Last updated: 2026-09-16
Privacy Policy
1. Data controller
Chut, Belgium. Contact: contact@chut.app
2. Data we collect
Account data
Sign-in is handled by Chut's identity service (auth.chut.me, operated by Chut in the EU), which holds your password. upii stores your user id, e-mail address, plan and the SHA-256 hashes of your API keys — never a plaintext key.
API usage data
For each request we record the endpoint, the number of characters processed, the number of entities detected and the latency, linked to the API key. This is metadata only: no request text is stored.
Anonymisation data — text API
Text sent to /anonymize, /batch and /anonymize-document, and to the demo on this site, is processed in memory on our servers and is not stored after the response is returned.
Anonymisation data — dossiers
Documents you upload to a dossier in the dashboard are stored so that you can download the result, propagate entities across the dossier and re-personalise later: the original file (encrypted at rest), the anonymised output, and the entity map that links each placeholder to its original value (encrypted with AES-256-GCM under a per-dossier key). Scanned pages and images are sent to optii.eu for text recognition (section 9). Every reveal, download and re-personalisation is written to an append-only audit log with the acting user and IP address.
3. Cookies
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
pii_access | Essential | 1 hour | Authentication (httpOnly, secure) |
pii_refresh | Essential | 30 days | Keeps you signed in (httpOnly, secure) |
oauth_state | Essential | 10 minutes | Protects the sign-in flow |
lang | Functional | 1 year | Language preference |
cookie_consent | Essential | 1 year | Remember cookie consent |
We do not use any tracking, analytics, or advertising cookies. No third-party cookies. The site loads no third-party resources: fonts are served from upii.eu.
4. Legal basis
- Performance of contract (Art. 6(1)(b) GDPR): processing account data to provide the service.
- Legitimate interest (Art. 6(1)(f) GDPR): aggregated usage statistics to maintain and improve the service.
5. Where your data is processed and stored
All processing and storage take place in the European Union: application servers in Helsinki (Finland) and model inference in Falkenstein (Germany) at Hetzner Online GmbH; database and file storage in Paris (France) at Scaleway SAS; text recognition of scanned pages by optii.eu (EU-hosted). No data is transferred outside the EU. No use of AWS, Azure, GCP, or any other US cloud provider.
6. Retention periods
- Account data: retained until account deletion.
- Usage metadata: retained for as long as the account exists.
- Text API: not retained after the response.
- Dossier originals: at most 90 days after upload (encrypted at rest); earlier on request.
- Anonymised outputs and entity maps: for as long as the dossier exists in your account. Deleting a dossier in the dashboard archives it; the stored files and entity map are erased on request (section 7) — automatic erasure on deletion is not yet in place.
- Audit log: append-only, kept for the life of the account.
7. Your rights
Under the GDPR, you have the following rights:
- Access: obtain a copy of your personal data.
- Rectification: correct inaccurate data.
- Erasure: delete your account and associated data.
- Portability: receive your data in a structured format.
- Objection: object to processing based on legitimate interest.
- Complaint: lodge a complaint with your data protection authority.
To exercise these rights: contact@chut.app
8. Security
Connections between you and upii.eu are encrypted with TLS, terminated at our load balancer. Passwords are held by Chut's identity service; API keys are stored as SHA-256 hashes. Original values in the entity map are encrypted with AES-256-GCM under a per-dossier key derived from a master key kept in a secret manager; original files are encrypted at rest. The links between our application servers, the inference server and the database are being moved to encrypted tunnels; until that work is complete we do not claim end-to-end encryption inside our network. Automated tests exist for the anonymisation pipeline; they do not yet run as a gate on every deployment.
9. Sub-processors
| Sub-processor | Role | Location | Data |
|---|---|---|---|
| Hetzner Online GmbH | Hosting: application servers and model inference | Helsinki (FI), Falkenstein (DE) | Data in processing; no long-term storage |
| Scaleway SAS | Hosting: managed database and object storage | Paris (FR) | Account data, usage metadata, dossier files, encrypted entity maps, audit log |
| optii.eu (operated by Chut) | Text recognition (OCR) of scanned pages and images in dossiers | EU | Page images; not retained after the response |
10. Data flow
| Surface | What is stored | Where | How long | Sub-processor |
|---|---|---|---|---|
| Website pages | Cookies listed in section 3; no analytics | Your browser | See section 3 | None |
Text API and demo (/anonymize, /batch, /anonymize-document, playground) | Nothing from the text; usage metadata (endpoint, character count, entity count, latency) | Database, Paris (FR) | Text: not retained; metadata: see section 6 | Hetzner (processing) |
| Dossier — original document | Encrypted file | Object storage, Paris (FR) | At most 90 days after upload | Hetzner (processing); optii.eu (scanned pages and images only) |
| Dossier — anonymised output | File | Object storage, Paris (FR) | While the dossier exists; erased on request | — |
| Dossier — entity map | Encrypted rows (AES-256-GCM, per-dossier key) | Database, Paris (FR) | While the dossier exists; erased on request | — |
| Dossier — audit log | Action, user, dossier, IP address, time | Database, Paris (FR) | Life of the account | — |
| Account | User id, e-mail, plan, API key hashes | Database, Paris (FR) | Until account deletion | — |
| Model inference | Nothing; text and page content processed in memory | Falkenstein (DE) | Not retained | Hetzner |