you submit a request, we collect your first and last name, contact email, requested plan or service, selected interests, job field and any additional specialty, use-case or project description, preferred operating system, and company/team name and team size where applicable. We also receive the form language, your terms acceptance and the applicable terms version, and an anti-spam field. Request records may include submission and review timestamps, the application status, review notes, and notification status. These are application records, not model queries or app-activity logs.
• Communication Data: Emails and support interactions to provide better customer service.
• Payment Data: Billing and transaction information, processed on our behalf by third-party payment providers. We do not store full card details on our systems.

The purposes for which we collect and use your data include:

• Providing the Services you request: To deliver AI-based functionality and support.
• Processing Early-Access & SPRINT Requests: To assess your request, understand your proposed use case or project requirements, decide on access or service next steps, and communicate the outcome. We process this information to take steps at your request before entering into a contract (Article 6(1)(b) GDPR); anti-spam checks rely on our legitimate interest in protecting the request process (Article 6(1)(f)). Form acceptance of our terms is not consent to unrelated marketing. Required fields are identified in the form; without the necessary information, we may be unable to process your request. Please avoid including unnecessary personal or sensitive information about yourself or others in free-text answers. Application records are not forwarded to OpenRouter as model-query content.
• Improving our Services: For troubleshooting, technical improvements, and security monitoring.
• Communication: Sending updates about your account, billing, and product changes (you can opt out of non-essential communications).
• Compliance: Meeting legal, regulatory, and compliance obligations.

We process your personal data on the following legal bases:

• Performance of a contract or steps at your request before entering into one: To provide requested account and AI services, subscriptions, SPRINT engagements, and support necessary to deliver those services, and to assess the applications described above (Article 6(1)(b) GDPR).
• Consent: For optional activities where we request your specific consent, such as marketing communications where consent is required. You can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. Ordinary support needed to deliver a service is not treated as consent-based merely because you contact us.
• Legitimate interests: To prevent abuse, operate our services, and enhance security.
• Legal compliance: To meet legal obligations, such as financial audits or fraud prevention.

Depending on the model and routing, your query is processed by BACR-hosted models or sent through OpenRouter to a third-party AI provider. Not every request is sent to OpenRouter.

What is forwarded: For OpenRouter-routed requests, OpenRouter and the selected provider receive the query and its included context, together with technical information needed for authentication, routing, and processing. BACR does not separately forward app-activity logs, account/profile records, billing records, or support records as model-query content.

Personal data in queries: Queries may contain information about you or other people, which is processed with the query. Do not assume personal information is automatically detected or removed; avoid including unnecessary personal or sensitive information. This guidance does not limit your data protection rights or BACR's legal obligations.

• Processing locations: Locations depend on the hosting infrastructure and provider and may be outside the EEA, including in the United States. We do not guarantee EU-only or EEA-only processing.
• Retention and training: BACR does not retain queries or their included content after generating a response and does not use them to train models. We configure OpenRouter routing to use only providers meeting these same zero-retention and no-training requirements, regardless of location. Zero retention limits storage after processing; it does not mean that no personal data is processed.
• Separate activity logs: App-activity logs exclude query content. Their retention period in Section 5 is not an exception allowing prompts or user-submitted content to be retained.

BACR does not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. While our service uses AI to generate responses to your prompts, these outputs do not constitute automated decisions about you, and we do not use your personal data for profiling to make such decisions.

We retain your personal data only for as long as it is necessary to fulfill the purposes for which it was collected or to comply with legal, regulatory, and contractual obligations. Below is a breakdown of our retention periods:

Prompt & Content Data

• Purpose: Processed by BACR-hosted models or transmitted through OpenRouter to third-party AI providers to generate responses, depending on the model and routing. Processing may take place outside the EEA, including in the United States.
• Retention Period: Model queries and their included content are not retained after a response is generated, under our Zero-Data-Retention policy (see Section 4a). This does not mean that separately collected account or support records are deleted after each response.

Account Data

• Purpose: Required to operate your account, manage access and subscriptions where applicable, and resolve disputes.
• Retention Period:

  • Active Accounts: Stored for the duration of your registration, whether your account is free or paid.
  • After Account Closure: Retained for up to 1 year from the date your account is closed for evidentiary and legal compliance purposes, after which it is securely deleted, subject to the specific legal obligations described below. Ending a paid subscription does not start this period if your account remains open on a free plan.

App-Activity Logs

• Purpose: Record application activity for reliability, troubleshooting, and security. Logs exclude model queries, user-submitted content, and account/profile data and are not forwarded to OpenRouter. Any operational metadata that qualifies as personal data remains subject to the protections and rights described in this policy.
• Retention Period: Retained for up to 1 rolling year, then deleted automatically.

