AI Model Providers

Version dated 26 September 2026. Annex to the Cyber AI Privacy Policy (https://cyhub.ai/en/privacy), section 6.

To perform a request we send its content (text, files, parameters) to the provider of the model you selected. Your messenger identifier and name, contact details, payment data and IP address are not sent to providers; requests are sent in the Operator's name.

Before your first request to AI models we ask for your separate consent to send request content to these providers (section 13 of the Privacy Policy).

Each provider's role follows its own terms:

• Processor: the provider uses request content only to perform the request and to monitor abuse, and does not train models on it.
• Independent controller: the provider may also use request content for its own purposes, including improving and training models, and is responsible for that processing itself.

KIE.AI

• Company: NEXUSAI SERVICES LLC (United States) and INNOLEAP AI LLC, jointly.
• Receives: requests to Gemini Omni, Banana PRO, Banana 2 Lite, Veo (developer Google), Grok and Grok Imagine (xAI), Images 2 at high quality (OpenAI), Seedance on channel 1 (ByteDance), HappyHorse (Alibaba), MiniMax H3 (MiniMax), Suno (Suno Inc., United States), and part of the AI chat requests (Anthropic). KIE.AI passes the request to the model developer.
• Role: independent controller. KIE.AI's terms allow it to use data to operate and improve its service; they say nothing about model training or retention periods.
• Transfers from the EU/EEA/UK: the provider does not publish a data processing agreement or Standard Contractual Clauses. The transfer happens only when you choose this provider's model and is based on your explicit consent (Art. 49(1)(a) GDPR).
• Terms: https://kie.ai/terms-of-use, https://kie.ai/privacy-policy

OpenAI

• Company: OpenAI OpCo, LLC, United States; OpenAI Ireland Ltd. for the EEA and Switzerland.
• Receives: requests to Images 2 at xhigh and max quality and with a transparent background, prompt checks and translation, and the text chat in the bot (GPT models).
• Role: processor. OpenAI does not use request content for training; abuse-monitoring logs are kept for up to 30 days.
• Transfers from the EU/EEA/UK: data processing addendum with Standard Contractual Clauses.
• Terms: https://openai.com/policies/services-agreement/, https://openai.com/policies/row-privacy-policy/

Anthropic

• Company: Anthropic, PBC, United States; Anthropic Ireland, Limited for the EEA, Switzerland and the UK.
• Receives: AI chat requests to Claude models.
• Role: processor. Anthropic does not train models on request content and deletes API inputs and outputs within 30 days.
• Transfers from the EU/EEA/UK: data processing addendum incorporated into the terms, Standard Contractual Clauses.
• Terms: https://www.anthropic.com/legal/commercial-terms, https://www.anthropic.com/legal/privacy

Google Cloud (Vertex AI)

• Company: Google LLC, United States; Google Cloud EMEA Limited, Ireland, for billing in Europe, the Middle East and Africa.
• Receives: AI chat requests to Gemini models, the text chat in the bot, and voice message transcription.
• Role: processor. Google does not train models on customer data without the customer's permission; abuse-monitoring logs are kept for a limited period.
• Transfers from the EU/EEA/UK: Google Cloud data processing addendum with Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework.
• Terms: https://ai.google.dev/gemini-api/terms, https://cloud.google.com/terms/data-processing-addendum

Google (Gemini app)

• Company: Google LLC, United States; Google Ireland Limited for the EEA and Switzerland.
• Receives: requests to Banana 2 and Gemini Deep Research.
• Role: independent controller. Google uses Gemini app data to improve its models; conversations reviewed by Google staff are kept for up to three years.
• Transfers from the EU/EEA/UK: Google LLC is certified under the EU-US Data Privacy Framework.
• Terms: https://policies.google.com/terms, https://support.google.com/gemini/answer/13594961

xAI

• Company: SpaceXAI LLC (x.AI LLC), United States.
• Receives: requests to Grok Pro (video).
• Role: processor. xAI does not train foundation models on request content and deletes it no later than 30 days after processing.
• Transfers from the EU/EEA/UK: data processing addendum with Standard Contractual Clauses.
• Terms: https://x.ai/legal/terms-of-service-enterprise, https://x.ai/legal/privacy-policy

BytePlus (ByteDance)

• Company: BytePlus Pte. Ltd., Singapore.
• Receives: requests to Seedream and to Seedance on channel 2.
• Role: processor. BytePlus does not train foundation models on customer data.
• Transfers from the EU/EEA/UK: data processing addendum with Standard Contractual Clauses.
• Terms: https://docs.byteplus.com/en/docs/legal/docs-customer-agreement, https://docs.byteplus.com/en/docs/legal/docs-privacy-policy

