Privacy Notice

Who we are

Radiant RX Ltd, trading as Mallard AI, runs an API that serves open-weight AI models to individuals and businesses, directly and through routers.

Name: Radiant RX Ltd
Trading name: Mallard AI
Company number: 15211321
Registered in: England and Wales
Registered office: 45 Chaucer Close, Basingstoke, Hampshire, RG24 9DW, United Kingdom
Email: privacy@mallardai.co.uk
Data protection officer: None. The company's director handles privacy matters.

What this notice covers

This notice covers this website and radiantrx.co.uk, your account, payments and the API. Our other websites each have their own.

We are the controller of our own records: accounts, balances, payments, request metadata and emails. Our role for the content of API requests is under Prompts, images and outputs.

UK GDPR applies to all of this. EU GDPR applies where its rules reach the processing.

Prompts, images and outputs

Zero data retention (ZDR): we don't store your prompts, images or outputs.

A request's content is processed only in our servers' working memory (RAM): the temporary memory a computer uses while it runs a task. Working memory isn't storage. It's cleared as it's reused and when the computer restarts, and nothing in it is saved. Request content is never written to disk or to a database.

We never use prompts, images or outputs to train or improve a model, and we never sell, share or publish them. No one at Radiant RX Ltd reads them.

Our role

We process prompts, images and outputs only to answer the request that carries them. Whoever sends a request decides what is in it.
For a business customer, we are its processor, or its sub-processor where it acts for its own customers. Our Data Processing Agreement sets out the terms.
For a request through a router, we are the router's processor, or its sub-processor.
If you use the API as a consumer, we are the controller of what you send. We process it only to answer you, as our contract with you requires.

Where they are processed

Prompts, images and outputs are processed only in the UK: on our gateway server in London and our own GPU server in England. At busy times, GPU servers we rent from Nebius in London can take requests.

We email customers and routers 30 days before we add or replace a provider that handles request content, or start processing it in a new place.

Caches

To answer repeated prompts faster, the GPU server reuses its work on recent prompts and images from one request to the next. This cache is in working memory only: only the same API key can reuse it, later requests overwrite it, and a restart wipes it. It is never saved.

A request reuses only text or an image identical to what it sent itself, so it gets back nothing it didn't send.
Naming a user or session gives it a cache of its own. Requests through a router share the router's cache, unless the router tells us which of its users or sessions sent them.
Where a cache is shared, a faster reply could show that the same text or image was sent recently.

Error log

If the model server hits an internal error, its error report can include a request's settings, such as its stop sequences or requested output format, and small fragments of its data, but never the prompt's text. It goes only to the GPU server's own log, which is kept in working memory, limited in size and wiped when the server restarts. We don't copy these reports anywhere else. Apart from them, our logs hold no request content.

Images sent as web links

Our gateway server fetches them itself, in the UK, and passes them to the GPU server with the request. The GPU server never fetches them. We fetch only from public web addresses, and we never log the link.

Request metadata

Our gateway logs metadata for each request (no content, image links or IP addresses) and keeps it for up to 30 days. Its fields are listed under What we keep and why.

