Data handling overview
Draft — not reviewed by legal counsel. Do not rely on this text for compliance decisions until counsel sign-off.
This page gives a short overview of how Steinkauz handles your data. For legal details, see the Privacy Policy and related Legal pages.
Workspace isolation
In the hosted public cloud, your data is organized by active context:
- Personal (Individual) — your individual workspace; no organization required
- Organization — a workspace shared with invited members under common policies and billing
Conversations, files, API keys, provider settings, and routing policy are isolated per context. Switching in the organization switcher changes which workspace you access. See Individuals & Organizations.
For enterprises with dedicated infrastructure or data-sovereignty requirements, Steinkauz also offers private cloud and on-premises deployments by direct arrangement. The application and its data services run in an organization-controlled environment, with infrastructure and identity integration agreed during onboarding. See Deployment options.
What we store
- Chat history and messages — Scoped to your active context so you can see history and continue threads. Stored in line with encryption at rest and retention policies.
- Membership and settings — Email, authentication, roles, billing, subscription, and preferences (provider configuration, routing matrix, tool policies, per-chat sensitivity).
- Usage and activity data — Model usage from web chat and API Access, including token counts, costs, timing, and tool calls. Used to show usage and activity, enforce billing and quotas, and operate the service.
In organizations, conversations are private to each member by default (including in the owner/admin sidebar). Owners and admins may review usage in Usage & Activity; only owners can inspect other members’ prompt/message content for audit.
What we do not do
We do not use your content to train our own AI models. We do not sell your data. Our business is your subscription, not monetizing your conversations or personal data.
Sending data to AI providers
When you chat or use tools, your prompts (and sometimes responses) are sent to the AI provider that serves the model you chose. Each provider has its own privacy policy and data practices.
For stricter control, use zero data retention on Gateway plans and data routing policy: an execution environment on each provider, a D×E routing matrix, and Auto or Manual sensitivity per chat thread — enforced before each request.
With BYOK, you send data to providers whose keys you configured; you are responsible for their terms and policies.
Your control
You can delete data and manage settings for your active context. Restrict providers via Gateway provider configuration or BYOK provider configuration. The routing matrix blocks sends when effective data sensitivity and the provider’s execution environment are not allowed.
Organization owners and admins configure policies for organizations. See Members, roles & invites.
Programmatic access (API Access)
When you call API Access from your own software:
Your application ──HTTPS──► Steinkauz /v1 ──► Your configured AI providers- Authentication uses a Steinkauz API key (Bearer token) created in Settings → API Keys for the active context.
- Prompts and completions follow the same provider routing as web chat, subject to Provider environment floor on API keys.
- Activity records for API requests appear in Usage & Activity alongside chat activity, with API key attribution.
- See the Privacy Policy for metadata we store about API usage.
For encryption and technical safeguards, see Encryption at rest.