Privacy policy: the agent, the chat and the API.

Who is responsible

The controller is FLEECE AI SASU (932 329 188 R.C.S. Clermont-Ferrand), 10 rue Pierre Poisson, 63400 Chamalières, France — the company that publishes Evanesca. For anything about your data, write to contact@fleeceai.agency. The company's details are in the legal notice.

In a Business workspace, your organisation decides what its members may send. For that content, FLEECE AI acts as its processor, under the data processing agreement the organisation signs with us (GDPR art. 28): the organisation is then the controller, and the one to answer requests about that use.

Your messages are not kept

When you send a message — text, files or images — it travels through Evanesca's servers, which Vercel, a US company, runs in its Paris region, to the operator that runs the model you chose, and the answer comes back the same way. Evanesca holds both in memory only while the answer is written: they are not written to a database, to a disk or to a log, and Evanesca never uses them to train a model — what each operator does with them is set out below. The same rule holds for everything the features below send: a web search, an image, a dictation, an agent's task.

Your conversation history is stored in your browser, on your device — not on our servers. You can delete it at any time; on a shared computer, delete it before you leave. Since Evanesca has no copy, it cannot recover a lost conversation, read one, or hand one over to anyone.

Images you add lose their metadata — location, device — in your browser, before they are sent. About each answer — and each agent step, image or dictation — Evanesca keeps a billing record and nothing more: what was used, the operator, the tokens or seconds, the cost, the date and time — never the content.

If you write about your health or another sensitive matter, those words are processed only to write the answer, on the basis of your explicit consent, which the chat asks you for once (GDPR art. 9(2)(a)). Saying no does not stop you using the chat: you then leave such details out. An answer is never medical advice.

Web search, images, Agent mode, dictation and memory

• Web search. Web search is off by default. If you switch it on, the queries the model writes, and the addresses of the pages it reads, go to Linkup — Linkup Technologies, a French company whose registered office is in Fresnes —, never your conversation; a query is written from your request, so it can repeat words from it. Evanesca has not verified where its servers run; its own privacy policy applies. In Agent mode too, the agent searches the web only when web search is on.
• Images. Images are made by FLUX.1 [schnell] or, for a portrait from 1 to 4 face photos, by PhotoMaker V2; they run at Infomaniak, in Switzerland. Infomaniak receives the description of the image and, for a portrait, the photos — which, like every image you add, lose their metadata in your browser first. A face photo is personal data: add only photos you are allowed to use. The image comes back to your browser and stays there, with the conversation. Infomaniak states that queries are “neither recorded nor used to train models” (its page).
• Agent mode. In Agent mode, the model you chose carries out a task step by step, with tools: web search, the conversation's files, Word, PDF and Excel documents, images, a to-do list — it never runs code. The task runs on Evanesca's servers: your instructions, the files your browser sends with them and the files the agent writes exist there only in memory, while the task runs; the conversation and its files are kept in your browser. Every model it calls runs in Europe, at its operator, which receives everything the agent sends it — your messages, the content of the files it reads, the results of its tools. It searches the web only if you have switched web search on — its searches and page reads then go to Linkup —, and its images go to Infomaniak, as above. For each task, Evanesca records only what it needs to hold your spending cap and the web-call limits — never any content (see below).
• Dictation. Dictation sends your recording — 60 seconds at most — to Mistral AI, a French company, which turns it into text; the text comes back into the message box, and nothing is sent until you send it. Evanesca keeps no copy of the recording. Mistral AI keeps the input and output of its API — your recording and its transcript included — “for thirty (30) rolling days to monitor abuse” (its privacy policy). Mistral AI lets its customers object to training on them, and Evanesca's account objects.
• Titles, follow-up questions and summaries. To title each new conversation, suggest follow-up questions after a complete answer and summarise a long conversation when it is compressed, the chat makes small calls of its own to Mistral Small 3.2, run by Scaleway (Paris, France) — or, if it is unavailable, to another model run in Europe. They carry the parts of the conversation they need, are billed like messages, and their cost shows in your account's usage history (the follow-ups' cost also under the answer).
• Memory. Memory is off until you switch it on. Then, after each answer, one more of these small calls updates a profile of you, 4,000 characters at most, kept in your browser: you can read it, change it or erase it at any time. The profile is sent with each of your messages, to the model that answers.
• Read-aloud. It uses the voices of your own device: the text never leaves it, and nothing is billed.
• Auto mode. It picks the model for you from signals in your message — an image, code, a long text, a request for deep reasoning —, among the models of the catalogue, all run in Europe, and without any extra call.