What we keep and why

Data	Why	Lawful basis	Kept
Request metadata from our gateway: the time, a random request ID, the endpoint, model and status code, whether the response was streamed, timings, token counts, which cache scope applied, how many images it fetched, and a short code for the API key used (the first 8 characters of its hash). It holds no content, image links or IP addresses. Our web server logs nothing about requests	Reliability, capacity planning, preventing abuse, answering questions about a charge	Legitimate interests: running and protecting the service	Up to 30 days in our gateway server's system log, then deleted automatically. The gateway also keeps the last 500 entries in its working memory until it restarts
Your account: your email address and password, when the account was created, and your Stripe customer reference. Our database provider stores the password only in a form that can't be turned back into it. Your API keys: a hash of each, its first 8 characters, its label, and when it was created, last used and revoked	Opening and running your account	Contract; legitimate interests, for the contact at a business customer	Until you delete your account
Your billing details: whether you buy as an individual or for a business; your full name, or the business's name and, if you give them, its company and VAT numbers; a postal address, required for a business and optional for an individual; your country	Your receipts and invoices, and checking we can sell to you	Contract; legal obligation, for our accounts	Until you delete your account. Each receipt and invoice keeps its own copy
Receipts and invoices for top-ups paid to us: your billing details and email address as they were when each was issued, its number, date and amount, how you paid (such as the card's brand and last four digits) and any refund	Your records and ours	Legal obligation: UK company and tax law require us to keep them	While you have an account, and for 7 years after you delete it
Your choices: that you accepted our terms, whether you want news and offers by email, and your automatic top-up settings, each with the wording you saw and when	Showing what you agreed to, and respecting your choice about marketing	Contract, for the terms; legal obligation, to show your consent to marketing	Until you delete your account
Sign-ins: when your account was created and last used, and your sign-ins with their IP address and browser, which our database provider keeps for security	Keeping your account secure	Legitimate interests: keeping accounts secure	Each sign-in until you sign out, and the security log for 90 days. All of it is deleted when you delete your account
Your balance: each top-up (the amount and currency charged, whether you paid in the UK or abroad, the terms version, and any refund or dispute), your usage by API key (each day's requests, tokens and cost, and each charge to your balance as it's made, with no content or request ID), and any adjustment we make	Charging for requests, refunds, answering questions about a charge, our accounts	Contract; legal obligation, for our accounts	While you have an account, and for 7 years after you delete it. Your sign-in details go when you delete it
Free credit, if you get it: a one-way, keyed hash of your email address (as free credit compares them) and one of its domain, the amount, when you got it and, while your account exists, a link to it. We can't turn the hashes back into your address	Giving free credit once per person, and stopping it being claimed again	Legitimate interests: preventing abuse	2 years from when you got it, even if you delete your account
Automatic top-ups, if you turn them on: a reference to the card you saved with Stripe (Stripe keeps the card itself), its brand and last four digits, the balance level and top-up amount you chose, and each automatic charge and how it went	Making the automatic top-ups you asked for	Contract	The card and settings until you remove the card or delete your account. The record of each charge for a year
Your consent at checkout, for individuals: what you agreed to, with the wording you saw and when	Showing that you asked for the credit to start at once	Legal obligation	With the top-up it belongs to
Emails, rights requests and complaints	Replying, support, handling requests and complaints	Legitimate interests: replying and support. Legal obligation, for rights requests and complaints	As long as the matter needs, and at most 2 years after it closes

Where your data comes from

Your account details come from you.
Payment details come from Stripe or Onelink.
Request metadata and usage counts are made by our gateway as requests arrive.

You don't have to give us your details, but we can't open or run an account without them.

Emails

We send the emails that running your account needs:

a link to confirm your email address;
links to reset your password or change your email address;
a notice when your password or email address changes;
a confirmation of each top-up, with its receipt or invoice;
a notice when an API key is created;
a confirmation when you delete your account;
notices about the API, its models, its prices and these documents.

Onelink sends the receipts for payments made outside the UK, the Channel Islands or the Isle of Man.

We send news and offers only if you ask for them, by ticking the box when you create your account or in your account's settings. You can stop them at any time in settings. We keep a record of each choice, as What we keep and why says.

This website

Render hosts our websites. Like any web host, it receives your IP address and your browser's details to send you the pages. Our lawful basis is legitimate interests: running this website.

Videos in our blog posts load from YouTube only when you press play. From then, YouTube (Google) receives your IP address and browser details, and its own privacy policy applies.

If you bought from our online shop, we keep your name, email address, delivery address and what you ordered for 6 years from the end of the financial year, as UK tax law requires.

Payments

In the UK, the Channel Islands or the Isle of Man, Stripe takes your payment for us, on its own checkout page.
Anywhere else, Onelink, part of Stripe, takes the payment as merchant of record. Stripe is then a controller of your payment details in its own right, under its Onelink privacy policy, and shares the order details with us.
We never see your full card number. Your receipts and invoices show the card's brand and last four digits.
If you save a card for automatic top-ups, Stripe keeps it, and we keep only a reference to it.
Both checkouts ask for your billing address. We use its country to check we can sell to you that way.
Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, as its privacy policy explains.

