Privacy Policy — 2026-11-07 (archived)

Since 9 October 2026, the service formerly presented as System1 Models has been presented under the Decision Models brand at decisionmodels.io. The provider remains productivity-boost.com Betriebs UG (haftungsbeschränkt) & Co. KG. References to System1 Models and system1models.ai in this document identify the same service. This branding update does not change the provider or the terms of this document.

Last updated: 7 November 2026

This policy explains what personal data we process when you visit system1models.ai, create an account, or use the System1 Models API, dashboard, MCP server or status page (together, the "Service"). It follows Article 13 of the EU General Data Protection Regulation (GDPR).

Short version: our API gateway, database and EU-tier inference stay in the EU. Peer-to-Peer first uses spare EU capacity and may use worldwide Lium GPU capacity only for keys you explicitly opt in. Our API gateway is configured not to write request or response content to its application logs, and our usage database stores usage and billing metadata rather than content; see section 2.4 and Data retention. We use no website analytics, no tracking cookies and no advertising. We keep account, billing and technical usage data only as long as needed or required by law.

1. Who is responsible

The controller is productivity-boost.com Betriebs UG (haftungsbeschränkt) & Co. KG, Reichenberger Str. 2, 94036 Passau, Germany, represented by its general partner productivity-boost.com UG (haftungsbeschränkt), itself represented by its managing director Florian Standhartinger. Email: info@productivity-boost.com, phone +49 178 1981631. Full details: Imprint.

We have not appointed a data protection officer because we are not legally required to. For all privacy questions, write to info@productivity-boost.com.

Content you send to the API is different. When our customers send data to the API (states, questions, images), they decide what data is processed and why. For that data, the customer is the controller and we are its processor under our Data Processing Agreement. If you are affected by such processing, please contact the customer that uses our Service; we will support them. This policy covers the data we process for our own purposes.

2. What we process, why, and on what legal basis

2.1 Delivering the website (server logs)

When you open a page or call the API, your client sends technical data to our servers: IP address, date and time, requested address, referrer, HTTP status, amount of data transferred, and user agent. We need it to deliver the Service and to detect and fend off attacks, abuse and errors.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and working Service.
• Retention: logs containing IP addresses are deleted after 14 days at the latest, unless a specific security incident requires us to keep individual entries longer to investigate it.

2.2 No website analytics

We do not analyse visits to this website and do not use any analytics or tracking service. There are no analytics cookies or beacons, no visitor identifiers, no device fingerprinting and no IP-derived location data. The only technical record of a page view is the server log described in section 2.1.

2.3 Your account

When you create an account, we process your email address, and, if you provide them, your name, company name, billing address, VAT ID and the settings you choose (for example, the per-key default tier and the data retention setting). When you sign in, we process sign-in timestamps and a session identifier.

• Optional sign-in by email: we send a one-time link that expires after 15 minutes. You explicitly confirm sign-in on the link page. Resend delivers these links; see sections 3 and 4. We do not send Google sign-in data or API content to Resend. New accounts must complete the Terms and DPA acceptance in the dashboard before creating an API key. Sessions last up to 365 days and are renewed whenever you use them (rolling); you can revoke all your sessions in the dashboard.
• When Google sign-in is enabled, we request only the openid and email scopes. Google returns a stable account identifier and your verified email address; we do not request profile, Gmail or Drive data and we never receive your password. We store the identifier and email with your account, but do not store the OAuth access token or ID token. We use Google sign-in data to create, authenticate and secure your account, and to contact you about your account, including service emails and invoices. We do not use it for advertising, model inputs or unrelated profiling. Our use follows the Google API Services User Data Policy, including its Limited Use requirements. Google Ireland Limited (Ireland) provides sign-in under its own privacy policy; transfers to Google LLC in the United States may occur as described in section 4.
• Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
• Retention: for as long as the account exists. After you close your account, we delete account data within 30 days, except data we must keep under commercial and tax law (see section 5) and the hash described in section 2.6.

2.4 API keys and usage records

For every API request, we record metadata: request ID, time, API key ID, account, model, tier, number of input tokens, number of decisions, response time, processing status and the price charged. We do not record the content of requests or responses (states, questions, images, probabilities) in logs or databases. API keys are stored only as a cryptographic hash; the full key is shown to you once.

If a request carries the optional Idempotency-Key header, we additionally keep, for 24 hours, a keyed (HMAC) digest of the request body, the request ID, the processing status and the usage receipt, so that a retried request is not processed or charged twice. This record never contains the content of the request or the answer. Legal basis: Art. 6(1)(b) GDPR.

