Privacy policy

This policy explains how TOKENSAVER processes personal data collected on the www.tokensaver.fr website (and tokensaver.cloud) and through the TokenSaver platform (console, API, gateway and code editor extension), in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act No. 78-17 of January 6, 1978.

Cookies and trackers are covered by a dedicated policy: the cookie policy.

Controller: TOKENSAVER, SAS with a share capital of €5,000, 130 897 564 R.C.S. Aix-en-Provence, Espace Beauvalle, Bâtiment A, 2 rue Mahatma Gandhi, 13090 Aix-en-Provence, France · contact@tokensaver.fr.

TokenSaver acts as controller for the data of website visitors, prospects and customers (contact, account, billing, business relationship).

For the data our customers send through the platform (prompts, responses, files, documents, call logs of their agents and developers), TokenSaver acts as processor within the meaning of article 28 GDPR, on behalf of and on the instructions of the customer, who is the controller. Data subjects should first contact the customer concerned; TokenSaver assists the customer in handling their requests.

• Contact data: name, email address, company, topic and content of messages sent through the contact form or by email.
• Account data: name, business email address, organization, role, login credentials and API keys (stored securely).
• Billing data: company name, billing address, subscription history. Card data is collected and processed directly by our payment provider Stripe; TokenSaver has no access to it.
• Technical and connection data: IP address, browser or client type, timestamps, connection and API usage logs, call metadata (model, token count, cost, latency, status).
• Data processed on behalf of customers: content of AI model requests and responses, files and RAG documents, agent execution traces, and, with the code editor extension, prompts, paths of generated files and tool calls captured on the developer’s machine.

Directly from you, when you fill in the contact form, create an account, subscribe or write to us; automatically, when you use the platform and the API; and through TokenSaver customers for the data they send through the platform.

TokenSaver does not use its customers’ prompts, responses, files or documents to train artificial intelligence models.

Customers’ requests are sent to the model providers they choose (for example Anthropic, OpenAI, Mistral, Google), usually with their own keys: these providers then process the data under their own terms and policies. Customers can restrict allowed models and enable personal data masking before data reaches the model.

• Authorized TokenSaver staff, within the limits of their duties.
• Our processors: Railway Corporation (platform hosting, data centers in Europe), Vercel Inc. (website hosting), Stripe (payment), Resend (email delivery, including contact form messages), Umami Software (cookieless audience measurement, aggregated statistics), Google (Google Analytics audience measurement, only with your consent).
• The AI model providers selected by each customer, for that customer’s requests only.
• Administrative or judicial authorities, when required by law.
• Your data is never sold or rented.

Platform data is hosted in data centers located in Europe. Some of our processors are established in the United States: when data is transferred there, the transfer is covered by the safeguards of Chapter V GDPR (adequacy decision, in particular the EU–US Data Privacy Framework for certified companies, or European Commission standard contractual clauses).

TokenSaver implements appropriate technical and organizational measures: encrypted communications, access control and permission management, data isolation per organization, logging, secure storage of secrets and key revocation from the console.

You have the following rights over your data:

• right to information and access;
• right to rectification and erasure;
• right to restriction and right to object, in particular to direct marketing;
• right to data portability;
• right to withdraw your consent at any time, where processing is based on consent;
• right to set instructions about what happens to your data after your death (French law).

Write to contact@tokensaver.fr or by post to the registered office. We answer within one month, which may be extended by two months for complex requests. If there is reasonable doubt about your identity, we may ask for proof.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the supervisory authority of your country.

The website and platform are intended for professionals. They are not intended for people under 15, whose data TokenSaver does not knowingly collect.

This policy may change. In case of significant changes, we inform our customers by email or in the console. The last update date is shown at the bottom of the page.