Privacy Policy

Effective Date: May 2026

NEXTBIT 256, S.L. (referred to as "us," "our," or "we") values your privacy and strives to safeguard any information you share with us or that we otherwise acquire.

This Privacy Policy explains our approach regarding the Personal Data gathered from you or about you while accessing our websites and services (collectively referred to as the "Services"). This Policy excludes data processed on behalf of our customers in the course of service provision; such data processing is governed by the Nextbit Data Processing Agreement (DPA), available at https://www.nextbit256.com/docs/dpa, which applies automatically when customers use the Services to process personal data of third parties.

Collection of Personal Data

We collect information which, individually or combined with other data available to us, can identify you ("Personal Data"), as detailed below:

Information Provided by You

We gather Personal Data when you register an account or interact with us directly, including:

Account Details: During account creation, we collect relevant information such as your name, contact details, login credentials, payment method details, and your transaction records (collectively "Account Data").

Content Submitted by Users: Utilizing our Services may involve submission of content containing Personal Data, including prompts, inputs and files submitted through the API, and the outputs generated in response (collectively "User Content"). User Content is processed solely to generate the response to each request and is not retained, as described under "Security and Data Retention" below.

Communication Records: If you reach out to us, we may retain your identity details, contact information, and message content ("Communication Data").

Automatically Collected Information

When engaging with our Services, we automatically collect certain data concerning your interactions ("Technical Data"):

Request Metadata: For each API request, we record technical and billing information that does not include User Content, such as timestamps, the model used, token counts, API key identifier, IP address, response status and latency ("Request Metadata").

Log Information: Includes data automatically sent by your browser during website interactions ("Log Data"), comprising your IP address, browser specifics, request dates and times, and interaction patterns.

Usage Information: Covers your interactions with the Services, including viewed or accessed content, utilized features, actions performed, your geographic location, timestamps, device type, browser version, connection details, and IP address.

Device Details: Covers your device model, operating system, and browser specifics, varying based on device types and settings.

Cookies and local storage: We do not use advertising, profiling or third-party tracking cookies. Our website and Platform only use cookies and similar technologies that are necessary for their operation or that store preferences, namely: (i) authentication and session cookies, set only when you log in to the Platform, to keep you signed in and secure your session; (ii) a preference cookie ("userCountry") that stores the country from which you access the website in order to adapt its content, with a duration of twelve (12) months; and (iii) browser local storage used to remember display preferences such as theme and menu settings, which is not transmitted to us. You may delete or block cookies through your browser settings; however, blocking authentication cookies will prevent you from logging in to the Platform.

Web Analytics: We use privacy-friendly web analytics and performance measurement provided by our website hosting provider. These tools do not use cookies, do not track visitors across websites, and do not identify individual visitors; they provide us only with aggregated statistics about website traffic and performance.

Infrastructure and Data Location

Nextbit makes its API available through two endpoints. You choose where your requests are processed by choosing the endpoint you call.

EU Endpoint — https://eu.api.nextbit256.com/v1

Model inference is performed exclusively on infrastructure located in Spain, within the European Union. No third-party infrastructure provider performs inference on, or stores, User Content submitted through the EU Endpoint. The models currently available on the EU Endpoint are listed at https://eu.api.nextbit256.com/v1/models. In the model catalogue on our website, these models are labelled "EU". We will continue adding models to the EU Endpoint over time.

Global Endpoint — https://api.nextbit256.com/v1

Model inference may be performed on compute capacity provided by a third-party cloud infrastructure provider on nodes located outside the European Economic Area (EEA). The models currently available on the Global Endpoint are listed at https://api.nextbit256.com/v1/models. In the model catalogue on our website, these models are labelled "Multi".

API gateway

API traffic to both endpoints is received by an API gateway hosted within the European Union. The gateway handles User Content only transiently, in transit, to route, secure and authenticate requests, and does not store it.