• Purposes: billing, showing you your usage, rate limiting, capacity planning, and detecting misuse.
• Legal basis: Art. 6(1)(b) GDPR for billing and usage display; Art. 6(1)(f) GDPR for security and capacity planning (legitimate interest: a stable and secure Service).
• Retention: detailed usage records for 13 months, then aggregated per day, model and tier without request IDs. Records needed as accounting evidence for an invoice are kept as long as the law requires (section 5).

2.5 Payments and invoices

Top-ups are paid through Stripe. You enter payment details directly with Stripe; we never see your full card number. Stripe tells us the payment status, amount, currency, card brand, the last four digits and the country, and calculates VAT (Stripe Tax). We create invoices with your billing details.

• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, processes payment data. For payment processing and for its own legal duties (such as anti-money-laundering and fraud prevention), Stripe acts as an independent controller; see stripe.com/privacy.
• Legal basis: Art. 6(1)(b) GDPR (payment for the contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations).
• Retention: see section 5.

2.6 Promotional credit and abuse prevention

When we grant promotional credit under section 5.3 of the Terms (currently the starter credit and the first-key credit), we store a keyed one-way hash (HMAC with a secret key) of your verified, normalised email address, together with your account ID and the grant, so that the credit is granted only once per person, including through deleted and re-created accounts. To decide eligibility we also check your account currency, earlier grants on any account with the same address and whether the address belongs to a disposable email service or counts as a test address; for the starter credit also your sign-up source (the "Use" button or an ad), and for the first-key credit whether this is your account's first API key. When no promotional credit offer is active, we create no new hashes.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is preventing fraud and abuse of promotional credit.
• Retention: the hash is kept for 24 months after the credit is granted and then deleted. If you delete your account earlier, we remove the account link and keep only the hash, its date and the type of credit until then.

2.7 Service emails

We send emails that are necessary for the Service: sign-in links, payment receipts, invoices, security notices, status and low-balance notices for dedicated endpoints, and notices of changes to the Service, prices or these documents.

• Legal basis: Art. 6(1)(b) GDPR; for security and legal notices also Art. 6(1)(c) and (f) GDPR.
• If you receive promotional credit, we send at most one factual notice about it per account (amount, expiry date, link to your dashboard). Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is telling you about credit on your account. You can object at any time by writing to info@decisionmodels.io. We then keep your address on a suppression list so that we do not contact you this way again.
• We do not send newsletters or regular marketing emails to your account address unless you have opted in separately. You can withdraw that consent at any time via the link in each email.

2.8 Support and business enquiries

If you write to us, we process your contact details and the content of your message to answer you. If you send us a letter of intent or a request for an individual contract, we process the contact details of the people involved.

If you send a request through a model page or your dashboard, we process your email address, your account reference if you are signed in, the model and option you chose, any text you enter and how you reached us, in order to confirm and answer it by email.

If we contact you first about our Service, we use your business contact details from a public source, such as a company website, a public code repository or a public forum, and the text of our email. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: telling businesses about a service that may suit them). You can object at any time by replying or by writing to info@decisionmodels.io. We then keep your address on a suppression list so that we do not contact you this way again.

• Legal basis: Art. 6(1)(b) GDPR where the message relates to a contract or a request before a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest: answering enquiries and maintaining business relationships).
• Retention: normally three years after the end of the calendar year of the last contact (standard limitation period, § 195 BGB), longer where section 5 requires it.

2.9 Status page

The status page at system1models.ai/status is part of our website; it does not yet report live availability. It is covered by sections 2.1 and 2.2. We do not currently offer email subscriptions to status notifications. If we introduce them, we will process your email address on the basis of your consent (Art. 6(1)(a) GDPR) until you unsubscribe, and we will update this policy first.

3. Recipients

We use the following service providers. Those marked "processor" process data on our instructions. We require an Art. 28 GDPR agreement for customer-data processing before opening that service.

Provider	Purpose	Location	Role
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Hosting of the websites, API gateway and database; encrypted backups	EU (data centre in Helsinki, Finland)	Processor
UpCloud Oy, Helsinki, Finland	GPU servers for inference (always-on capacity for both tiers, plus additional servers for the EU tier when EU capacity is busy); no account or billing data	EU (Finland, data centre FI-HEL2)	Processor
Lium (lium.io), with independent third-party GPU providers	On-demand GPU inference for opted-in Peer-to-Peer keys; no account or billing data	worldwide (third-party GPU providers)	Content sub-processors; transfer conditions in section 4
Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France	Sending service emails (planned; not in use at present)	EU (Paris, France)	Processor, once enabled
Resend (Plus Five Five, Inc., San Francisco, USA)	Sending our emails: sign-in links; account, hosting and promotional-credit notices; notices of changes to our documents; confirmations of and answers to requests you send us; first-contact business emails; top-up and withdrawal confirmations. Recipient address, message and delivery data, including any text you enter in a request and order details such as order ID and amounts; no API content	Sending region Ireland; message content and delivery/account records stored in the USA	Processor for account and contact data under its DPA; SCCs and EU-U.S. Data Privacy Framework
Stripe Payments Europe, Ltd., Dublin, Ireland	Payments, tax calculation, invoices	EU; transfers to Stripe, Inc. (USA) possible	Independent controller for payment processing; processor for invoicing
Google Ireland Limited, Dublin, Ireland	Optional "Sign in with Google"; our mailbox for mail you send to our addresses and for some notices we send (sender, recipient, message, attachments)	EU; transfers to Google LLC (USA) possible	Independent controller
Cloudflare, Inc., San Francisco, USA	DNS for our domains; forwards mail sent to our addresses to our mailbox (sender, recipient, message in transit). Our websites and API do not run through Cloudflare	Global network; USA	Processor under its DPA; SCCs and EU-U.S. Data Privacy Framework

