Privacy Policy

Last updated: November 5, 2026

Last Updated: November 5, 2026
Effective Date: November 5, 2026

1. INTRODUCTION

Welcome to Test AI Models. We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains:

What data we collect
How we use it
Your rights under GDPR and other privacy laws
How to contact us

By using Test AI Models, you agree to this Privacy Policy.

2. WHO WE ARE

Business Name: Marko Milojkovic PR Digital M2

Registration Number: 67812549

VAT Number: 114733003

Registered Address: Karadjordjeva 272, 34220 Lapovo, Serbia

Website: https://testaimodels.com

Email: info@testaimodels.com

Payment Processor: Paddle (Paddle.com Market Limited) is our Merchant of Record. Paddle handles all payment data and we never see your credit card information.

Marko Milojkovic PR Digital M2 is the controller of the personal data described in this notice. Paddle acts as an independent controller for payment data.

3. WHAT DATA WE COLLECT

3.1 Account Information

When you register, we collect:

Email address (required for login and communication)
Password (hashed and encrypted, we never see plaintext)
Name (optional)
Account creation date
Email verification status (whether you confirmed your email)

3.2 Test Data

When you use the Platform, we collect:

Prompts and system prompts (the text you submit to AI models), including text you pull in from a .docx, .txt or .md file
Images you upload, and the page images of any PDF you attach
AI responses (outputs from ChatGPT, Claude, Gemini, etc.)
Chat tests: your messages and each model's replies
Model selections and settings (for example reasoning effort, max tokens, temperature)
Workflows, alerts, projects and quality-check rules you create
Savings inputs, if you enter them (the model you use today and your monthly bill)
Timestamps (when tests were run)
Cost data (credits consumed, per-model costs)
Speed data (response times in seconds)
User feedback (good or bad output ratings, and the winner you choose with a reason picked from a list)
Use case category (the task type, labelled automatically from your prompt: classification, extraction, summarization, etc.)

3.3 Usage Data

We collect technical data needed to run and secure the Platform:

IP address and request details (inherent to every web request)
Browser type and version
Device information (OS, screen size)
Feature usage in the app (for example runs and credits spent)
Subscription status (Pay as you go or PRO)
Credits balance and usage
Where your sign-up came from: when you click a sign-up button on our website, the link carries the website, the place of the button (for example nav, hero, pricing or blog) and the page. When you create your account, we also note the name of the site your browser says you came from (the site name only, never a page or search). We store these with your account to understand which pages bring people in. They are kept in your account record and travel in the sign-in service's own session cookie after you sign in; the app adds no separate cookie for them

On our marketing website only, and only if you accept analytics cookies, we also collect pages visited and session duration (see Section 14). The app itself loads no analytics, advertising or tracking scripts.

3.4 Payment Data (Handled by Paddle)

We do NOT collect or store:

Credit card numbers
CVV codes
Bank account details
Billing addresses (Paddle collects this for tax purposes)

Paddle collects payment data as our payment processor. See Paddle's Privacy Policy: https://paddle.com/legal/privacy

3.5 Cookies and Tracking

We use cookies for:

Essential functions: Login, session management (required)
Security and reliability: error reporting (Sentry) and bot protection (Cloudflare Turnstile) on the sign-in and sign-up pages, which we treat as strictly necessary
Analytics: Usage tracking via PostHog on our marketing website only (opt-in, disabled by default)

See Section 14 for cookie details.

4. HOW WE USE YOUR DATA

4.1 To Provide the Platform

Create and manage your account
Run AI model tests and display results
Track model test balance and API credits usage
Calculate costs and generate cost projections
Send email confirmations (password resets, account verification)
Run the scheduled checks you set up (smart alerts and workflow alerts) and email you the results
Warn you by email when your credit balance is too low for a scheduled check

4.2 To Improve the Platform

Analyze usage patterns (which features are popular)
Identify bugs and errors
Improve performance
Develop new features based on user behavior
A/B test new features

4.3 To Communicate with You

Send transactional emails (password resets, account confirmations, alert emails you set up, low-credit warnings)
Notify you of important Platform updates (security issues, Terms changes)
Respond to support requests
Send optional product updates (you can opt-out)

4.4 To Generate Community Benchmarks

We automatically collect and aggregate the following data from ALL tests:

Speed: How fast each model responded
Cost: How much each model cost
Model selected: Which AI models users chose
Use case category: What users are building (the task type)
Reason for selection: Why users chose a winner (picked from a fixed list, never free text)

Thumbs up and down ratings are stored but are not used for benchmarks.

