Privacy notice

1. Controller and contact details

For processing described in this notice, the controller is Netter S.r.l., Via Indipendenza, 06081 Assisi (PG), Italy, VAT no. IT03569900545. Contact info@netter.io with “Privacy” in the subject, or write to the postal address above.

This notice covers llm.netter.io, admin.llm.netter.io and api.llm.netter.io. For personal data in materials an organisation uploads for its own purposes, the organisation determines processing purposes and Netter acts on its behalf under the Data Processing Agreement. For that content, the organisation's notice remains the reference for data subjects.

2. Data and sources

If you choose Google, we receive authorised identifiers and profile data such as name and email through the authentication protocol. Netter does not receive your Google password. Google manages its service under its own notice. If the company creates or invites the account, some data comes from the organisation administrator.

• Data provided by users or company administrators: name, email, role, organisation, contact details and information necessary for registration, support and invoicing.
• Authentication and security data: account identifiers, sessions, protected credentials, second factor if enabled, access events and technical information useful for preventing abuse.
• Operational and accounting data: top-up requests, payment references, receipts, balance, reservations, usage, model/profile used and transaction references. Accounting records do not require prompt text.
• Content supplied during use: prompts, stored responses, attachments, codebases, consulting materials and support communications, as necessary for requested features.
• Technical browsing and device data, such as IP addresses, request characteristics, security outcomes, technical cookies and preferences; push channel data only when enabled.

3. Purposes and legal bases

Data essential to an account or transaction is necessary to provide that service; without it we may be unable to complete it. Optional features, such as push notifications, can be disabled. Acknowledging the notice does not authorise additional commercial purposes.

4. AI processing and content protection

Netter receives the original content needed for the request. In protected text flows, the local PII filter replaces recognised entities before forwarding and keeps encrypted maps to restore values in responses. This is pseudonymisation: it may not recognise every personal datum and does not necessarily make content anonymous.

Images, scans and audio are not covered by the text filter and may reach the provider in their original form. Requests are forwarded only through providers configured for the service. Information about recipients, locations, retention and transfers must be available before the specific service is activated.

The platform does not train Netter's own models on supplied content. Conditions applying to external providers must be defined for each configuration: sending a parameter requesting that a response not be stored is not, on its own, a guarantee about the provider's entire processing.

Available providers depend on enabled model configuration. Supplier identities, locations, retention and terms must be communicated before the relevant processing under the Data Processing Agreement.

5. Recipients and transfers

Authorised Netter personnel, experts assigned to consulting within their assignment and suppliers necessary for hosting, communications, support and compliance may access data. Banks, professionals and authorities may receive relevant data when needed for payment, applicable obligations or defence of rights. Data is not published or sold as part of the service.

The platform infrastructure uses AffordableBytes, which states that its infrastructure is in Frankfurt, Germany. Keycloak identity, service email and ntfy notifications are managed in the Netter stack. If you choose Google or enable browser push delivery, identity or delivery services from that ecosystem also participate, under their notices and applicable roles.

The Netter stack's European location does not mean every AI provider or user-selected service processes data exclusively in the European Economic Area. Transfers subject to Chapter V GDPR require an adequacy decision or appropriate safeguards, with necessary assessments and supplementary measures. Request information about relevant safeguards and an accessible copy of the documentation at info@netter.io, subject to applicable confidentiality limits.

6. Retention

Expiry prevents ordinary access and starts deletion through persistent processes with retries if storage is unavailable. Deletion covers PostgreSQL and chat S3 objects, including object versions. Export and deletion requests remain available in the portal; administrative and accounting obligations follow separate criteria.

PostgreSQL is the authoritative source for conversations. Modified conversations are archived to S3 hourly, with application-level encryption and checksum verification; the latest verified copy and the preceding one are retained within conversation expiry. S3 failure does not extend retention and is reported to operators. Storage uses the configured S3 endpoint s3.fra.databucket.eu; the supplier's contractual details and applicable safeguards are available on request at info@netter.io.

Open WebUI Desktop, Conduit and user-selected development tools may retain local copies, exports and their own sessions. The 90-day period covers Netter server copies: removal from devices and external tools depends on their functions and settings. MCP access is limited to the user's authorised workspace conversations; it does not automatically synchronise development tools' local sessions.

7. Security and automated controls

Measures include HTTPS, organisation- and user-level permission checks, encryption of stored content and PII maps, key protection, optional second factor, traffic limits and HTTP protection. Data access is limited according to duties. No technical measure eliminates every risk.

Automated security controls may reject a request based on IP reputation, traffic volume or abuse indicators. If you believe a block is incorrect, request a review at info@netter.io. AI supplied to customers is not used by Netter to make automatic decisions about employment, credit or other personal rights.

8. Rights and requests

Where provided by law, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. You may withdraw consent for the future without affecting processing before withdrawal. You may also complain to the Italian data protection authority at www.garanteprivacy.it or contact the competent authority.

Write to info@netter.io with your request and contact details. We may request identity confirmation proportionate to the data requested. We respond without undue delay and within applicable deadlines, normally one month; any justified extension is communicated. If the request concerns data processed on your organisation's behalf, we involve it or direct you to the relevant controller.

9. Updates and cookies

This notice may be updated when processing, recipients or features change. Its version and date appear on the page; significant changes are brought to users' attention. The cookie notice describes technical tools and available choices.

10. Web search and computation in chat

The Web search feature can be enabled by the user for each request. The query is sent through Netter's managed SearXNG service to configured engines Brave Search, DuckDuckGo and Wikipedia. These services receive the search text and Netter server IP address; they do not automatically receive the full history, Netter credentials or attachments. Selected public results are included in model context and shown with source references.

The local PII filter is applied to the query before search when required by company policy. With the filter disabled, search text is sent without this transformation. The filter does not guarantee absence of all personal data: avoid confidential information in web searches. External services apply their own terms and notices; Netter does not control their retention.

The Python interpreter runs code in the user's browser, in an environment separate from the Netter session, without access to external networks. Computing packages are distributed by the platform. Code, results and charts included in conversations follow the chat's 90-day retention; downloaded or exported files remain on the device according to the user's choices. HTML previews are isolated and cannot make external requests.