Privacy policy

Who is responsible

Spavik is operated by NEBERIS CONSULTING, registered under 981 362 734 R.C.S. Bobigny, with its registered office at 5 Rue des Mésanges, 93220 Gagny, France.

Spavik decides how website, account, billing and security data are processed and is the controller for that data.

When your application sends personal data to the API, you decide what to send and why: you are the controller, and Spavik processes that data on your behalf as a processor. Where your plan allows Spavik to reuse submitted data for training, Spavik is responsible for that reuse (see Data policies by plan).

Questions about personal data can be sent to hello@spavik.co.

Visiting the website

The website sets no cookies, uses no analytics or advertising trackers and stores nothing in your browser.

Pages are served from Google Cloud. The hosting infrastructure processes your IP address and technical request data to deliver pages and protect the service. These logs are kept for up to 30 days.

Typefaces load from Google Fonts: when a page loads, your browser sends your IP address to Google.

Your account

Spavik processes the following data to create, secure and run your account, as needed to perform the contract:

• your email address and whether it has been verified;
• your name, if you enter it or sign in with Google;
• your Google account identifier, if you sign in with Google;
• your country, estimated from your IP address at signup with MaxMind, used for tax purposes and aggregate measurement and never to restrict access;
• session tokens: access tokens expire after 15 minutes and refresh tokens after 30 days.

Emails and signup credits

Sign-in links and service emails are sent from noreply@spavik.co through Mailjet.

To grant signup credits only once, Spavik keeps a keyed fingerprint (HMAC) of your email address, including after account deletion, for as long as the free grant exists. This relies on Spavik’s legitimate interest in preventing abuse.

Messages sent to hello@spavik.co are used to answer your request and are kept for up to three years after the last exchange.

Payments and billing

Payments are processed by Stripe. Spavik stores your Stripe customer identifier, your plan and subscription status, your credit balance, a ledger of credit movements and the usage events of billed requests.

This processing is needed to perform the contract. Invoices and accounting records are kept for ten years, as required by French accounting law.

API keys and request logs

API keys are stored as hashes. The full key is shown only once, when it is created.

Each API call is logged with its request identifier, time, method, path, status, error code, duration, workspace, key identifier, IP address, user agent, and the name and version of the SDK used. You can view your workspace’s logs for the last 30 days. Spavik keeps them for 90 days, based on its legitimate interest in securing the service, providing support and handling billing disputes.

Data your application sends

Spavik processes this data to provide the service you requested. Send only the columns your predictions need and avoid direct identifiers where you can. Predictions are computed by Spavik’s own engine: submitted data is not sent to third-party AI providers.

• Training data. When you create or refresh a model, it keeps prepared examples from your table as context data, with its schema and diagnostics, for each version. They are kept until you delete the model; archiving keeps them.
• Prediction and forecast data. Inputs and outputs are used to return the result. Depending on your plan’s data policy, they are also archived in encrypted form.
• Observed outcomes. Outcomes you submit are stored in encrypted form until they are integrated into a model or the model is deleted. They are used to measure performance and update models.
• Idempotency cache. Responses are kept for 24 hours on every plan, so that a retried request is not charged twice.
• Quality telemetry. Aggregate quality indicators are kept for up to 90 days.

Data policies by plan

Each plan has a data policy, published in the data_policy field of the public plans endpoint (GET /v1/plans).

Zero data retention applies to the inputs and outputs of predictions, forecasts, evaluations and backtests. It does not cover the context data a model keeps, the data sent to create or refresh a model, submitted outcomes or the 24-hour idempotency cache.

• Free: training allowed. Data you submit may be reused to train and improve Spavik’s models.
• Build: no training. Your data is not reused for training.
• Pro and Growth: zero data retention. Inputs and outputs of predictions, forecasts, evaluations and backtests are not archived, and your data is not reused for training.
• Enterprise: terms negotiated in the contract.

How long data is kept

Account data

Until the account is deleted

Models and context data

Until the model is deleted

Pending outcomes

Until integrated into a model or the model is deleted

Archived inputs and outputs

Up to 12 months

Request logs

90 days

Website hosting logs

Up to 30 days

Quality telemetry

Up to 90 days

Idempotency cache

24 hours

Messages to hello@spavik.co

Up to 3 years after the last exchange

Signup fingerprint

As long as the free grant exists

Billing records

10 years

Providers and hosting

Spavik runs on Google Cloud in the European Union. The API, database, file storage and data warehouse are in Paris (europe-west9); the prediction engine runs in Belgium (europe-west1). Spavik also uses technical providers for caching and request logging, bound by confidentiality and data protection obligations.

• Google Cloud: hosting, databases, file storage, data warehouse and task queues;
• Google: sign-in with Google and the website’s typefaces;
• Stripe: subscriptions, payments and invoices;
• Mailjet: sign-in and service emails;
• MaxMind: estimating the country from the IP address at signup.

Transfers outside the European Union

Google, Stripe and MaxMind are US companies. When their processing involves a transfer of personal data outside the European Economic Area, it relies on the EU-US Data Privacy Framework for certified companies, or on the standard contractual clauses adopted by the European Commission.

Security

An API key only opens its own workspace. Keys are stored as hashes.

Archived inputs and outputs and submitted outcomes are encrypted with AES-256-GCM, using a key for each model that is itself protected by a master key.

Deleting your data

You can delete a model through the REST API (DELETE /v1/models/{id}). Its artefacts are purged from the engine together with its pending outcomes. This cannot be undone. A record of the model is kept for request history and billing.

To delete your account, write to hello@spavik.co from the account’s email address. Deletion is permanent: it cancels your subscription, purges your models and deletes your workspaces, API keys and webhooks.

Archived inputs and outputs and request logs are not erased at that moment: they are deleted at the end of their retention period. Billing records are kept as required by law.

Your rights

Under the GDPR, you may request access to your data, its rectification or erasure, the restriction of its processing or its portability, and object to processing based on legitimate interest.

You can change your name in the platform settings. For any other request, write to hello@spavik.co. Spavik answers within one month and may ask for proof of identity when there is a reasonable doubt. You may also complain to the CNIL, the French data protection authority.

Policy updates

This policy is updated when processing changes. The date of the last update appears at the top of the page, and account holders are informed by email of material changes.