Zero Data Retention Statement
NEXTBIT 256, S.L. — Data Handling Attestation
June 2026
1. Purpose and Scope
This statement is issued by NEXTBIT 256, S.L. ("Nextbit") in response to requests from customers and prospective customers seeking attestation of our data retention practices in connection with the use of our AI inference Services.
It summarizes commitments set out in Nextbit's Terms of Service, Privacy Policy and Data Processing Agreement, which are the binding documents. For questions or to request copies of Nextbit's binding data protection agreements, contact [email protected].
2. Service Endpoints
Nextbit's API is available through two endpoints:
| EU Endpoint | Global Endpoint | |
|---|---|---|
| Base URL | https://eu.api.nextbit256.com/v1 | https://api.nextbit256.com/v1 |
| Available models | https://eu.api.nextbit256.com/v1/models | https://api.nextbit256.com/v1/models |
| Label in the website model catalogue | EU | Multi |
| Where inference runs | Spain (EU) | Third-party cloud infrastructure, nodes outside the EEA |
| Third parties performing inference | None | One cloud infrastructure provider |
For both endpoints, API traffic is received by an API gateway hosted within the European Union, which handles request content only transiently, in transit, and does not store it.
3. Summary of Commitments
"Request Content" means prompts, inputs, files, outputs, and any logs containing them.
| Commitment | EU Endpoint | Global Endpoint |
|---|---|---|
| Request Content retained after the request is completed | Never | Never, save where required by law — and then max. 30 days |
| Request Content written to persistent storage or logs | Never | Never, save the legal exception above |
| Request Content used to train, fine-tune or develop AI models | Never | Never (Nextbit and its infrastructure provider) |
| Request Content disclosed to third parties | Never, save where required by law | Never, save to the infrastructure provider processing the request or where required by law |
| Inference performed within the EU | Yes | No |
| International transfer safeguards | SCCs / DPF for the API gateway provider | SCCs |
4. EU Endpoint — Zero Data Retention
Request Content submitted through the EU Endpoint is processed in memory on infrastructure located in Spain for the sole purpose of generating the response, and is discarded once the request has been completed. It is not written to persistent storage or logs, is not accessible to Nextbit personnel after the request is completed, and cannot be retrieved, reproduced or disclosed afterwards — including in response to a legal request — because it no longer exists.
No third-party infrastructure provider performs inference on, or stores, Request Content submitted through the EU Endpoint.
5. Global Endpoint — No Retention, with a Narrow Legal Exception
Request Content submitted through the Global Endpoint is processed on a third-party cloud infrastructure provider's nodes located outside the EEA. Neither Nextbit nor that provider retains Request Content after the request has been completed, save where retention is required by applicable law, in which case it is retained for no longer than thirty (30) days and used for no purpose other than compliance with that legal requirement.
The infrastructure provider is contractually bound (i) not to use Request Content — including prompts, outputs and logs — to train, fine-tune or otherwise develop any model; (ii) not to disclose it to any third party, save as required by law or legal process; and (iii) not to retain it beyond the limits stated above.
6. Request Metadata
To operate, bill and secure the Services, Nextbit records technical metadata for each API request that does not contain Request Content — such as timestamps, model used, token counts, API key identifier, IP address, response status and latency. This metadata is retained for as long as necessary for billing, security, abuse prevention and compliance with legal obligations (including accounting and tax obligations). It is not used for any other purpose.
7. No AI Model Training — Contractual Basis
The prohibition on using customer data for AI model training is a binding contractual commitment, not merely a policy statement. Nextbit's agreements with all customers include the following commitments:
- "Nextbit does not use Request Content to train, fine-tune, evaluate or otherwise develop any AI model, and its infrastructure providers are contractually prohibited from doing so." (Terms of Service, Section 5.3)
- "Your Personal Data and User Content will not be used to train, fine-tune or otherwise develop AI models, whether by Nextbit or by any of its providers." (Privacy Policy)
- "Nextbit does not use Personal Data submitted by the Controller, whether through the EU Endpoint or the Global Endpoint, to train, fine-tune, or otherwise develop any AI model." (Data Processing Agreement, Section 11)
These commitments apply to all customers and all endpoints.
8. International Data Transfers and Governmental Access
EU Endpoint. Inference and storage take place within the EEA. The API gateway provider may be incorporated in, or have its parent company established in, a third country (including the United States); any resulting transfer is covered by Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU–US Data Privacy Framework (DPF).
Global Endpoint. Request Content is processed outside the EEA under SCCs approved by the European Commission (Commission Implementing Decision (EU) 2021/914).
Infrastructure providers, or their parent companies, may be subject to the laws of third countries that allow public authorities to compel access to data. Nextbit's no-retention commitments substantially reduce this exposure, but contractual measures cannot fully eliminate it. Customers for whom third-country governmental access represents a material risk should use the EU Endpoint exclusively.
9. Special Categories of Personal Data
Nextbit's Services are not designed or intended for the processing of Special Categories of Personal Data as defined in Article 9 GDPR (including health data, genetic data, biometric identification data, and data concerning racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or sex life). Submission of such data through the standard Services is prohibited. Customers requiring such processing must execute a separate written addendum with Nextbit prior to use.
10. Customer Rights and Deletion
As Request Content is not retained, there is no Request Content to delete or return upon termination. Upon termination of a customer's agreement with Nextbit, account data and Request Metadata associated with that customer are deleted within 60 calendar days, except where retention is required by law. Customers may also request deletion in writing at any time by contacting [email protected].
Customers retain the right to request information about their data, correct inaccuracies, object to processing, and request data portability, in accordance with applicable data protection law (GDPR, LOPDGDD). All such requests should be directed to [email protected].
11. Enterprise and Custom Arrangements
Customers operating in regulated sectors or with specific compliance requirements — including enhanced audit rights or dedicated infrastructure — are invited to contact Nextbit at [email protected] to discuss available arrangements. Nextbit does not guarantee the availability of any specific custom arrangement but will engage in good faith with customers who present documented compliance requirements.
12. Contact
For questions regarding this statement or Nextbit's data handling practices:
NEXTBIT 256, S.L. Carrer del Moll de la Duana, s/n, Edificio Lanzadera 46024 Valencia, Spain [email protected] https://www.nextbit256.com
This document reflects Nextbit's data handling practices as of June 2026. It may be updated to reflect changes in Nextbit's Services or applicable law. The current version is available upon request from [email protected].