The current list of sub-processors that may process API content is at /legal/subprocessors.

Peer-to-Peer tier: The Peer-to-Peer tier first uses spare EU capacity, with lower priority than EU-tier requests. When that capacity is busy, Peer-to-Peer requests may use on-demand GPU capacity rented through Lium (lium.io). Independent third-party providers operate the GPU hardware in various countries, including outside the EU/EEA. Processing outside the EU happens only for API keys whose customer has explicitly enabled the "Allow worldwide processing" switch. Without that opt-in, Peer-to-Peer requests stay on EU capacity and may be queued or rejected with a retryable error when busy. EU-tier requests always stay in the EU and have priority. Existing customers keep EU-only processing unless they opt in for the individual key. Our API gateway is configured not to write request or response content to its application logs, and our usage database stores usage and billing metadata rather than content. This does not cover operating-system swap or crash dumps on the gateway and TLS-edge host, the rented Peer-to-Peer router, or independent network providers; see Data retention. New content sub-processors remain subject to the notice and objection process in section 6.2 of the DPA.

We do not sell personal data and do not share it with anyone for advertising. Where the law requires it, we pass data to public authorities.

4. Transfers outside the EU/EEA

Our API gateway and database remain in the EU. EU-tier inference and Peer-to-Peer inference without worldwide opt-in stay in the EU. The following services can involve transfers outside the EU/EEA:

• Peer-to-Peer inference via Lium: independent third-party GPU providers operate hardware in various countries, including outside the EU/EEA, for opted-in keys only. Transfers outside the EU/EEA happen only for keys you opted in; you are responsible for not sending personal data on such keys unless an adequate transfer basis applies for your use. The switch itself is not a transfer basis under Chapter V GDPR. We do not assert signed Standard Contractual Clauses or certifications for Lium.
• Stripe: Stripe may transfer data to Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR); Stripe also uses the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Email via Resend: email addresses, messages and delivery records are processed in the USA; the Ireland sending region does not provide EU-only storage. Transfers are covered by Resend’s DPA with Standard Contractual Clauses and its EU-U.S. Data Privacy Framework participation. Its normal email/log retention is 30 days. Resend receives no API request or response content or card details. Its purposes are listed in the table above. Provider data handling.
• Google sign-in (only if you choose it): Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Mail to and from our addresses: Cloudflare forwards mail sent to our addresses to a mailbox at Google, and we send some notices through it. Both may process this mail in the USA. Both participate in the EU-U.S. Data Privacy Framework.

5. Retention required by law

We keep invoices and accounting records for the periods set out in German commercial and tax law: currently eight years for accounting vouchers such as invoices and payment records, and ten years for books, annual financial statements and related records (§ 257 HGB, § 147 AO); six years for business letters. During these periods the data is restricted to these legal purposes.

6. Is providing data required?

To use the Service, you must provide an email address; without it we cannot create an account. For paid top-ups, billing details are required by tax law. Everything else is optional.

7. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Automatic limits — for example, rate limits or rejecting requests when the prepaid balance is exhausted — only apply the rules set out in our Terms.

8. Your rights

You have the right to:

• access your personal data (Art. 15 GDPR),
• have incorrect data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20); you can also view your usage data in the dashboard,
• object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21). We will then stop processing unless we can show compelling legitimate grounds or need the data to establish, exercise or defend legal claims,
• withdraw any consent at any time, with effect for the future (Art. 7(3)); this does not affect processing that happened before you withdrew it.

To use these rights, email info@productivity-boost.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or work, or the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

9. Security

We protect data with the technical and organisational measures described on our Security page: encryption in transit (TLS), hashed API keys, strict separation of customer accounts, minimal logging, and access limited to the people who need it.

10. Cookies

We use no tracking cookies. The dashboard uses strictly necessary cookies to keep you signed in. Details: Cookie statement.

11. Changes

We update this policy when the Service or the law changes. The current version is always available here, with its date at the top. We inform account holders of material changes by email.

Previous versions.