Data Policy

This policy describes what MADD does with the content and metadata of requests sent to MaddLabs at maddlabs.co, including requests routed through a Marketplace such as OpenRouter. The rule is simple: content passes through server memory and is gone.

Zero retention of content

1. MADD does not store prompts, messages, input files or Model outputs. Request and response content exists only in memory for the time needed to generate the response and is discarded once the response is delivered.
2. Content is not written to logs, databases or backups. The API gateway keeps no access log with request addresses or content.
3. Because content is not stored, MADD cannot reconstruct, disclose or hand it over, including at the request of a Customer or an authority.

No training

MADD never uses prompts, outputs or any other Customer Content to train, fine-tune or evaluate models, and does not share it with third parties for such purposes.

Metadata we keep

For billing, capacity planning, reliability statistics and abuse prevention MADD records only the following per request:

Metadata is kept for as long as required for billing and Polish tax and accounting obligations, no longer than 5 years from the end of the year in which the invoice was issued, and is then deleted.

Where processing happens

1. Requests pass through MADD's API gateway on an OVH server in the European Union. The model processes them on a GPU server in one of these places, all within the European Economic Area:
   • Bielik: MADD's own server in Poland;
   • Qwen3.8 27B: a GPU server rented from Runpod in a datacenter in Sweden;
   • Qwen3.5 35B A3B: a GPU server rented from Runpod in a datacenter in Iceland.
2. The country of every model is shown on the Models page and published in the /v1/models endpoint. The full list of providers is on the Subprocessors page.

Requests from a Marketplace

When a request comes through a Marketplace, MADD acts as a processor or subprocessor for the Marketplace and its customers under the agreement with the Marketplace. Zero retention applies in the same way.

Security

All traffic is encrypted: with TLS between the Customer and the API gateway and between the API gateway and Runpod servers, and through an SSH tunnel between the API gateway and MADD's server in Poland. GPU servers do not write request or response content to logs. API access requires a secret API Key, of which MADD stores only a hash. Only the business owner has access to the servers.

Changes

MADD announces material changes to this policy at least 30 days in advance to Customers with active API Keys.

Contact

MADD Marcin Kisielinski, ul. Kajki 10-12, 10-547 Olsztyn, Poland, VAT ID PL7422297084. E-mail: domaai@madd.im, for personal data: prywatnosc@madd.im.