This is an old version of the document, which expired on December 5, 2025. The current version is available at: https://docs.tokenfactory.nebius.com/legal/privacy-policyDocumentation Index
Fetch the complete documentation index at: https://docs.tokenfactory.nebius.com/llms.txt
Use this file to discover all available pages before exploring further.
Introduction
This Privacy Policy applies to the personal data that Nebius B.V., a company incorporated under the laws of the Netherlands and having its registered office at Schiphol Boulevard 165, 1118 BG Schiphol, the Netherlands (“Nebius,” “we,” “us,” or “our”), processes as a controller in connection with the Nebius Token Factory services (“Services”). This Privacy Policy does not apply to:- Job applicants. If you are applying for a position with Nebius, please see our separate HR Privacy Policy: https://docs.nebius.com/legal/hr-privacy-policy.
- Third‑party offerings. Any products, services, or content provided by third parties even other Nebius group entities are governed by their own privacy policies.
Terms and Definitions
This Privacy Policy uses the key terms as defined by the EU General Data Protection Regulation (GDPR). Unless we explicitly state otherwise, these terms carry the same meanings and must be interpreted in accordance with the GDPR. Under the “Learn more” button, you can review detailed definitions of the terminology we use.1. Personal Data We Collect
1.1. Personal Data You Provide to Us
Registration. When you register to use our Services, you provide us with the following data:- Full name
- Contact information, such as email address and phone number
- Job title
- Company name
- Company size
- Industry
- Any other information you supply in the registration form
- Inference planning: Data we can ask on intended use case and/or inference consumption to classify the user
- Speculative decoding: Input(s) and output(s) for the purpose of training smaller models as specified in the Terms of Service
- Payment details
- Billing address (street, city, state/province, postal code, country)
- Tax/VAT identification, if required for invoicing
- Transaction records (dates, amounts, invoice/order numbers, payment status)
- Additional payment-related details you provide
- First name
- Last name
- Email address
- Phone number
- Job title
- Company name
- Company website
- Scenario you’re interested in (e.g. infrastructure or inference as a service)
- Any other information you decide to share
- A partially obscured copy of your government‑issued ID, showing only:
- Your photograph
- Your full name and surname
- Your nationality
- The place and type of document
- The first four digits of the document number
- Any other information necessary to complete our KYC checks
1.2. Personal Data We Collect Automatically
Service Use. When you use our Services, we automatically collect and generate metadata needed to provide, administer, and improve those services. This may include:- User identifiers and authentication credentials
- Resource identifiers and related attributes
- IP addresses
- Operational status, software errors, and crash reports
- Quality and performance metrics (e.g., latency, throughput, uptime)
- Other technical details essential for the operation, maintenance, and troubleshooting of our Services
- Marketing preferences
- Zero data retention status
1.3. Submissions on Behalf of Others
When you provide information on behalf of another person or entity whether during registration or through any other interaction you confirm that you are authorized to:- Supply and process the submitted details for that person or entity;
- Grant us the right to collect, use, and retain their information in accordance with this Privacy Policy.