The public Community Picks page shows winner counts and reasons. Signed-in users also see platform-wide win rates, average cost and speed per model, and the top model per task. No prompts, answers, names or organization details are shown.

This data is used to create public benchmarks like:

"For code generation, Claude was selected 57% of the time"
"Average cost for customer support prompts: $0.04"
"Gemini Flash is 2x faster than GPT-4o for summaries"

We DO NOT publicly share:

Your exact prompt text
Your name, email, or account information
Any personally identifiable information

Current Status:

By default, your tests contribute to community benchmarks; you can turn this off at any time in Settings, Privacy ("Share my test results for community benchmarks")
In the app, the public Community Picks page shows which model people choose as winner for each kind of task, with no accounts, no names and no prompt text
When the toggle is off, your tests no longer contribute to benchmark statistics

4.5 For Legal Compliance

Comply with laws and regulations (GDPR, tax laws, etc.)
Respond to legal requests (subpoenas, court orders)
Protect our rights and property
Prevent fraud and abuse
Investigate policy violations

5. WHAT WE NEVER DO WITH YOUR DATA

5.1 We Don't Train AI Models on Your Data

We do not use your prompts or results to train or fine-tune AI models
We're a pass-through platform: prompts go to the providers you pick, only to run your test
What those providers do with data sent through their APIs is set by their own terms, which we do not control (see 6.1)
Separately, we may use anonymized aggregate statistics for community benchmarks (see 4.4 and 17); you can turn that off in Settings

5.2 We NEVER Sell Your Data

Your data is not for sale
We don't share data with advertisers
We don't monetize your information
We don't participate in data broker networks

5.3 We NEVER Show Your Exact Prompts Publicly

Your prompts remain private
Community benchmarks are aggregated and anonymized
We only share statistical patterns (e.g., "57% chose Claude"), not your content

6. DATA SHARING AND THIRD PARTIES

6.1 Third-Party AI Providers

When you run a test, we send your prompt, system prompt, chat messages and any attached image or document text to the provider of each model you select:

OpenAI (for ChatGPT tests)
Anthropic (for Claude tests)
Google (for Gemini tests)
xAI (for Grok tests)
Mistral AI (for Mistral tests)
Moonshot AI (for Kimi tests)
DeepSeek (for DeepSeek tests)
Alibaba Cloud (for Qwen tests)
Perplexity (for Perplexity tests)

Each provider has their own data policies:

OpenAI: https://openai.com/policies/privacy-policy
Anthropic: https://www.anthropic.com/legal/privacy
Google: https://policies.google.com/privacy
xAI: https://x.ai/legal/privacy-policy
Mistral: https://legal.mistral.ai/terms/commercial-terms-of-service
Moonshot AI (Kimi): https://platform.kimi.ai/docs/agreement/userprivacy
DeepSeek: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
Alibaba Cloud (Qwen): https://www.alibabacloud.com/help/en/model-studio/faq-about-alibaba-cloud-model-studio
Perplexity: https://docs.perplexity.ai/docs/resources/privacy-security

Providers differ. Some keep data sent through their API for a period for abuse monitoring, some say they may use content to improve their services unless you have a separate agreement, and some store or process data outside the EU, for example in Asia or North America. Read the terms of each provider you use, and do not send personal or sensitive data to a provider whose terms you have not reviewed.

Some features also call a model on your behalf: quality check (judge models read your answers and your pass rule), AI summary, prompt tidy-up and the winner assistant. They send the relevant prompt and answers to the model they use, which can belong to any provider above. A model is never used to judge an answer from its own provider.

When you start a new test, we also send its prompt once to Mistral AI, a French company, to label the task type automatically. A prompt of up to 1,500 characters is sent whole; a longer one is sent as its first 900 and last 600 characters. Only prompt text is sent, never images or PDF pages. This happens once per new test, even if you did not pick a Mistral model, and it costs you a few credits. Mistral may process this request outside the EU. Mistral's policy is linked above.

