Meteor-AI

Privacy policy

Status: 14 October 2026

1. Controller

zuber-management, owner Patrick Zuber
Eschelbacher Str. 46, 69242 Mühlhausen, Germany
Email: info@meteor-ai.com

2. What data is processed

2.1 This website

  • This website sets no cookies, includes no analytics or advertising services and loads no fonts or icons from third parties.
  • When you visit, Vercel, which delivers this website (section 4), processes technically necessary connection data (including IP address, time, page requested, browser identifier) in server logs.
  • If you write to us by email, we process sender, content and time to answer your request.

2.2 The app

  • Account data: name, email address. The app does not store passwords; sign-in is handled by Supabase Auth.
  • Content: chats, attachments, generated images, settings and library (prompts, skills, knowledge items with documents, assistants, flows, HTML apps).
  • Web search: if web search is switched on for a model that does not search itself, the beginning of the last input (at most 400 characters) goes to the search service Linkup as the search query (section 4); the results are added to the request to the model and shown as sources under the answer.
  • Usage data: time, model, tools used, tokens and cost of each request. They serve billing against allowance and credit, or billing of usage on the Enterprise plan, and contain no content.
  • Subscription and payment: plan, billing period, subscription status, credit bookings (starter credit, allowance, top-ups, settlements, refunds) and the identifiers of customer, subscription, payments and invoices at Stripe. For a request for the Enterprise plan, also its time, the decision and, where applicable, the reason. Payment details such as card or account numbers are entered directly at Stripe; the app neither receives nor stores them.
  • Technical data: connection data when the app is loaded (IP address, time, file requested) at Vercel; server logs at Supabase; error messages the app reports to the database when something goes wrong.
  • Support: requests via the support form (topic, subject, description, status). On request, information about the environment is included (app version, page, window size, language, browser identifier) – never chat content.
  • Cancellation and withdrawal: what is submitted via “Cancel contracts here” or “Withdraw from contract”, also without signing in: name, email address, contract, type and date of the cancellation including the reason, or order date and message, plus date and time of receipt. If the address belongs to an account, the declaration is linked to it.
  • Origin at sign-up: accounts are created only in the European Economic Area and Switzerland. For this, the request's IP address is checked inside the database against a list of IP ranges, without another service. If the check succeeds, the address is not stored. If sign-up is rejected, the address, the assigned country, the number of attempts and their times are stored and deleted after 180 days. No email address is recorded.
  • App emails: sign-up confirmation, password reset and email change; in addition, notices about the subscription, invoices, failed payments, credit, a request for Enterprise and account deletion as well as the confirmation of receipt of a cancellation or withdrawal. For this, name, email address and the content of the respective email – including the confirmation link or amount, date, invoice number and link to the invoice at Stripe – are passed to the sending service (section 4). When the email address is changed, emails go to the previous and to the new address: both confirm the change; afterwards the previous one receives a notice of the change and the new one a confirmation.

3. Purposes and legal bases

  • Account, chat, library, images, support: providing the contractual service, Art. 6(1)(b) GDPR.
  • Usage data and billing: performance of the contract (b) and legitimate interest in traceable cost control (f).
  • Subscription, payment, credit and refunds: performance of the contract (b). Creating a customer record at Stripe as soon as the email address is confirmed is based on the legitimate interest in handling a later purchase without delay (f).
  • Operational security, error log, sign-up check, server logs: legitimate interest in secure, stable operation and in limiting sign-up to the EEA and Switzerland (f).
  • Email contact: pre-contractual measures or performance of the contract (b), or legitimate interest in answering enquiries (f).
  • Cancellation and withdrawal: performance of the contract (b) and the legal obligation to accept cancellations and withdrawals electronically and confirm their receipt (§§ 312k, 356a BGB; c).
  • Commercial and tax retention: legal obligation, Art. 6(1)(c) GDPR.

4. Recipients and processors

Input leaves the app: it goes through a server function to Eden AI's EU endpoint and from there to the European infrastructure of the model provider chosen. Only models that compute in the EU can be reached through this endpoint; all others are blocked. Zero data retention applies to model processing: input and answers are neither stored there nor used for training. Accounts, content and files are stored at Supabase.

  • Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) – database, sign-in, file storage, server functions. Project region Frankfurt am Main (eu-central-1). The basis is Supabase's Data Processing Addendum under Art. 28 GDPR, which forms part of Supabase's terms of service.
  • Eden AI (Eden AI SAS, 19 rue Louis Guérin, 69100 Villeurbanne, France) – intermediary to language and image models. Processing exclusively in the EU through the EU endpoint; data processing agreement with zero data retention provisions.
  • Model providers – process the request in the chosen model, exclusively on their infrastructure in the EU; input and answers are not stored. The model picker in the app shows which models are available.
  • Linkup (through Eden AI) – web search when it is switched on for a model that does not search itself. Receives only the search query (beginning of the last input, at most 400 characters), no account data or other content. The request runs through Eden AI's EU endpoint; the basis is the data processing agreement with Eden AI.
  • Plunk (Coenraetsstraat 72, 1060 Brussels, Belgium) – sending the app's emails (confirmation, password reset, email change; subscription, invoices, credit, account deletion). Storage in the EU (Hetzner, Germany), delivery through Amazon Web Services in the eu-north-1 region (Stockholm). The basis is Plunk's data processing agreement under Art. 28 GDPR.
  • Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA) – delivers the app's files at app.meteor-ai.com and this website at meteor-ai.com. Project region Frankfurt am Main (fra1); the files themselves come through Vercel's network from the nearest location. Connection data is processed in the process (IP address, time, file requested, browser identifier), no accounts and no content. The basis is Vercel's Data Processing Addendum under Art. 28 GDPR, which forms part of the contract for our plan.
  • Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) – payment processing: taking out and cancelling the subscription, topping up and refunding credit, invoices and customer portal. As soon as the email address is confirmed, Stripe receives name, email address and the account's identifier. If the email address is changed later, Stripe receives the new address once the change is complete, so that invoices and the customer portal show it. Payment details and billing address are entered directly at Stripe. Where Stripe processes payments on our behalf, it acts as processor; the basis is Stripe's Data Processing Agreement, which forms part of the contract with Stripe. For its own purposes – such as fraud prevention, anti-money-laundering checks and other legal obligations – Stripe is an independent controller; Stripe's privacy policy applies to that.
  • Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) – mailboxes of meteor-ai.com (Exchange Online in Microsoft 365). Emails to info@meteor-ai.com and support@meteor-ai.com arrive and are answered through them; sender, content, attachments and time are processed. The mailboxes are held in data centres in Germany; Microsoft guarantees storage in the EU by contract (EU Data Boundary). The basis is Microsoft's Data Protection Addendum under Art. 28 GDPR, which forms part of the product terms.
  • European Central Bank – the app fetches the public reference rate daily; no user data is transmitted.