Kling AI

• Company: Kling AI Pte. Ltd., Singapore.
• Receives: requests to Kling and Kling Motion.
• Role: independent controller. The Kling app terms allow requests to be used to improve and train models. Servers are located in Singapore.
• Transfers from the EU/EEA/UK: the provider does not publish a data processing agreement or Standard Contractual Clauses. The transfer happens only when you choose this provider's model and is based on your explicit consent (Art. 49(1)(a) GDPR).
• Terms: https://kling.ai/docs/user-policy, https://kling.ai/docs/privacy-policy

Wan (Alibaba)

• Company: Intelligent Cloud Computing (Singapore) Private Limited, Singapore.
• Receives: requests to Wan.
• Role: independent controller. Wan may use non-personal request content to develop its models; data is stored in Singapore and mainland China.
• Transfers from the EU/EEA/UK: the provider does not publish a data processing agreement or Standard Contractual Clauses. The transfer happens only when you choose this provider's model and is based on your explicit consent (Art. 49(1)(a) GDPR).
• Terms: https://wan.video/policy/termsofService, https://wan.video/policy/privacyPolicy

Midjourney

• Company: Midjourney, Inc., United States.
• Receives: requests to Midjourney.
• Role: independent controller. Under its terms Midjourney receives a perpetual licence to prompts and outputs.
• Transfers from the EU/EEA/UK: Standard Contractual Clauses.
• Terms: https://docs.midjourney.com/hc/en-us/articles/32083055291277-Terms-of-Service, https://docs.midjourney.com/hc/en-us/articles/32083472637453-Privacy-Policy

ElevenLabs

• Company: Eleven Labs Inc., United States.
• Receives: requests to Elevenlabs (voice-over, voice change, dubbing) and Eleven Music.
• Role: independent controller. ElevenLabs uses content for training unless the customer opts out.
• Transfers from the EU/EEA/UK: data processing addendum; ElevenLabs is certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses also apply.
• Terms: https://elevenlabs.io/terms-of-use, https://elevenlabs.io/privacy-policy

Tripo

• Company: Holymolly Ltd, Hong Kong.
• Receives: requests to Tripo 3D.
• Role: processor. Tripo does not use paid customers' inputs and outputs for training.
• Transfers from the EU/EEA/UK: Standard Contractual Clauses or equivalent safeguards.
• Terms: https://www.tripo3d.ai/terms, https://www.tripo3d.ai/privacy

HeyGen

• Company: HeyGen Technology Inc., United States.
• Receives: requests to HeyGen (lip sync).
• Role: independent controller. HeyGen's standard terms grant it a licence to use data to train its models. Data is stored in the United States.
• Transfers from the EU/EEA/UK: data processing addendum with Standard Contractual Clauses; HeyGen is certified under the EU-US Data Privacy Framework.
• Terms: https://www.heygen.com/terms, https://www.heygen.com/privacy

Black Forest Labs

• Company: Black Forest Labs Inc., United States; BFL GmbH, Germany, for the EU.
• Receives: requests to FLUX 3.
• Role: independent controller. Black Forest Labs may use inputs and outputs to train its models unless the customer opts out.
• Transfers from the EU/EEA/UK: Standard Contractual Clauses.
• Terms: https://bfl.ai/legal/developer-terms-of-service, https://bfl.ai/legal/privacy-policy

Vidu

• Company: ShengShu AI HK Limited, Hong Kong.
• Receives: requests to Vidu.
• Role: independent controller. Vidu's API terms do not describe the use of data for training; data is stored in Singapore.
• Transfers from the EU/EEA/UK: the provider does not publish a data processing agreement or Standard Contractual Clauses for its API. The transfer happens only when you choose this provider's model and is based on your explicit consent (Art. 49(1)(a) GDPR).
• Terms: https://platform.vidu.com/docs/terms-of-use, https://platform.vidu.com/docs/privacy-policy

Recraft

• Company: Recraft Inc., United States.
• Receives: requests to Recraft, prompt enhancement and style creation.
• Role: processor. Recraft does not train models on API outputs and does not keep them longer than needed to deliver them.
• Transfers from the EU/EEA/UK: data processing addendum with Standard Contractual Clauses.
• Terms: https://www.recraft.ai/legal/developer-terms, https://www.recraft.ai/legal/privacy

DuckDuckGo

• Company: Duck Duck Go, Inc., United States.
• Receives: search queries that the AI chat composes to search the web (for models without their own search).
• Role: independent controller. DuckDuckGo does not save IP addresses together with search queries.
• Transfers from the EU/EEA/UK: the provider does not state safeguards. The transfer happens only when the AI chat searches the web and is based on your explicit consent (Art. 49(1)(a) GDPR).
• Terms: https://duckduckgo.com/privacy