# AI Model Privacy Notice

**Last Updated:** 2026-04-22
**Generated:** Automatically from model registry

---

## Overview

This system uses artificial intelligence (AI) models to process your requests and generate responses. This notice describes which AI models are currently active and how they may process your data.

## Compliance

This notice is provided in accordance with:

- **EU AI Act Article 50 §1**: Transparency obligations for AI systems
- **GDPR Article 13 §1(a)(b)(c) and §2(a)(b)**: Information to be provided where personal data are collected

## Data Controller (GDPR Art. 13 §1(a))

- **Legal entity:** MINION GmbH
- **Registered address:** Berlin, Germany (full registered address on file with the controller)
- **Contact:** privacy@minion.ai

## Data Protection Officer (GDPR Art. 13 §1(b))

- **Email:** dpo@minion.ai
- **Postal address:** Data Protection Officer, MINION GmbH, Berlin, Germany

## Lawful Basis per Processing Purpose (GDPR Art. 13 §1(c))

| Processing Purpose                                                  | Lawful Basis                                                                        | Article           |
| ------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ----------------- |
| Delivering AI responses to your messages                            | Performance of a contract (you requested the service)                               | GDPR Art. 6 §1(b) |
| Routing messages across channel integrations you connect            | Performance of a contract                                                           | GDPR Art. 6 §1(b) |
| Audit logging of agent actions for compliance and incident response | Legitimate interest (security, regulatory audit trail) balanced against user rights | GDPR Art. 6 §1(f) |
| Abuse detection, rate-limit enforcement, and safety review          | Legitimate interest in platform integrity                                           | GDPR Art. 6 §1(f) |
| Optional product analytics and feature improvement                  | Consent (opt-in; withdrawable at any time)                                          | GDPR Art. 6 §1(a) |
| Billing, tax, and statutory record-keeping                          | Legal obligation                                                                    | GDPR Art. 6 §1(c) |

## Active AI Models

This system currently has **3 AI models** registered across **2 providers**.

| Provider  | Model Name                 | Full Model ID                        | Disclosure Text                                                    |
| --------- | -------------------------- | ------------------------------------ | ------------------------------------------------------------------ |
| anthropic | claude-3-5-sonnet-20241022 | anthropic/claude-3-5-sonnet-20241022 | This response was generated by AI model claude-3-5-sonnet-20241022 |
| anthropic | claude-3-5-haiku-20241022  | anthropic/claude-3-5-haiku-20241022  | This response was generated by AI model claude-3-5-haiku-20241022  |
| openai    | gpt-4-turbo                | openai/gpt-4-turbo                   | This response was generated by AI model gpt-4-turbo                |

## How AI Models Are Used

- **Response Generation:** AI models generate text responses to your messages
- **Content Understanding:** Models may analyze text, images, or other media you provide
- **Tool Execution:** Models may call functions or access external data sources
- **Conversation Memory:** Models may reference prior messages in the conversation

## Data Processing

When you interact with this system:

1. **Your input** (text, images, audio, etc.) may be sent to one or more AI model providers
2. **AI providers** process your input using their models
3. **Generated responses** are returned to you through this system
4. **Conversation history** may be stored locally for context

## Model Provider Privacy Policies

Each AI provider has their own privacy policy governing how they handle data:

- **anthropic**: [Privacy Policy](https://www.anthropic.com/privacy)
- **openai**: [Privacy Policy](https://openai.com/privacy)

## Retention Period (GDPR Art. 13 §2(a))

- **Default conversation retention:** 30 days from last activity
- **Audit log retention:** 365 days (required for regulatory audit trail)

**Per-channel overrides:**

| Channel    | Retention    | Notes                                                                  |
| ---------- | ------------ | ---------------------------------------------------------------------- |
| voice-call | 7 days       | Voice transcripts purged after 7 days unless flagged for abuse review. |
| signal     | Not retained | End-to-end encrypted; message bodies not retained by the gateway.      |
| imessage   | Not retained | End-to-end encrypted; message bodies not retained by the gateway.      |

Retention counts from the last interaction on a given thread. Legal holds or active abuse investigations extend retention until the matter is resolved.

## Right to Erasure (GDPR Art. 13 §2(b) / Art. 17)

1. **Email request:** Send an erasure request to dpo@minion.ai including the account identifier and affected channels.
2. **Self-service flow:** An in-product self-service erasure flow is in development; this notice will be updated when it ships.
3. **Response window:** We will confirm receipt within 72 hours and complete the erasure within 30 days, extendable by up to two further months for complex requests (GDPR Art. 12 §3).
4. **Scope:** Erasure covers stored conversation history, audit-log personal data not required for statutory retention, and derived profile data. Upstream AI providers retain data under their own policies — see the model table above for links.

The in-product self-service erasure flow is under development (tracked in MIN-1223 follow-up). Until it ships, submit requests by email and include the account identifier and channels involved.

## Your Rights

Under GDPR and equivalent data protection laws, you have the following rights:

- **Access** (Art. 15): Request information about the personal data we process about you
- **Rectification** (Art. 16): Request correction of inaccurate or incomplete data
- **Erasure** (Art. 17): Request deletion of your data — see procedure above
- **Restriction** (Art. 18): Request that processing be limited in specific circumstances
- **Portability** (Art. 20): Receive your data in a structured, machine-readable format
- **Objection** (Art. 21): Object to processing based on legitimate interest
- **Withdraw consent** (Art. 7 §3): Withdraw consent at any time where processing relies on consent
- **Lodge a complaint** (Art. 77): Complain to your local supervisory authority

Contact dpo@minion.ai to exercise any of these rights.

## Changes to This Notice

This notice is automatically regenerated when AI models are added or updated in the registry. Check the "Last Updated" date at the top of this document.

---

_This notice was automatically generated from the model registry. Do not edit manually._