What the operators keep

The model's operator receives your message to write the answer. Each applies its own rule; here it is, in its own words:

• OVHcloud (models run in Gravelines) — Zero data retention: We keep only the data required for billing purposes. and Your data is never used to train our models source
• Scaleway (models run in Paris) — By default we apply a Zero Data Retention Policy; but when requests cause unexpected errors or look malicious, Scaleway says it may store temporarily and access the full content of HTTP requests, for up to two weeks. And: Your data is not used for training, retraining, or improving the base models. source
• Mistral AI (Mistral Large 4, Mistral Small 4 and dictation) — except for specific APIs, Mistral AI says it keeps your input and output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse. Its policy also lists input and output among the data it may use to train its models, subject to your opt-out: Mistral AI lets its customers object, and Evanesca's account objects, except for what is sent to Mistral Large 4: it is a preview, and Mistral's commercial terms let it use the data of preview models for training, whatever the objection. source For Mistral Small 4 and dictation, Evanesca's promise that your conversations train no model rests on that objection — one of the conditions for opening the service. source
• AKI.IO (DeepSeek V4.1 Flash, GLM-5.3 and Gemma 4 26B, in Germany) — Prompts, inputs, and generated outputs are processed in volatile memory and are not logged, stored, or analyzed by AKI.IO. And: customer prompts and outputs are not used to train AI models. source What AKI.IO keeps, according to its privacy policy: usage metadata — request ID, model called, status, timestamps, tokens —, for 90 days. source
• Infomaniak (Apertus v1.5 70B, and images) — Your queries are neither recorded nor used to train models or improve our services. source

Mistral Small 3.2 is made by Mistral AI but run by Scaleway: its messages go to Scaleway, not to Mistral AI. Pixtral 12B is made by Mistral AI but run by Scaleway: its messages go to Scaleway, not to Mistral AI.

How each operator is checked: the sovereignty page.

What we process, why, and for how long

You can close your account from your account space, or by writing to us from its address. We then delete your account and everything attached to it — API keys, app connections, usage records, credit purchases, agent tasks. All that remains: if you have credit left, the fingerprint of your address, the former account's identifier and its balance, to give that credit back if you return — it never expires; your withdrawal statements, if any; and, at Stripe, your invoices, as accounting records. Your history, the agent's files and your memory profile are in your browser: the closure page offers to erase this browser's conversations; anywhere else, deleting them is in your hands.

Who receives your data

Authorities receive data only when the law obliges us to hand it over — and we have no message content to give them. AKI.IO in turn relies, for its infrastructure, on AIME GmbH (Berlin), which provides the GPUs, and ScaleUp Technologies GmbH & Co. KG (Hamburg), the data centre — both in Germany, according to its list of sub-processors. The same list is in the legal notice. Business workspaces are told before any change of sub-processor and may object to it (GDPR art. 28(2)).

Transfers outside the EU

Your messages never leave Europe: they are processed in memory on Evanesca's servers, in Vercel's Paris region, then at the European operator of the model you chose. Every model Evanesca serves runs in Europe — in France (Scaleway, OVHcloud as a fallback), in Mistral AI's EU region, in Germany (AKI.IO) or in Switzerland (Infomaniak) — and so does image generation, at Infomaniak. No model call leaves Europe — not as a backup, not when servers are busy.