1.4. Sensitive Personal Data
We do not intentionally collect sensitive personal data (e.g., information revealing race, ethnicity, political opinions, religion, or similar) and ask that data subjects refrain from submitting such information.2. Why We Process Your Personal Data
We collect and use personal data only for purposes that are necessary to:- Process your requests and queries
- Verify your identity if you contact us
- Send you our newsletter
- Enhance the performance and content of our websites
- Tailor our services and websites to your preferences
- Analyze trends
- Comply with applicable laws
- Protect us and our users/customers from fraud or other illegal activities
- Provide timely feedback to your questions and requests and/or take the necessary steps to conclude an agreement with you
- Deliver our Services, including creating, updating, and personalizing your account; enabling accessibility features; processing payments; performing all operations required to provide and maintain the Services; handling support requests and other inquiries; sending notifications about Service changes; and supplying information relevant to your use of the Services
- Develop, improve, and secure our Services, including speculative decoding
- Evaluate the effectiveness of our promotional campaigns so we can better tailor them to your interests
- Conduct analytics, statistics, development, and research, including sharing aggregated statistical data with our business partners and affiliates
- Comply with legal obligations, judicial enforcement, and administrative orders under applicable law
- Protect and enforce our rights, privacy, security, safety, systems, and property as well as those of other persons we are responsible for and to resolve disputes
- Verify your identity during onboarding as part of our KYC (Know-Your-Customer) checks, authenticate you as an authorized user of the Services, and detect or prevent possible fraud
- Perform audits and internal checks to ensure our processes comply with legal, contractual, and regulatory requirements
Consent where required by law
In certain jurisdictions outside the EEA, local laws may require your explicit consent before we process your personal data. By accessing, browsing, or using our websites, you agree to the processing of your personal data as outlined in this Privacy Policy. You may withdraw your consent at any time your withdrawal will not affect the legality of any processing carried out before you withdrew it.| Purpose of processing | Legal Basis | Example |
|---|---|---|
| Send you our marketing newsletters | Consent | Monthly newsletter about new Nebius Token Factory features, sent only after prior opt‑in |
| Improve website performance and content | Legitimate interest to improve website performance and content and optimize user experience | Analyzing page‑load times on the Nebius Token Factory (platform) and optimizing server responses |
| Analyze trends | Legitimate interest in analyzing usage trends to anticipate infrastructure needs, and deliver data-driven service enhancements | Shift in query types: e.g., from simple prompts to fine-tuning requests |
| Comply with applicable laws and regulations | Legal obligation | Retaining financial records to meet tax audit requirements |
| Deliver our services: create/update/personalize your account; process payments; handle support; send service notifications; finalize contracts with you | Contract performance | Registering a new Nebius Token Factory customer, and charging the service fee |
| Verify identity during onboarding (KYC checks) | Legal obligation | Performing customer verification checks to comply with anti‑money‑laundering regulations |
3. To Whom We Disclose Your Personal Data
We may share certain personal data with the following recipients, as required or permitted by applicable law and our legitimate interests:- Nebius Group:
For the purposes of providing and developing our services, we may share your personal data within the Nebius Group. - Service providers:
We engage third‑party providers to help deliver our Services such as for maintenance, auditing, payment processing, customer support, marketing, and development. These providers may access the personal data they need solely to perform their tasks on our behalf, and they’re contractually prohibited from using or disclosing it for any other purpose. If you purchase Nebius services, we may also use a payment provider who may independently collect additional information about you (for example, for fraud prevention or compliance with legal requirements). - Marketing and analytics providers:
With your prior consent, we may share data with marketing and analytics providers (e.g., Google Analytics) to understand and improve how you use our website. - Legal Disclosures:
We may disclose your information if required by law, subpoena, or other legal process - or whenever we have a good‑faith belief that disclosure is necessary to:- Investigate, prevent, or take action on suspected or actual unlawful activities, or to assist law‑enforcement agencies.
- Enforce our agreements with you.
- Defend against third‑party claims or allegations.
- Protect the security or integrity of our services or those of our affiliates.
- Safeguard the rights, safety, or property of Nebius, our users, employees, or others.
- Change in Control or Sale:
We can also share your personal data as part of a sale, merger or change in control, or in preparation for any of these events. Any other entity which buys us or part of our business will have the right to continue to use your data, but only in the manner set out in this Privacy Policy or as required by law.
