Data Privacy Statement

This Data Privacy Statement explains how PII Detection API (operated by Alpha Quantum, Munich, Germany) handles data when you use our PII detection services. We designed our platform with privacy at its core — the content you submit for scanning is processed in-memory, never persisted, and never shared with third parties beyond the processing pipeline described below.

When you submit data to our API for PII detection, the following principles apply:

• Transient processing only — All content submitted to our API is processed in real time. Once the detection results (and any optional masked output) are returned, the original content is immediately and permanently discarded from our systems.
• No persistent storage of customer content — We do not write your submitted text, documents, images, audio, or video data to any disk, database, or long-term storage system.
• No logging of content — We do not log the content of API requests or responses. Only metadata necessary for billing and service reliability (e.g., timestamps, request counts, response codes) is recorded.
• No use of your data for model training — Your data is never used to train, improve, or fine-tune any machine learning models.

We offer two deployment models to accommodate different data privacy requirements:

All of our own infrastructure is hosted exclusively within the European Union. For the Cloud API, external LLM providers may process data outside the EU transiently; for the Local Deployment option, all processing remains strictly within EU borders.

• EU-first data processing — Our own infrastructure keeps your data within EU borders. With the Cloud API, external LLM calls may be routed through providers with global infrastructure; with the Local Deployment option, all processing remains strictly within the EU.
• EU-governed data centers — Our hosting providers operate Tier III+ certified facilities compliant with EU regulations.
• Encrypted in transit — All API communication is encrypted using TLS 1.2+ (HTTPS). Data in transit cannot be intercepted or read by any intermediary.

We fully adhere to the EU General Data Protection Regulation (GDPR). Our commitment includes:

• Lawful basis for processing — We process data solely based on the contractual necessity of providing our PII detection service to you (Article 6(1)(b) GDPR).
• Data minimization — We collect and process only the minimum data necessary to deliver the service.
• Purpose limitation — Your data is used exclusively for the purpose of returning detection results. No secondary use, no profiling, no analytics on your content.
• Right to information — This statement provides full transparency into how your data is handled.
• Data Protection Officer — We have designated a data protection officer who can be reached at [email protected].
• Data Processing Agreements (DPA) — We provide DPAs to enterprise customers upon request to formalize our data protection commitments.

Separately from API content data, we collect limited account information to manage your subscription:

• Account information — Email address, company name, and contact details provided during registration.
• Billing records — Transaction history and payment metadata. We do not store full credit card numbers; payment processing is handled by PCI-DSS compliant third-party processors.
• Usage metrics — API call counts, timestamps, and response codes for billing and reliability monitoring. These records contain no customer content.

This account and billing data is stored within the EU and retained only for as long as your account is active or as required by applicable tax and commercial law.

We implement comprehensive technical and organizational measures to protect your data:

• Encryption in transit — All communications are secured via TLS 1.2+ (HTTPS).
• Network isolation — Processing servers operate in isolated virtual private networks with strict firewall rules and no public access beyond the API endpoints.
• Access controls — Internal access is restricted on a need-to-know basis with multi-factor authentication and audit logging.
• Regular security assessments — We conduct periodic vulnerability assessments and penetration testing of our infrastructure.
• Incident response — We maintain a documented incident response plan and will notify affected customers within 72 hours in the event of a data breach, in accordance with GDPR Article 33.

We do not sell or share your data for marketing, analytics, or any purpose unrelated to delivering the PII detection service. Our sub-processors include:

• EU-based hosting providers — Infrastructure providers operating data centers in Germany and Finland, bound by DPAs and GDPR obligations.
• LLM providers (Cloud API only) — External Large Language Model providers used for advanced AI-powered entity detection and classification. These providers process data transiently via their APIs and are contractually prohibited from storing, logging, or using your data for model training. This applies only to the Cloud API deployment; the Local Deployment option does not use any external LLM providers.
• Payment processor — PCI-DSS compliant payment provider for subscription billing (no content data is shared).

If you require a deployment where no data is processed by any third party, our Local Deployment option eliminates all external sub-processors from the data pipeline.

As a data subject under GDPR, you have the following rights regarding your personal data:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate personal data.
• Right to erasure — Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing — Request limitation of how we process your data.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to specific types of processing.
• Right to lodge a complaint — File a complaint with your local EU data protection supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.