Security. All connections are encrypted with TLS. Database and file storage are encrypted at rest. Each account sees and changes only its own data; the rule is enforced in the database itself.

Transfers to third countries. Accounts, content, model requests and emails are stored and processed exclusively in the EU. Two service providers are based outside the EU, and two more belong to groups based in the USA:

  • Supabase Pte. Ltd. (Singapore): the data is stored in Frankfurt am Main. Where Supabase accesses it from Singapore, for example for operations and support, this is covered by the European Commission's standard contractual clauses, which are part of the Data Processing Addendum (Art. 46(2)(c) GDPR).
  • Vercel Inc. (USA): Vercel is certified under the EU-U.S. Data Privacy Framework. The transfer of connection data is based on the European Commission's adequacy decision for it (Art. 45 GDPR); in addition, the standard contractual clauses in Vercel's Data Processing Addendum apply (Art. 46(2)(c) GDPR).
  • Stripe: the contracting party is the Irish company; data may go to Stripe, LLC (formerly Stripe, Inc.) in the USA. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the standard contractual clauses in Stripe's Data Processing Agreement apply (Art. 46(2)(c) GDPR).
  • Microsoft: the contracting party is the Irish company, and the mailboxes are held in Germany. Where Microsoft Corporation in the USA accesses them, for example for operations and support: it is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the standard contractual clauses in Microsoft's Data Protection Addendum apply (Art. 46(2)(c) GDPR).

5. Retention

  • Account and content: until deleted by the users. “Delete all data” removes chats, image conversations, library and settings as well as all files; “Delete account” ends a running subscription, refunds what is left of topped-up credit and then removes the files and the account.
  • Billing rows and credit bookings: remain after deletion, without name and email address, with an identifier only, as the operator's record. They are deleted once the retention period under commercial and tax law has expired; for accounting records it is currently eight years (Section 147 AO, Section 257 HGB).
  • At Stripe: customer record, payments and invoices remain at Stripe after the account is deleted: invoices and payment records must be retained, and on Enterprise the final invoice only follows after deletion. Stripe keeps them according to its own retention periods and obligations under commercial and tax law.
  • Support requests: until support deletes them, at the latest when the account is deleted.
  • Error log: around 90 days; when an account is deleted, its entries immediately lose the link to the account.
  • Emails to info@ and support@: enquiries not related to a contract twelve months after they are dealt with; commercial and business letters six years (Section 257 HGB, Section 147 AO); bank details provided for a payout as long as the accounting record for it.
  • Manual payouts: name, email address and amount eight years from the end of the year of the payout, as an accounting record (Section 147 AO), then deleted.
  • Rejected sign-ups: 180 days.
  • Cancellations and withdrawals: three years from the end of the year in which they were received (standard limitation period, §§ 195, 199 BGB), then deleted.
  • Switching providers under the Data Act: name, email address, periods and completion remain beyond the account as evidence, three years from the end of the year of completion, then deleted.
  • Server logs: 7 days at Supabase, at most one day at Vercel.
  • Email sending: Plunk deletes logs of sending requests after 30 days. For each recipient address Plunk creates a contact (email address, not subscribed to newsletters). After the account is deleted, we remove this contact once the last email about it has been sent – the confirmation of deletion, or on Enterprise the one about the final invoice.

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Where processing is based on consent, you can withdraw it at any time. Contact info@meteor-ai.com for this. Much can be done in the app itself, such as deleting and changing account data.

You can lodge a complaint with a supervisory authority. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, poststelle@lfdi.bwl.de.

7. Storage in the browser

The app stores in the browser's local storage: the session token, a mirror of the settings (so the theme is right immediately), a mirror of the permissions (so the sidebar is right immediately) and a cache of the model catalogue. This serves operation only. There is no tracking and no data is analysed for advertising. This website stores something in the browser only when the light/dark switch is used: the chosen theme, so that it applies on every page. It is not transmitted and can be deleted with the browser data.

8. Automated decisions

There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

9. Changes

We adapt this policy when processing changes. The version published here applies. We send earlier versions on request.

  • Version of 14 October 2026: the plan billed by usage is now called Enterprise instead of Ultimate (sections 2.2 and 5); processing does not change.
  • Version of 13 October 2026: web search through Linkup added (sections 2.2 and 4); new email address passed to Stripe after an address change, and emails to the previous and the new address; Microsoft as provider of the mailboxes (section 4); retention of support requests, the error log, emails, manual payouts and provider switches (section 5).
  • Version of 11 October 2026: first version.