ModelStation Sub-processors and Data Recipients
Operator: ELVARON LIMITED, Registration No. 79402144, 14/F, China Building, 29 Queen's Road Central, Central, Hong Kong. Contact: support@modelstation.org
Version: 2.0 Effective date: from the date of publication on the website.
1. Purpose of the page
1.1. This page discloses who may process data in the operation of ModelStation: the purpose of processing, the categories of data transferred, and the recipients. AI Providers to whom the contents of your requests are transmitted are disclosed by name and jurisdiction (§3). Providers of the infrastructure and ancillary layer are disclosed by category (§4), and their names are provided upon request in the manner described in the same section. The disclosure ensures transparency toward users and fulfills the requirements of applicable law on informing about data recipients and sub-processors, including Arts. 13–14 and Art. 28 GDPR.
1.2. This page forms part of the Privacy Policy and the DPA.
1.3. Who is considered a sub-processor. A provider that processes data on the Company’s instructions to perform a specific technical function. A mere hyperlink to an external site, use of public documentation, or mention of a brand does not create a sub-processor relationship.
1.4. Who acts independently. Payment providers and AI Providers, in respect of their own purposes (security, abuse, compliance with the law), act as independent controllers and are responsible for their processing toward you directly in accordance with their terms.
2. Key principle of request routing
The contents of a request and attached files are transmitted only to the AI Provider of the Model you selected, or to the provider selected by automatic mode if you have enabled it. Your request is not sent to the other providers in the list. By not selecting a particular provider’s model, you exclude transmission of your data to that provider.
3. AI Providers (processing of request contents)
| Provider | Models | What is transferred | Primary processing jurisdiction |
|---|---|---|---|
| OpenAI (OpenAI, L.L.C. / OpenAI Ireland Ltd) | GPT line | request text, attachments, service parameters | United States, EEA |
| Anthropic (Anthropic PBC) | Claude line | request text, attachments, service parameters | United States |
| Google (Google LLC / Google Ireland Ltd) | Gemini line | request text, attachments, service parameters | United States, EEA |
| xAI (X.AI LLC) | Grok line | request text, attachments, service parameters | United States |
| Moonshot AI | Kimi line | request text, attachments, service parameters | mainland China |
| Alibaba Cloud | Qwen line | request text, attachments, service parameters | mainland China, Singapore |
Warning regarding cross-border transfer. Selection of Kimi and Qwen models means transmission of request contents to the jurisdiction of mainland China. The legal regimes of certain countries permit access by competent authorities to data. If such a transfer is unacceptable to you under law, contract, or internal policy, do not select the corresponding models and do not enable automatic provider selection.
Practices of storage, logging, and training on data are determined by each provider’s terms and are outside the Company’s control. The Company seeks to use modes of interaction that exclude training on transmitted data, but cannot guarantee this.
4. Infrastructure and ancillary services
| Function | Provider category | Data categories |
|---|---|---|
| Request-routing and consumption-accounting gateway | operator’s own infrastructure (ELVARON LIMITED) | request contents, consumption metrics, memory items |
| Placement of servers and database | professional provider of hosting infrastructure and computing capacity | data located on servers in a stored and processed state |
| Traffic protection, attack filtering, determination of request country | provider of network protection and traffic delivery | IP address, request headers, country code, request characteristics |
| Sending of transactional emails: address verification, service notices | corporate email service provider | email address, email contents |
| Acceptance of payments and processing of refunds | licensed payment providers and payment intermediaries | payment and contact data entered on the provider’s side, amount, currency, status, transaction identifier |
| Domain registration and DNS servicing | domain-name registrar and DNS operator | technical domain data |
| Professional advisers: legal, accounting, audit | engaged as needed on the basis of confidentiality obligations | minimally necessary information |
On disclosure of specific providers. This page discloses functions, categories of providers, and categories of data transferred — the volume necessary to inform about data recipients in accordance with applicable law. The names of specific legal entities are not published: their disclosure relates to information about the organization of infrastructure and protection of the Service against targeted attacks.
Current names and jurisdictions of specific providers are provided:
- to corporate customers that have entered into a DPA — upon request to support@modelstation.org, for the purposes of their own compliance assessment;
- to users — to the extent necessary to exercise their rights in respect of personal data, upon a reasoned request;
- to competent authorities — to the extent established by law.
The current payment provider is always indicated directly on the payment screen before confirmation of payment, and its terms and privacy policy apply to you directly.
5. Categories of data available to providers
A provider receives only those data that are necessary for its function:
- AI Provider — request contents, attachments, selected generation parameters;
- hosting — all data in a stored and processed state on the server;
- protective contour — network metadata: IP address, headers, country code, request characteristics;
- email provider — recipient address and text of the transactional email;
- payment provider — payment details entered by you directly on its side, amount, currency, transaction identifier, contact data;
- advisers — individual information to the extent of the engagement.
The Company seeks to minimize the composition and volume of data transferred and does not transmit conversation contents to providers that do not require them.
6. Requirements for providers
In selecting and retaining a provider, the following are taken into account: the purpose and volume of processing; the place of processing and storage; the existence of contractual guarantees, including data-processing terms and, where necessary, standard contractual clauses; security measures; restrictions on onward transfer; the procedure and time limits for deletion; the procedure for incident notification; the provider’s reputation and resilience.
Processing by a provider is limited to the agreed service. Use of data by a provider for its own independent purposes is permitted only to the extent disclosed in its own terms, for which it is independently responsible.
7. Changes to the composition of providers
7.1. The composition of providers and Models changes together with the development of the catalog and infrastructure.
7.2. Material changes (addition of a new sub-processor, change of processing jurisdiction) are published on this page, where possible before the new processing begins.
7.3. Right of objection for corporate customers. A customer that has entered into a DPA may subscribe to change notices by sending a request to support@modelstation.org, and within 30 days from the date of notice may raise a reasoned objection to a new sub-processor. The parties in good faith discuss an alternative: a change of settings, disabling of the corresponding Model, or another configuration. If an alternative is impossible, the customer may discontinue use of the affected feature or terminate the contract in respect of such feature; other remedies do not apply.
7.4. Replacement of a provider for the purpose of eliminating a security threat, ensuring continuity of operation, or complying with a legal requirement may be effected without prior notice, with subsequent disclosure on this page.
8. Liability
The Company is responsible for the selection of sub-processors and for the existence with them of contractual terms required by applicable law, to the extent established by §17 of the Terms of Use and the corresponding DPA. The Company is not responsible for the independent acts and omissions of providers that act toward you as independent controllers, including payment systems and AI Providers in respect of their own processing purposes.
9. Contacts
Requests regarding sub-processors, notices, and objections: support@modelstation.org ELVARON LIMITED, Registration No. 79402144, 14/F, China Building, 29 Queen's Road Central, Central, Hong Kong.