Privacy Policy
This Privacy Policy explains how Offchain Holding B.V., trading as Divergent Labs, with its registered office at Oudezijds Voorburgwal 171, Amsterdam, the Netherlands (“Divergent Labs”, “we”, “us”), processes personal data when you visit our websites or use our services (the “Services”), and the rights you have in that respect under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection law.
1. Scope and our role
1.1 Controller. We are the controller of personal data we process to operate our business, including data relating to account holders, users of our Services, visitors to our websites, prospective customers, and persons who contact us.
1.2 Processor. When our customers submit data to the Services, such as code, datasets, files, prompts and model output (“Customer Content”), we process any personal data it contains on behalf of the customer, as processor. That processing is governed by our Data Processing Agreement and the customer’s own privacy notice. If your personal data is contained in Customer Content, please direct your request to the relevant customer. We will assist them in responding.
2. Personal data we process
2.1 Account data. Your name, email address, authentication data (such as hashed passwords and public keys registered for passkey or SSH sign-in), the organisations you belong to and your role in them, and invitations you send or receive.
2.2 Billing data. Your organisation’s plan, balance, transaction history and billing details, including the billing address and tax identification number you provide. Card payments are processed by our payment service provider. We receive only limited card information (such as the card brand and last four digits) and do not store full card numbers.
2.3 Usage data. Information about your use of the Services, including the resources you create and consume, their duration and cost, and, for model inference, the model used and the volume of tokens processed. We do not retain the content of prompts or model responses for models we offer on a per-token basis, other than as necessary to transmit them.
2.4 Technical and security data. IP addresses, device and browser information, timestamps, and records of authentication attempts and API requests, collected in server logs and used to secure the Services.
2.5 Communications. The content of correspondence you send us and our replies.
2.6 Website and early-access data. Our hosting provider collects technical data when you visit our websites. If you apply for early access, we collect the information you enter in the application form, such as your name, email address and company.
3. Purposes and legal bases
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Providing the Services, creating and administering accounts, authenticating users | Account, usage, technical | Performance of a contract (art. 6(1)(b) GDPR) |
| Billing, payment collection and invoicing | Billing, usage | Performance of a contract (art. 6(1)(b) GDPR) |
| Bookkeeping and compliance with tax law | Billing | Legal obligation (art. 6(1)(c) GDPR) |
| Sending service communications, such as account notices and changes to our terms | Account | Performance of a contract (art. 6(1)(b) GDPR) |
| Security of the Services, and preventing fraud, abuse and breaches of our terms | Technical, usage, account | Legitimate interests (art. 6(1)(f) GDPR) in protecting our Services, customers and third parties |
| Responding to enquiries | Communications, account | Performance of a contract, or legitimate interests where you are not a customer |
| Analysing aggregated usage to maintain and improve the Services | Usage | Legitimate interests (art. 6(1)(f) GDPR) in developing our Services |
| Processing early-access applications | Early-access data | Consent (art. 6(1)(a) GDPR) |
| Establishing, exercising or defending legal claims | All categories, as relevant | Legitimate interests (art. 6(1)(f) GDPR) |
Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. We do not send direct marketing without your consent.
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of article 22 GDPR.
4. Cookies and similar technologies
Our websites do not use cookies or analytics tools. The dashboard uses only cookies and local storage that are strictly necessary to provide the service you request, such as keeping you signed in and remembering your display preferences. These do not require consent.
5. Recipients
5.1 We share personal data with the following categories of service providers, which process it on our behalf and under our instructions, bound by a data processing agreement:
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure hosting | Germany (EU) |
| PlanetScale, Inc. | Database hosting | Germany (EU) |
| Mistral AI SAS | Model inference | European Union |
| Plus Five Five, Inc. (Resend) | Transactional email | United States |
| Vercel Inc. | Website hosting | United States and global |
| Tally BV | Forms | Belgium (EU) |
5.2 Our payment service provider, Stripe Payments Europe, Ltd. (Ireland), acts as an independent controller for the payment data it processes. Its privacy policy is available at stripe.com/privacy.
5.3 We may also disclose personal data where required by law or by order of a competent authority; where necessary to establish, exercise or defend legal claims or to protect the rights, property or safety of any person; and to a successor in the event of a merger, acquisition or transfer of all or part of our business, subject to that successor’s continued compliance with this Privacy Policy.
5.4 We do not sell personal data.
6. International transfers
Where personal data is transferred to a recipient in a country outside the European Economic Area that is not subject to an adequacy decision of the European Commission, we ensure the transfer is subject to appropriate safeguards within the meaning of chapter V GDPR. These are, where available, the recipient’s certification under the EU–US Data Privacy Framework, and otherwise the standard contractual clauses adopted by the European Commission, together with supplementary measures where required. You may request a copy of the relevant safeguards by contacting us.
7. Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting and reporting obligations:
| Category | Retention period |
|---|---|
| Account data | For the duration of your account, and up to 30 days after its closure |
| Billing data and financial records | Seven years, in accordance with Dutch tax law |
| Usage data | For the duration of your account; to the extent part of financial records, seven years |
| Technical and security data | Up to 90 days, or longer where needed to investigate a specific incident |
| Communications | Up to two years after the matter is closed |
| Early-access data | Until you withdraw consent, and no longer than two years |
Where data is required for the establishment, exercise or defence of legal claims, we may retain it for as long as necessary for that purpose.
8. Your rights
8.1 Subject to the conditions set out in the GDPR, you have the right to request access to, rectification or erasure of your personal data, restriction of its processing, and to receive it in a structured, commonly used and machine-readable format. You have the right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.
8.2 To exercise these rights, contact us at nick@divergentlabs.xyz. We may need to verify your identity before responding. We will respond within one month of receipt, which may be extended by two further months where necessary in view of the complexity or number of requests.
8.3 You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. In the Netherlands, this is the Autoriteit Persoonsgegevens.
9. Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including encryption, access controls, logical separation of customer data, and secure development and operating practices. In the event of a personal data breach, we will notify the supervisory authority and affected individuals where required by the GDPR.
10. Children
The Services are not directed at persons under 18 years of age, and we do not knowingly collect their personal data. If you believe we have collected such data, please contact us and we will delete it.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date of the latest version is shown at the top. We will notify account holders by email of changes that materially affect the processing of their personal data before they take effect.
12. Contact
Offchain Holding B.V. Oudezijds Voorburgwal 171 Amsterdam, the Netherlands nick@divergentlabs.xyz