Data residency requirements

If you require that User Content is not processed on inference infrastructure outside the EEA, use the EU Endpoint exclusively. For any other data residency requirement, contact us at [email protected].

International Data Transfers

EU Endpoint. Model inference and storage take place within the EEA. The provider hosting the API gateway used for both endpoints may be incorporated in, or have its parent company established in, a third country (including the United States). To the extent its processing involves a transfer of Personal Data outside the EEA, it is subject to Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU–US Data Privacy Framework (DPF) for providers that have self-certified under it.

Global Endpoint. User Content submitted through the Global Endpoint is processed on infrastructure located outside the EEA. These transfers are subject to Standard Contractual Clauses (SCCs) approved by the European Commission.

Customers who require documentation of the safeguards applicable to their specific data processing may request this by contacting us at [email protected].

Customers should be aware that infrastructure providers, or their parent companies, may be incorporated or operate in third countries and may be subject to the laws of those countries — for example, in the United States, the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 2018) and Section 702 of the Foreign Intelligence Surveillance Act (FISA), as well as comparable laws of other jurisdictions in which infrastructure providers or their corporate groups are established — which may permit public authorities to compel disclosure of data held by those providers, regardless of the physical location of the servers on which such data is processed. This legal reality is not fully mitigated by Standard Contractual Clauses or other contractual transfer safeguards alone. Our commitment not to retain User Content (see "Security and Data Retention") reduces this exposure but cannot eliminate it.

The DPF is subject to ongoing judicial review before the Court of Justice of the European Union and may be invalidated, as occurred with its predecessors (EU–US Safe Harbor in 2015 and EU–US Privacy Shield in 2020). In that event, Nextbit will rely on Standard Contractual Clauses or such other legally recognized transfer mechanisms as remain valid at that time. Nextbit accepts no liability towards customers, users, or any other third party arising from the potential invalidation or modification of the DPF or any other transfer mechanism by a competent court or regulatory authority, provided that Nextbit maintains at all times at least one valid transfer mechanism as required by applicable law.

Customers for whom third-country governmental access represents a material risk — for example, those operating in regulated sectors or handling sensitive personal data — are strongly encouraged to use the EU Endpoint and to contact us at [email protected] to discuss their requirements.

Use of Personal Data

Your Personal Data and User Content will not be used to train, fine-tune or otherwise develop AI models, whether by Nextbit or by any of its providers.

We do not disclose User Content to third parties, except to the infrastructure providers strictly necessary to process your requests as described above, or where required by law, court order or a binding request of a competent public authority.

Nextbit does not intentionally collect or process Special Categories of Personal Data as defined in Article 9 of Regulation (EU) 2016/679 (GDPR), including health data, genetic data, biometric data, data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning a person's sex life or sexual orientation. Submission of such data through the standard Services is prohibited under the Terms of Service. If your use case requires processing Special Categories of Personal Data, you must contact [email protected] and execute a separate written addendum prior to any such use.

Your Personal Data primarily serves the following purposes:

  • Providing and operating our Services, including generating responses to your API requests.
  • Billing, account management and customer support.
  • Analyzing and improving our Services using Account Data, Request Metadata and Technical Data (never User Content).
  • Facilitating communications with you.
  • Protecting against fraud, crime, or misuse, and safeguarding our digital infrastructure.
  • Complying with applicable legal obligations and processes, and defending our legal rights, property, or safety, including those of you or third parties.

AI Act. Nextbit provides AI inference infrastructure and operates as a technical infrastructure provider under Regulation (EU) 2024/1689 (EU AI Act). Customers who use the Services to develop or operate AI systems act as the provider or deployer of those systems under the AI Act and are solely responsible for their own compliance with applicable AI Act obligations. For details, see Section 8.2 of the Terms of Service.