4. Your Rights
According to the GDPR, you have certain rights as a data subject, including the right to access, right to data portability, right to rectification, right to withdraw consent, right to object, right to erasure, right to restriction of processing, right to lodge a complaint, and right to contact a Data Protection Authority (DPA). Please be aware that there may be limitations or exceptions to these rights, depending on the specific circumstances and legal requirements. If anything is unclear, please don’t hesitate to contact us and ask any questions. Below, you can find more information about these rights and how you can exercise them. Once you submit a request, we will review and respond promptly - typically within 30 days. In certain cases, we may need additional time to investigate and fulfil your request. Once completed, we will confirm via the email address you provided. By submitting a request, you confirm that you are the individual to whom the data relates and that you have the legal capacity and authority to act on your own behalf. We may verify your identity using the information you supply if there is any doubt. Additionally, where required by law, we may need to share your request and our response with third parties, including regulatory authorities.5. Retention of Your Personal Data
We retain your personal data only for as long as it is necessary to fulfil the scopes described in this Privacy Policy. The exact length of time may vary depending on the type of data, the scope of processing, the category of users involved and - most importantly- whether we are compelled to retain certain personal data due to, for example, tax requirements or other legal obligations under applicable law, fraud‑prevention or safety considerations. When we process partially obscured copies of your ID, we retain them for a maximum of 18 months in order to maintain the necessary records for our yearly audits. Please consider that non‑personal data may be retained and used by Nebius without limitation, in particular for archiving purposes, public‑interest, statistical, historical or scientific research purposes.6. Overseas Personal Data Transfers
We store your personal data in our data centres in the European Union. However, as a global organization, we may also process and transfer your personal data to other group companies or to third parties around the world for the purposes set out in this Privacy Policy - specifically, to fulfil our agreements with you, to respond to your requests, or, where applicable, based on your consent. Whenever we transfer your personal data outside the EU and EEA, we ensure its protection by implementing appropriate safeguards, including:- adopting the European Commission’s Standard Contractual Clauses (and their approved equivalents for Switzerland and the UK), or other approved transfer mechanisms;
- encrypting personal data in transit;
- maintaining internal policies to restrict access and promote awareness.
7. Cookies
As outlined in our Cookie Policy, we use cookies and similar technologies such as pixels, ad tags and local storage to improve your experience, provide convenience, maintain security and serve you tailored ads. For simplicity, we call all these tools “cookies.” In practice, cookies support functions like authentication, security, feature enablement, advertising and analytics. There are two types of cookies: first‑party cookies set by us, and third‑party cookies set by our vetted partners. We collect marketing and analytics cookies based on your consent obtained via the cookie banner. If you’ve granted consent for cookies, you may modify or withdraw that consent at any time via the “Manage cookies” option on our websites.Third‑Party Services
Certain features of the websites are provided by third parties. These providers may collect information about your online activity to deliver personalized advertisements for products and services that might interest you. In addition, your activity on our websites may enable third parties such as search engines to infer your interests and show you tailored ads as you browse. Any data collection and processing by these third parties is governed solely by their own privacy policies, for which they are fully responsible. Nebius disclaims all liability for their practices. Please consult each third party’s Privacy Policy for more details.8. Security of Your Personal Data
Nebius maintains a dedicated security team and employs a combination of technical, administrative and physical controls to safeguard the personal data we process. We continually update and rigorously test these measures to ensure they remain state‑of‑the‑art. However, no system is completely impervious to attack, and no internet transmission can be guaranteed secure. While we strive to protect your data, we cannot promise that unauthorized access, hacking, data loss or other breaches will never occur. Any transmission of information is at your own risk.9. State- or Country-Specific Provisions
9.1. United States of America
A. Privacy Information for California Residents
This section of the Privacy Policy applies only to California residents. If you are a California resident, this section will prevail over other parts of the Privacy Policy in case of any discrepancies. To avoid any misunderstanding, personal information has the same meaning as personal data. Personal Information Collected over the Last 12 Months Personal information we collected directly from you:| Categories of data collected | Data collected from you and why it was collected |
|---|---|
| Characteristics of protected classifications under California or Federal law | We do not intentionally collect any information on your protected classifications |
| Commercial information | Records of services with Nebius |
| Precise Geolocation Data | We do not collect precise geolocation data |