We have no control over what these providers do with your prompts. Review their privacy policies to understand their data practices.

6.2 Payment Processor (Paddle)

Paddle processes all payments and subscriptions
Paddle collects: payment details, billing address, VAT number (if applicable)
We receive: transaction confirmation, customer ID, subscription status
See Paddle Privacy Policy: https://paddle.com/legal/privacy

6.3 Service Providers

We use third-party services for:

Database, accounts and file storage: Supabase (Frankfurt, Germany, EU region)
App hosting and logs: Vercel
Rate limiting: Upstash (EU region), counters only, no prompt or output content
Email: Brevo (transactional emails, password resets, alert emails)
Error monitoring: Sentry (error reports with request bodies, cookies and personal details removed, plus an internal user id)
Bot protection: Cloudflare Turnstile on the sign-in and sign-up pages
Analytics: PostHog on our marketing website only (usage tracking, opt-in only)

These providers have access to data necessary to perform their services but cannot use it for other purposes.

6.4 Legal Requirements

We may disclose data if required by:

Court orders or subpoenas
Law enforcement requests
Compliance with legal obligations (tax reporting, etc.)
Protection of our rights or safety
Prevention of fraud or policy violations

7. DATA RETENTION

7.1 Test Results and Prompts

All plans: Test results are stored until you delete them (we don't auto-delete)
You can delete individual tests, workflows or workflow steps, or your whole account, anytime
Deleting a test removes its results from our live systems and removes its uploaded images, unless another test or workflow step still uses the same upload
Copies may remain in our database backups until they expire in the normal backup cycle

Note: We do NOT automatically delete tests after 3 days or any other period. All your tests remain accessible unless you delete them.

7.2 Account Data

Stored until you delete your account
If you delete your account, your login, profile, tests, results, chat messages, workflows, alerts, projects, API keys and uploaded images are removed when you confirm
Copies in backups and at third parties (for example AI providers) roll off on their own schedules

7.3 API Credits Balance

Credits (signup gift, purchased and monthly PRO credits): Balance preserved indefinitely (even if you cancel PRO)
The credit ledger is kept as a financial record (see 7.4)

7.4 Payment Records

Required for tax compliance and fraud prevention
Retained for 7 years after final transaction (legal requirement)
Cannot be deleted even if you delete your account
Cost records (which model ran, tokens, cost and latency, with no prompt or output text) are kept with your identity removed when you delete your account
To stop one person registering again under alias addresses, we keep a one-way hash of your normalized email address (not the address itself) after you delete your account

7.5 Aggregate Statistics

Once data is anonymized and aggregated, it's no longer linked to you
Aggregate stats are retained indefinitely for benchmarks

8. DATA SECURITY

8.1 How We Protect Your Data

Encryption in transit: All data transmitted via HTTPS (SSL/TLS)
EU hosting: Database and file storage are hosted in Frankfurt, Germany
Account isolation: Database row-level security so one customer's account cannot read another's data
Password hashing: Passwords are hashed, we never see plaintext
API key protection: Our provider API keys stored on our servers only, never exposed in the browser
Access controls: Access to production data is limited to platform administrators and the people who hold our hosting credentials
Support access: Platform administrators can view an account as the user to give support, but cannot run billed tests as you
Regular security updates: Platform updated for security patches

8.2 No System Is 100% Secure

Despite our efforts, no internet transmission is completely secure
You use the Platform at your own risk
We're not liable for data breaches caused by third parties or factors beyond our control

8.3 Data Breach Notification

If we discover a data breach affecting your personal data:

We'll notify affected users without undue delay when the breach is likely to put them at risk
We'll report to the relevant authority where the law requires it (under GDPR, within 72 hours of becoming aware)
We'll take steps to mitigate the breach
We'll provide guidance on protecting yourself

9. YOUR PRIVACY RIGHTS

Under GDPR (and similar privacy laws), you have the following rights:

9.1 Right to Access

Request a copy of your personal data
We'll provide data in machine-readable format (JSON or CSV)
Free of charge (first request)
Response within 30 days