In Germany, AKI.IO states that inference runs on GPU infrastructure in German data centres and that, under its data processing agreement, “processing of customer-provided inference data is restricted to the EU/EEA and does not take place in third countries” (its FAQ, read on 13 Oct 2026); it confirmed in writing on 13 Oct 2026 that the models it serves run at its highest trust level, in Germany. Its list of sub-processors places AIME GmbH's and ScaleUp Technologies' processing in Germany, with no transfer outside the EU/EEA; an entry in Singapore concerns a marketplace that, according to AKI.IO, has not launched.

Switzerland is not in the European Union, but the European Commission has decided that it protects personal data adequately (Decision 2000/518/EC): personal data may go there without any further safeguard (GDPR art. 45). Infomaniak is a Swiss company with no US parent.

Web search is off by default. If you switch it on, the queries the model writes, and the addresses of the pages it reads, go to Linkup, a French company whose registered office is in Fresnes; Evanesca has not verified where its servers run — its own privacy policy applies.

Four providers are US companies, or pass data to one. This is what may go to the United States:

• Vercel Inc. runs Evanesca's servers in its Paris region; your messages only pass through them in memory. Its data processing agreement says that its primary processing facilities are in the United States: technical logs — IP address, date, page requested — may be processed there.
• Databricks, Inc. (Neon) hosts Evanesca's database in Frankfurt: your account, your balance, your credit purchases, your usage records — with no content at all — and your API key fingerprints. Databricks says it may transfer data to the United States, and Neon relies on Grafana Labs, a US company, for its infrastructure.
• Plus Five Five, Inc. (Resend) sends the emails: your address and the content of those emails — sign-in links, account notices — are handled by this US company (its data processing agreement).
• Stripe Payments Europe, Limited (Ireland) takes the payments and, as its data processing agreement provides, passes data to Stripe, LLC, in the United States.

On which basis: the European Commission has decided that US companies certified under the EU-U.S. Data Privacy Framework protect personal data adequately (Decision (EU) 2023/1795); personal data may go to them without any further safeguard (GDPR art. 45). Vercel Inc., Databricks, Inc. — for Neon, LLC —, Plus Five Five, Inc. (Resend) and Stripe, LLC are listed as certified on the official list, read on 14 Oct 2026. Their data processing agreements also include the Commission's standard contractual clauses (Decision (EU) 2021/914). These companies remain subject to US law, CLOUD Act included: that is why none of your messages is kept there.

Your rights

You may access your data, have it corrected or erased, restrict its use, object to processing based on our legitimate interest, receive the data you gave us in a reusable format, and withdraw a consent at any time (GDPR art. 15 to 22). Under French law, you may also leave instructions on what happens to your data after your death (loi Informatique et Libertés, art. 85).

Write to contact@fleeceai.agency from the address of your account, so that we know the request is yours. We answer within one month; for a complex request, that can be extended by two months, and we will tell you why (GDPR art. 12(3)).

We cannot give you your conversations, the agent's files or your memory profile: we do not have them. They are in your browser, where you can read and delete them yourself.

You may also lodge a complaint with the French data protection authority, the CNIL.

Cookies and browser storage

This website sets no cookies — see the legal notice. The chat uses only what it needs to work: sign-in cookies — to keep you signed in, protect the sign-in and remember the language of the sign-in link — and your browser's storage for your conversation history — with the agent's files and the images generated — and, if you switch memory on, for your profile. All are strictly necessary for the service you ask for, so they need no consent; there are no analytics, advertising or tracking cookies.

Also good to know

• No automated decisions. Evanesca takes no decision about you based solely on automated processing (GDPR art. 22): the answers are yours to use, nothing more. Auto mode picks a model, nothing about you.
• Changes. When this policy changes on a point that matters, we tell account holders by email and on this page, with the new version date.