| Financial Information | Payment and Billing Information. Please note that Nebius relies on third‑party payment providers to handle your payments and does not retain your payment information |
| Biometric Data | We do not collect biometric data |
| Audio, electronic, visual, thermal, olfactory, or similar information | Audio may be recorded during online calls, provided that the party being recorded has given their consent |
| Internet/Network Activity | Internet Protocol address (IP address), browser type and language, sending and exiting pages, information about the date and time stamps, information about visits, logs |
| Professional or Employment-related Information | Field of activity or occupation, job title, and company name |
| Education Information | We do not collect Education Information |
| Device Information | Operating system, browser type, device ID (with consent) |
| Categories of Data Disclosed | Types of Entities to Which Data Was Disclosed | Reason for Disclosure of Data | Categories of Recipients |
|---|---|---|---|
| Commercial information, Financial information, Internet/Network Activity Professional or Employment-related Information, Audio Information, Device Information | Please see section 3 with the detailed description | Please see section 2 with the detailed description | Please see section 3 with the detailed description |
- Disclosure of Direct Marketers
- Right to Information About Collecting, Selling, Sharing, or Disclosing Personal Information
- Right to Opt-Out of the Sale of Personal Information
- Right to Non-Discrimination
- Submitting a Verifiable Request under the CCPA
- Submitting a request through an authorized agent
- Submitting a Request for Removal of Minor Information
B. Privacy Information for Residents of other States (Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia)
Unless otherwise stated by the law of your state of residence, the provisions in Chapter A “Privacy Information for California Residents” will apply to the processing of your data. If you have questions related to your rights or any other aspects of this Privacy Policy, please contact us using the methods outlined in Section 14. Your Rights under various United Sates state data privacy laws such as the Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Indiana Consumer Data Protection Act, Iowa Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire SB 255, New Jersey SB 332, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act. For residents from the states of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia this section allows you to exercise your rights under the applicable state law.- Right to Confirm: The right to confirm whether your personal data is being processed.
- Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing of your data.
- Right to Data Portability: the right to obtain, move, copy, or transfer data as defined by applicable law.
- Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
- Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
- Right to Opt-Out: The right to opt out of the processing of your personal data for targeted advertising, as defined by applicable law as well as the right to opt out of the processing of sensitive data as defined by applicable law. Certain applicable laws also permit the right to opt out of the sale of personal data and profiling.
- Right to Appeal: You may also have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request.
- Submitting a Verifiable Request under the United States’ State Laws.
C. Profiling Disclosure
We do not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act.D. Data Protection Assessments
Nebius will conduct all necessary data protection assessments for all applicable processing or other activities when required by applicable law9.2. Israel
This section provides additional information for residents of Israel in accordance with the Protection of Privacy Law, 5741-1981 as amended by Amendment No. 13, 5774–2024 (the “PPL”). Terminology: For the purpose of this section, the term “Information” is used, which is equivalent to “Personal Data” under the GDPR. Local Representative: For purposes of the Protection of Privacy Law, our appointed local representative in Israel is: Nebius Israel Ltd Yigal Alon Street 94, 1 Alon Tower, 39 floor, Tel-Aviv, Israel (Attn: Privacy Office) Email: privacy@nebius.com Supervisory Authority: You have the right to lodge a complaint with the Israeli Privacy Protection Authority at any time by using the contact details specified here.10. Children
Our websites and services are not intended for use by individuals under the age of 18. We do not knowingly collect or process personal data from anyone under 18. If you are a parent or guardian of a minor and believe we have collected their data, you may contact us to exercise their rights as described in this Privacy Policy.11. Difficulty Accessing this Privacy Policy
If you have a disability and cannot access our Privacy Policy online, please contact us (using the details in the Section 14) to request a copy in an alternative, more accessible format. We will not collect or process any health‑related or other sensitive personal data in connection with such requests.12. Changes
Our business is continually evolving, and we may update this Privacy Policy to reflect those changes. We’ll post any revised version on our website, so we encourage you to review it periodically. If we make any material changes, we will notify you.13. Contact Us
If you have any questions or concerns about your privacy, you may contact us or our data protection officer by writing to us at: Nebius B.V., Schiphol Boulevard 165, 1118 BG Schiphol, the Netherlands (Attn: Privacy Office), or by emailing us at privacy@nebius.com.Web address: https://docs.tokenfactory.nebius.com/legal/privacy-policy Publication date: August 12, 2025
Effective date: August 12, 2025