Cookies and browser storage

This site sets no cookies and runs no analytics or advertising. Your browser keeps two things for this site, both needed for what you ask it to do:

Name	What it holds
`darkMode`	Your choice of light or dark theme
`rrx-api-account`	Your sign-in, once you sign in to your account, so you stay signed in. Signing out removes it

Stripe's and Onelink's checkout pages set their own cookies.

Who receives your data

Recipient	Role	Where
Mythic Beasts Ltd (UK company)	Our hosting provider: hosts our gateway server, a virtual server we rent. It has no login access to the server. Request content is on that server only in its working memory. The only request record on its disk is our metadata log. Its network delivers each request to our gateway server, so it carries the caller's IP address. The request stays encrypted until it reaches our server, and we don't log the caller's IP address	London, UK
Nebius B.V. (Netherlands)	Rents us GPU servers in London, used at busy times. They process request content only in working memory, as ours do	London, UK. Its staff may reach its systems from other countries only where needed to run, secure or support them, under the EU's standard contractual clauses with the UK Addendum
Supabase	Our database and sign-in: your account, API key hashes, balance and usage. No prompts or outputs	London, UK
Stripe	Takes payments in the UK, the Channel Islands or the Isle of Man for us, and handles the order details of payments through Onelink. No prompts or outputs	UK, and may process data in the US
Onelink (Sold through Link, LLC, part of Stripe)	Merchant of record for payments from outside the UK, the Channel Islands or the Isle of Man, and a controller of them in its own right. No prompts or outputs	May process data in the US
Resend	Sends our emails: account links, top-up confirmations and notices, and news and offers if you ask for them. No prompts or outputs	EU, and may process data in the US
Google Workspace	Our email, including support and privacy requests, through Google Cloud EMEA Limited. No request data	Google's data centres, which may be outside the UK
Render	Hosts our websites. It receives your IP address and browser details to send you the pages. The API doesn't run on Render	US, through its network of servers worldwide
Routers that send us requests	Receive the outputs they request, and usage figures for billing	Where each router is (for example, the US)

Only our director has access to your personal data. The software tools our director uses to build and run the service, AI assistants included, are never given request content, or your account and billing details or emails. They may read our request metadata, which holds no content.

We never sell your data or share it with advertisers. We disclose it to anyone else only if the law requires it.

International transfers

Request data

We process prompts, images, outputs and request metadata only in the UK, on the servers under Prompts, images and outputs.
We send each output, and usage figures for billing, back to whoever sent the request, on its instructions.
We make no other transfer of request data.

Account, payment and email data

Our account database is in London.
Stripe, Onelink and Resend may process account and payment data in the United States. When they do, it's protected by safeguards recognised under UK law, such as the UK-US Data Bridge or the UK International Data Transfer Addendum.
Our email is with Google Workspace, which may hold it outside the UK. Google's data processing terms include the UK's International Data Transfer Addendum, which covers that.
You can ask us for a copy of these safeguards at privacy@mallardai.co.uk.

Security

Our Security page sets out each measure we take.

Your rights

For our own records, you have the right to:

ask for access to the personal data we hold about you;
ask us to correct it;
ask us to erase it;
ask us to restrict how we use it;
object to processing based on legitimate interests;
withdraw your consent to marketing at any time;
get a portable copy of what you gave us under a contract.

In your account's settings you can change your details and your choice about news and offers, download a copy of your account's data, and delete your account. If you have paid credit left, we close your account for you by email.

For anything else, email privacy@mallardai.co.uk from the address on your account, or write to our registered office. It's free, and we reply within one month.

Data in someone else's request

If your data reached us inside a business customer's or a router's request, that business decides what happens to it. We pass any request about it to that business and help it reply. We don't store request content (see Prompts, images and outputs), so there is usually nothing to find.

Automated decisions

Whether a new account gets free credit is decided automatically, under the conditions in our Terms of Service. We make no other automated decisions about people.

Complaints

If you're unhappy with how we handle your personal data, please complain to us first, by email or by post to the addresses under Who we are. We'll acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to the UK regulator, the Information Commission (still known as the ICO), at ico.org.uk/make-a-complaint. If you are in the EU or EEA, you can also complain to the data protection authority where you live or work.

Changes to this notice

We post changes here with the date, and email customers 30 days before a material change.