Payment Data

• Purpose: Processed securely by third-party payment providers for billing and fraud prevention.
• Retention Period: Follows the retention period required by financial and tax regulations, usually 5 to 7 years, depending on your country of residence.

Early-Access & SPRINT Request Data

• Purpose: Assess and respond to your application or service request.
• Retention Period: Kept temporarily while we process the request. Once the request has been processed and the outcome communicated, the application data is deleted, unless a specific legal obligation requires retention of particular records. This temporary retention rule applies to the application answers and associated review records; it is separate from the retention periods for general support correspondence and app-activity logs.
• If your request leads to an account or service engagement, information necessary to provide that service is handled separately under the applicable account, communication, or payment retention rules in this policy. We retain only the information necessary for the resulting service.

Communication Data

• Purpose: Manage customer support inquiries and improve service delivery.
• Retention Period: Retained for up to 2 years from the date of your last interaction, unless deletion is requested earlier.

Legal Obligations

If required by law, we may retain certain data beyond the retention periods outlined above, but only to the extent necessary to comply with applicable laws (e.g., tax regulations or court orders).

We may disclose your Personal Data to third parties when necessary to provide the services we offer. Any such disclosure is limited to what is needed for the purposes described above. BACR may share your Personal Data with the following categories of third parties:

• Third-party Service Providers:
  To operate and deliver our services, we use providers including cloud vendors and payment processors, as well as OpenRouter and third-party AI model providers when requests are routed through them. AI requests may contain personal data included in your prompts or other submitted content. Using a BACR-hosted model does not itself require sending the request to OpenRouter. These providers are bound by contractual agreements to process your data only for the agreed purposes, in compliance with privacy laws.

• Compliance with Laws:
  We may disclose your data if required to do so by law, a court order, or other legal processes.

We do not sell or share your data for advertising purposes.

We have robust measures in place to protect data against unauthorized access, loss, destruction, or alteration. These include:

• Encryption: Data in transit is encrypted. We use secure infrastructure, including PostgreSQL and Google Cloud Platform.
• Regular Audits: We periodically review our systems and data-handling processes for vulnerabilities and ensure security updates are applied promptly.

BACR is based in the EU, but your personal data may be processed outside the European Economic Area (EEA). In particular, AI requests routed through OpenRouter may be processed by providers in the United States or other countries. We do not guarantee that prompts or other personal data remain exclusively in the EEA.

International transfers may arise from AI processing as well as operational services such as payment processing. Where such transfers are necessary, we ensure they are done under adequate safeguards, such as through Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the European Commission. Zero prompt retention and no-training requirements are separate from processing location; they do not mean that processing stays in the EEA.

If you are located in the EEA, the UK, or another jurisdiction with comparable privacy protections, you may have the following rights under the GDPR and similar privacy regulations:

• Right to Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You can request corrections or updates to your data if it’s inaccurate or incomplete.
• Right to Erasure (Right to Be Forgotten): You can request deletion of your data, subject to specific retention requirements under the law.
• Right to Restrict Processing: You can request that we limit the processing of your data in certain situations.
• Right to Objection: You can object to the processing of your data where we rely on legitimate interests as a legal basis.
• Right to Data Portability: You have the right to request your data in a portable format for reuse elsewhere.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

You can exercise any of these rights by contacting us at the email address listed in Section 12. We will respond to your request without undue delay and, in any event, within one month of receipt, as required under Article 12(3) GDPR (this period may be extended by up to two further months for complex or numerous requests, in which case we will inform you). If you believe we have not adequately addressed your request, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

We use Google OAuth (Sign in with Google) for authentication. The website stores BACR access and refresh tokens in your browser's localStorage, rather than in authentication cookies.

• Cookies: Used for website functions such as language selection.
• Browser storage (localStorage): Used for authentication tokens and preferences such as your theme and cookie-preference choice. This browser storage is distinct from BACR's server-side app-activity logs.

We do not use advertising or third-party tracking cookies.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or industry standards. Notice of significant changes will be provided by email or within the service itself. Please check this page periodically for updates.

Last Updated: 18-10-2026

For questions, concerns, or requests regarding this Privacy Policy, including to exercise any of your data protection rights, you can contact us at:

Email: contact [at] bacr [dot] app

Please indicate that your message concerns a privacy or data protection request so we can route it appropriately.

The BACR Team

We aim to deliver exceptional AI services while protecting your privacy at every step. Thank you for trusting us with your data.