GDPR Notice
Legal basis, data minimisation, EU rights and cross-border transfers for the international edition.
1. Status of this notice
This page records how the international edition is designed to meet GDPR so that the engineering choices are auditable. It is not a substitute for a reviewed privacy notice or a data-processing agreement.
2. Who this applies to
This page addresses users in the EU/EEA using the international edition. The domestic edition is not covered here — see the PIPL section and the Cross-border notice.
3. Roles
| Party | Role | Data |
|---|---|---|
| tokencoup (operating entity TBD) | Controller for gateway account & billing data | Key hash, plan, usage ledger, audit metadata |
| Baidu Qianfan International | Independent upstream provider | Request bodies you send |
| Cloudflare (Pages + AI Gateway) | Infrastructure / edge processor | TLS metadata; not request or response bodies (collect_logs=false) |
| You (B2B customer) | Controller of the content in your prompts | Prompt content |
4. Personal data and legal basis
| Processing | Data | Proposed basis (Art. 6) |
|---|---|---|
| Authenticate & rate limit | Key hash, key id, plan | Contract performance (b), legitimate interest in security (f) |
| Meter & invoice Mode B | Token counts, timestamps, amounts | Contract performance (b), legal obligation for tax records (c) |
| Abuse detection | Audit metadata | Legitimate interest (f) |
| Forward your request | Prompt content | Contract performance (b); not stored by tokencoup |
Special-category data is neither requested nor intended. Do not submit it. No automated decision-making or profiling is performed by tokencoup.
5. Data minimisation by design
log_prompt=false— prompts are not persisted by the gateway.collect_logs=falseon Cloudflare AI Gateway — no request or response bodies stored at the edge.- Gateway keys are stored as SHA-256 hashes, never in plaintext.
- Audit records contain only edition, mode, key id and token counts.
- Requests are tagged
X-Data-Region: overseas.
These are implemented in gateway/config.py, gateway/auth.py and gateway/common.py. See the API reference.
6. Your rights
- Access (Art. 15) and rectification (Art. 16).
- Erasure (Art. 17) and restriction (Art. 18).
- Data portability (Art. 20) for data you provided.
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent at any time, where consent is the basis (Art. 7(3)).
- Lodge a complaint with your supervisory authority (Art. 77).
7. International transfers
The EU has no adequacy decision for mainland China (confirmed 2026-10). A transfer of EU personal data to China would require EU Standard Contractual Clauses (2021/914), a transfer impact assessment under Schrems II, and supplementary technical measures.
The S1 design is intended to avoid that transfer: EU/US traffic is routed through an overseas gateway to the Qianfan International upstream, with the goal that no data enters mainland China. This is a design target, not a verified fact. The upstream's actual data-residency region has not been confirmed in writing, and third-party due diligence (Kaamel, terms checked to 2026-09-17) reports that some Qianfan International personal data is stored in China and that no public DPA is available. Until Baidu confirms residency and a DPA/SCC package is executed, EU personal data must not be sent through the live service. S3 — an international request using a domestic Qianfan key — is blocked in code with 403 key_edition_mismatch.
8. Sub-processors
| Sub-processor | Function | Location | Status |
|---|---|---|---|
| Cloudflare Pages | Static hosting / CDN | Global edge | In use |
| Cloudflare AI Gateway | Edge cache, rate limit, retry | Cloudflare edge | Resource created; custom provider pending |
| Baidu Qianfan International | Model inference upstream | Overseas node — unverified | To be confirmed |
| Payment provider | Billing | — | Not selected (Stripe / Paddle TBD) |
9. Retention and breach notification
Retention periods are not fixed; the C2 plan proposes 30 days for operational metadata, with billing records kept for statutory tax periods. A personal-data breach notification procedure targeting the 72-hour deadline (Art. 33) is not implemented.
10. DPO, EU representative and contact
Whether a Data Protection Officer (Art. 37) or an EU representative (Art. 27) is required depends on the final entity, scale and target market — all undecided. No DPO, representative or data-request address has been appointed.