Legal
Privacy Policy
How AI Stupid Level handles personal data: what we collect, why, who sees it, how long we keep it, and how to exercise your rights. Last updated 19 October 2026.
01
Who we are
AI Stupid Level (aistupidlevel.info, “ASL”, “we”) is operated by S.C. STUDIO PLATFORMS S.R.L., Craiova, Dolj County, Romania. We are the controller of the personal data described here. Contact: hello@aistupidlevel.info.
This policy covers the website, your account, paid plans, the Smart Router (/v1), the Data API, workspaces, the forum and our emails. It applies under the EU General Data Protection Regulation (GDPR) and Romanian law.
02
What we collect
- Account
- Your email address, name, a password hash (bcrypt; we never store the password itself), whether your email is confirmed, your plan, and the settings you choose (watchlists, alerts, layout, routing preferences).
- Sign in with Google or GitHub
- If you use it: the email address, name and profile picture that Google or GitHub share with us, and their account ID for you.
- Payments
- Handled by Stripe. We never see or store your card number. We keep your Stripe customer and subscription IDs, your plan and its dates, and records of purchases.
- Smart Router and Data API
- The router keys and Data API keys you create, the provider keys you add (encrypted), and a record of each request. See the next section.
- Workspaces
- Members and roles, projects, budgets, invitations, single sign-on and SCIM settings, and an audit log of workspace actions (who did what, with the IP address and browser it came from).
- Forum
- Your posts and your forum username. Posts are public.
- Contact form
- Your name, email, company, topic and message, with the IP address and browser the message came from (to stop abuse of the form).
- Emails we send
- Who we sent which email to and whether it was delivered: account emails (confirmation, password reset), alerts you subscribe to, receipts for assessments, and occasional service emails.
- Site visits
- For each page view: IP address, browser (user agent), the page, the referring page, the time, and the country and city derived from the IP address using a database on our own server. No third party sees this.
- Benchmark runs with your keys
- If you use Test your keys or fund a community run with your own provider key: the results and the models tested. The key is used for that run.
We do not buy personal data, we do not sell it, and we do not use it for advertising.
03
Smart Router traffic
The router passes your requests to the AI provider you hold a key for. It does not keep your prompts unless you turn that on.
- Your requests and the answers
- Pass through our server on their way to and from the provider. They are not stored, except as described in the rows below.
- Prompt logging (off by default)
- If you turn it on in API monitoring, for your account or for one key, we store the last user message of each request, encrypted with AES-256-GCM, after automatically removing API keys and tokens, email addresses, phone numbers and other strings that look like secrets. It is deleted after your retention setting (90 days unless you change it). You can view it, delete one prompt or delete all of them at any time.
- Request records
- For every request: time, router key, requested and selected model, provider, routing reason, token counts, latency, cost estimate, success or error, and any fallback. These power your dashboard, budgets and analytics. Your plan sets how far back you can see them (3 days on Free and Pro, 30 on Developer, 90 on Teams, 365 on Enterprise).
- Retry protection
- If you send an
Idempotency-Key, the response is kept for 24 hours so that a retry gets the same answer instead of a second charge. - Tool calls
- To continue a multi-step tool conversation on the same model, the model’s own turn data is kept, encrypted, for 24 hours.
- Provider keys
- Stored encrypted with AES-256-GCM and decrypted only to make your requests. You can remove them at any time.
- The AI provider
- Receives your request under your own key and processes it under its own terms and privacy policy, as if you had called it directly. You choose which providers we may route to.
04
Why, and on what legal basis
- To provide the service (contract, Art. 6(1)(b) GDPR)
- Your account, sign-in, plans and payments, the Smart Router, Data API, workspaces, alerts you ask for, and support.
- To meet legal duties (Art. 6(1)(c))
- Keeping accounting and tax records, and answering lawful requests from authorities.
- Our legitimate interests (Art. 6(1)(f))
- Keeping the service secure and stopping abuse (rate limits, blocking scrapers and bots), counting visits and where they come from, fixing faults, and telling customers about important changes to the service.
- Your consent (Art. 6(1)(a))
- Google Analytics cookies, and prompt logging when you turn it on. You can withdraw consent at any time; that does not affect what happened before.
06
Transfers outside the EU
Our server is in the EU. Stripe, Google and GitHub may process data in the United States; they rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. When you route a request to an AI provider, it goes where that provider processes requests (for example the US, or China for DeepSeek, Moonshot and Zhipu), under your agreement with that provider.
07
How long we keep it
- Account and settings
- Until you delete your account (Settings, Delete account). Deleting it removes your data from both our databases; your forum posts stay, credited to “Deleted user”.
- Request records
- While your account exists. Deleted with your account.
- Logged prompts
- Your retention setting, 90 days by default. Only if you turned logging on.
- Retry protection and tool-call turns
- 24 hours.
- Site visits (IP address, browser, page, location)
- 90 days. After that only daily totals remain (visits, unique visitors, top pages and top countries), with no IP addresses.
- Web server logs
- 14 days.
- Mail server logs
- About four weeks.
- Payment and accounting records
- As long as Romanian accounting and tax law requires (up to 10 years).
- Contact messages
- As long as we need them to answer and follow up. Ask and we delete yours.
- Backups
- Nightly database backups, kept for 7 days on the same server.
09
Security
Traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Provider keys and logged prompts are encrypted with AES-256-GCM. Access to the server is restricted, the firewall only opens the ports the service needs, and repeated failed logins are blocked. If a breach puts your data at risk, we will notify the Romanian supervisory authority within 72 hours and tell you without undue delay where the law requires it.
10
Your rights
- Access and a copy
- Ask what we hold about you and get a copy.
- Correction
- Fix data that is wrong. Most of it you can change yourself in Settings.
- Deletion
- Delete your account in Settings, or ask us.
- Restriction and objection
- Ask us to pause or stop processing based on our legitimate interests.
- Portability
- Get the data you gave us in a machine-readable format.
- Withdraw consent
- Cookie settings in the footer for analytics; API monitoring for prompt logging.
- Complain
- To the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), or the authority where you live or work.
Email hello@aistupidlevel.info from the address on your account. We answer within one month, and we may ask you to confirm who you are first.
11
Children
ASL is a tool for developers and businesses and is not meant for children. You must be at least 16 to create an account. If you believe a child has given us personal data, tell us and we will delete it.
12
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your data, we will tell account holders by email before it takes effect.
Questions about your data?
Write to hello@aistupidlevel.info or use the contact form. We answer privacy requests within one month.