9.2 Right to Deletion ("Right to be Forgotten")

Delete your account and all associated data
Use "Delete account" in your account settings
Or email us at info@testaimodels.com and we will respond within 30 days
Deleting your account in settings removes your data when you confirm

What's deleted:

Account information (email, password)
All tests, prompts, results and chat messages
Workflows, alerts, projects and API keys
Uploaded images and PDF page images
Usage data
Preferences

What's NOT deleted:

Payment records and the credit ledger (required by law for 7 years)
Cost records, with your identity removed
A one-way hash of your normalized email, kept only to prevent repeat sign-ups under alias addresses
Anonymized aggregate statistics (no longer linked to you)
Copies at AI providers and other third parties, and in backups, which we cannot delete directly; we will ask them to delete where your data could be there

9.3 Right to Portability

Export your data in machine-readable format
Currently: Not yet implemented
Future: "Download My Data" button (planned)
Workaround: Contact info@testaimodels.com for manual export

9.4 Right to Rectification

Correct inaccurate or incomplete data
Update your email or name in account settings
Note: You cannot change your email address after registration (security measure)

9.5 Right to Restriction

Limit how we process your data
Contact us to discuss restrictions
Example: Stop using your data for community benchmarks (Settings, Privacy)

9.6 Right to Object

Object to data processing for specific purposes
Benchmarks: your tests contribute by default, and you can turn this off at any time in Settings, Privacy ("Share my test results for community benchmarks")
You can always object to marketing emails (unsubscribe link)

9.7 Right to Withdraw Consent

Withdraw consent for optional data processing anytime
Example: Disable analytics cookies in account settings
This doesn't affect lawfulness of past processing

9.8 How to Exercise Your Rights

Email us at info@testaimodels.com with subject "GDPR Request" and specify:

Which right you want to exercise
Your registered email address
What data you want accessed/deleted/corrected

We'll respond within 30 days.

10. DATA PROCESSING AND LEGAL BASIS

10.1 Legal Basis for Processing (GDPR)

We process your data based on:

Contract Performance:

To provide the Platform service you signed up for
To process payments and manage subscriptions
To deliver test results and features you requested

Legitimate Interests:

To improve the Platform based on usage patterns
To prevent fraud and abuse
To generate anonymous community benchmarks
To maintain security and prevent attacks

Consent:

Optional analytics cookies (PostHog) - opt-in required
Optional marketing emails - opt-in required

Legal Obligations:

Tax compliance (payment records, VAT)
Responding to legal requests (subpoenas, court orders)
GDPR compliance (data protection)

10.2 International Data Transfers

Our database, accounts and file storage are hosted in the EU (Frankfurt, Germany)
We operate from Serbia, so our team accesses data from Serbia
The AI providers you choose to test may process your prompts outside the EU, including in the United States and Asia; their own policies explain what safeguards they use
Paddle (payment processor) complies with GDPR for payment data

10.3 Data Processing Agreement

The service providers that process data for us are listed in Section 6.3
You can ask about the data processing terms we have with a specific provider by emailing info@testaimodels.com

11. CHILDREN'S PRIVACY

The Platform is NOT intended for users under 18 years old
We don't knowingly collect data from children
No age verification: We rely on users being honest about their age
If we discover a child's account, we'll delete it immediately
If you're a parent and believe your child created an account, contact us at info@testaimodels.com

12. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you're a California resident, you have additional rights under CCPA:

12.1 Right to Know

What personal data we collect
How we use it
Who we share it with
Covered in Sections 3, 4, and 6 above

12.2 Right to Delete

Request deletion of your personal data
Same as GDPR "Right to Deletion" (Section 9.2)

12.3 Right to Opt-Out of Sale

We don't sell personal data (so nothing to opt-out of)

12.4 Non-Discrimination

We won't discriminate against you for exercising your rights
No price increases, service degradation, or denial of service

To exercise these rights, email info@testaimodels.com with subject "CCPA Request."