Disclosure of Personal Data

We may share your Personal Data under certain conditions without additional notice unless legally mandated:

Third-party Providers: To support our operational needs, we may share your Personal Data with service providers such as cloud and network infrastructure, IT services, payment processing, email management systems, and website hosting and analytics providers. These third parties process Personal Data solely based on our instructions for specified operational purposes. Infrastructure providers that process User Content are contractually bound not to use it to train or develop any model, not to disclose it to third parties save as required by law, and not to retain it beyond the limits described in this Policy.

Corporate Changes: In the event of strategic transactions such as mergers, reorganizations, bankruptcy proceedings, or transfers of service to another entity ("Transaction"), your Personal Data may be disclosed during the transaction process and transferred along with other assets to a successor or related entity.

Legal Obligations: If required by legal mandates or in good faith belief that disclosure is essential to comply with laws, safeguard our rights, combat fraud, protect user safety, or limit legal liability.

Your Rights

Depending on your geographic location, individuals in regions such as the European Economic Area (the "EEA"), Switzerland, or the United Kingdom (the "UK"), and elsewhere globally, may exercise specific statutory rights concerning their Personal Data, including:

  • Accessing your Personal Data.
  • Deleting your Personal Data.
  • Correcting inaccuracies in your Personal Data.
  • Transferring your Personal Data elsewhere.
  • Withdrawing previously granted consent.
  • Objecting to or limiting data processing where processing relies on legitimate interests.

Because User Content is not retained after each request is completed, we are generally unable to access, retrieve, correct or export User Content once the request has been processed.

You may utilize these rights via your account settings. If unable to do so, contact us at [email protected]. We will respond within the timeframes required by applicable law. EEA residents may also lodge a complaint with their national data protection supervisory authority.

Minors

Our Services do not target individuals under 18 years of age, and we do not knowingly gather Personal Data from minors. If you suspect a minor has provided Personal Data through our Services, please notify us promptly at [email protected] for investigation and potential removal.

Our Services may include external links to third-party websites or social media platforms ("External Sites"). Information disclosed to External Sites is governed by their privacy policies, not this Privacy Policy. Links to External Sites do not imply our endorsement or review; please contact these third-party websites directly for their privacy practices. For instance, you can access Stripe's Privacy Policy here: https://stripe.com/es/privacy

Security and Data Retention

We apply commercially reasonable protective measures — technical, organizational, and administrative — to secure Personal Data against unauthorized access, loss, misuse, or alteration. Nonetheless, internet and email transmissions are never completely secure or error-free. Exercise caution when transmitting sensitive information via email or our Services. We are not accountable for bypassed security settings on our Services or external websites.

User Content — EU Endpoint. We do not store or retain User Content submitted through the EU Endpoint. Prompts, inputs and outputs are processed in memory solely to generate the response and are discarded once the request is completed. They are not written to persistent storage or logs.

User Content — Global Endpoint. Neither Nextbit nor its infrastructure providers retain User Content submitted through the Global Endpoint after the request is completed, save where retention is required by applicable law, in which case it is retained for no longer than thirty (30) days and used for no purpose other than compliance with that legal requirement.

Account Data, Request Metadata and Technical Data. We retain this data only as long as necessary to provide the Services and for legitimate business purposes such as billing, resolving disputes, ensuring security and preventing abuse, and for as long as required to comply with legal obligations (including accounting and tax obligations). Retention periods depend on the nature and sensitivity of the data, the processing purposes, and applicable legal requirements.

Privacy Policy Updates

This Privacy Policy may be periodically updated. Updates will be available on this page unless legally obligated otherwise. Continued use of our Services or provision of Personal Data following posted updates signifies consent to the amended Privacy Policy.

Contact Us

For unresolved questions or concerns regarding this Privacy Policy, please contact us at [email protected].

NEXTBIT 256, S.L. Carrer del Moll de la Duana, s/n, Edificio Lanzadera 46024 Valencia, Spain [email protected] https://www.nextbit256.com

Was this page helpful?