13. CHANGES TO THIS PRIVACY POLICY

13.1 How We Update

We may update this Privacy Policy to reflect:
New features or data practices
Legal requirements
User feedback

13.2 Notification of Changes

We'll notify you of significant changes via:
Email to your registered address
Platform notification banner
Updated "Last Updated" date at top of this page

13.3 Effective Date

Changes take effect 30 days after notification, except the update dated November 5, 2026, which takes effect on that date
Continued use after changes means you accept the new policy
Material changes require explicit consent

14. COOKIES AND TRACKING

14.1 Essential Cookies (Required)

These cookies are necessary for the Platform to function:

Session cookies: Keep you logged in
Security cookies: Prevent CSRF attacks, secure authentication
Preference cookies: Remember your settings (theme, language)
Bot protection (Cloudflare Turnstile) on the sign-in and sign-up pages, and error reporting (Sentry), which carry no prompt content

You cannot disable essential cookies. The Platform won't work without them.

Retention: Session cookies expire when you close browser; preference cookies persist for 1 year.

14.2 Analytics Cookies (Opt-In)

These cookies help us understand how you use the Platform:

Provider: PostHog (privacy-friendly analytics), on our marketing website only
Data collected: Pages visited, features used, session duration, errors encountered
No cross-site tracking: We don't track you across other websites
Default: Disabled (you must opt-in)

To enable analytics cookies:

Choose "Accept all" or "Analytics only" in the cookie banner on the website

To disable analytics cookies:

Choose "Reject non-essential" in the cookie banner, or clear this site's stored data in your browser to see the banner again
Or use browser extensions (e.g., uBlock Origin)

The "Accept all" choice also loads the Cal.com booking calendar on the Book demo page. See our Cookie Notice for details.

14.3 No Advertising Cookies

We don't use advertising cookies
We don't track you for ad targeting
We don't share data with ad networks (Google Ads, Facebook Pixel, etc.)

14.4 Managing Cookies

Browser settings:

Chrome: Settings, Privacy and security, Cookies
Firefox: Settings, Privacy & Security, Cookies and Site Data
Safari: Preferences, Privacy, Cookies and website data

Cookie consent banner:

First-time visitors to our website see a cookie consent banner
You can change your choice by clearing this site's stored data in your browser, which shows the banner again

Third-party cookie tools:

Browser extensions: uBlock Origin, Privacy Badger, Cookie AutoDelete
Do Not Track (DNT): We respect DNT signals for analytics cookies

15. DO NOT TRACK (DNT) SIGNALS

Some browsers send "Do Not Track" signals
We respect DNT signals for analytics cookies only
DNT does not affect essential cookies (required for functionality)

16. THIRD-PARTY LINKS

The Platform may link to third-party websites:
AI provider documentation (OpenAI, Anthropic, Google, etc.)
Paddle payment portal
Support resources
We're not responsible for their privacy practices
Review their privacy policies before sharing data
Example third-party links: Paddle Customer Portal, AI provider terms

17. COMMUNITY BENCHMARKS (YOU CAN OPT OUT)

17.1 Current Status

By default, your tests contribute to community benchmarks. You can turn this off at any time (see 17.2).

We collect and aggregate:

Speed (response times)
Cost (per-model pricing)
Model selections (which models users chose)
Use case category
Reason for selection (picked from a fixed list)

Thumbs up and down ratings are stored but are not used for benchmarks.

We DO NOT share:

Your exact prompt text
Your name or email
Any personally identifiable information

17.2 Opt-Out Toggle

Account Settings, Privacy, toggle "Share my test results for community benchmarks"
Default: Enabled (opt-out available)
When disabled: Your tests won't contribute to public statistics

17.3 How Shared Data Is Used

Display aggregate statistics on the Platform (e.g., "Claude wins 57% for code generation")
Publish industry insights on our blog
Help other users make informed model choices
Improve Platform recommendations

18. CONTACT US

18.1 General Privacy Questions

Email: info@testaimodels.com

Website: https://www.testaimodels.com

18.2 GDPR/CCPA Requests

Email: info@testaimodels.com with subject:

"GDPR Request" (for EU residents)
"CCPA Request" (for California residents)

Include:

Your registered email address
Which right you want to exercise (access, deletion, correction, etc.)

18.3 Privacy Contact

For any privacy question, including complex ones, contact us at info@testaimodels.com

By post: Marko Milojkovic PR Digital M2, Karadjordjeva 272, 34220 Lapovo, Serbia

We have not appointed a Data Protection Officer, because none is legally required for a company of our size, but we handle every privacy request seriously.