TarseekDraft

Tarseek Legal Center

Tarseek Legal Center

This document is currently being prepared and is not yet effective. It is a draft of Tarseek’s intended legal framework. It does not create a binding contract, privacy notice, or other legal obligation until Tarseek publishes an effective version and users agree to it where required.

The Tarseek Legal Center collects the contracts, privacy notices, trust disclosures, and related policies that a production AI gateway should maintain. These documents are the intended operating framework for Tarseek, including requirements that are not yet implemented or decided.

Tarseek is a BYOK AI model gateway. Users create accounts, connect their own supported Model Provider credentials, generate Tarseek API keys, send supported text or image inputs, receive model outputs, and use hosted Chat. Requests use the explicit Model's primary Deployment and the Customer's matching provider credential. Tarseek does not sell inference credits or silently use its own provider keys.

Version 1.0. Last updated September 26, 2026. Operator: Mahmoud Chaer, Beirut, Lebanon. Tarseek is not incorporated. There is no registered office. Contact: legal@tarseek.com.

Documents

Terms of Service
Master contract for use of Tarseek accounts, APIs, Chat, and related services.
API & Developer Terms
Supplemental terms for automated access, API keys, metering, and downstream applications.
Acceptable Use Policy
Baseline prohibited uses of Tarseek and reserved enforcement rights.
Copyright & Intellectual Property Policy
IP complaint procedures, takedown process, and third-party trademark notices.
Beta & Preview Terms
Additional terms for Beta, Preview, Experimental, Early Access, and Labs features.

Privacy & Data

Privacy Policy
How Tarseek intends to collect, use, share, and retain personal data.
Data Practices & Retention
Plain-language explanation of API, Chat, Memory, file, metadata, and log retention.
Model Provider Data Practices
How third-party model providers may handle inputs, outputs, training, and retention.
Data Processing Addendum
Controller/processor framework for customer application data processed through Tarseek.
Subprocessor List
Infrastructure, support, analytics, and model-provider subprocessors.
Cookie Policy
Cookies and similar technologies, categories, and intended consent controls.
Privacy Choices & Requests
How users may request access, deletion, export, correction, and other privacy actions.
Regional Privacy Addenda
Supplemental privacy terms for the EU/EEA, UK, US states, UAE, and other regions.
Sensitive & Biometric Data Notice
Restrictions for health, biometric, children’s, and other highly regulated data.

Trust & Security

Security & Trust
Intended security controls, certifications posture, and trust disclosures.
Vulnerability Disclosure Policy
How to report security vulnerabilities in good faith.
AI Transparency Notice
Disclosures that Tarseek provides access to AI systems and that outputs may be inaccurate.
Law Enforcement Guidelines
How Tarseek intends to handle legal process, preservation, and emergency requests.

How to read these documents

Each policy uses a consistent structure: title, effective date, last updated date, version, headings with stable anchors, related-policy links, and contact information.

Internal markers identify work that remains:

  • IMPLEMENTED — the described product control exists and is enforced.
  • PARTIALLY IMPLEMENTED — the core control exists, but a stated part still needs work.
  • PLANNED — intended design; implementation may be incomplete.
  • TBD — a business or legal fact has not been decided.
  • NOT YET IMPLEMENTED / REQUIRES IMPLEMENTATION — the policy assumes product behavior that does not yet exist.
  • NOT YET EFFECTIVE — not a live legal commitment.
  • REQUIRES LEGAL DECISION — counsel or entity formation is required.
  • REQUIRES PROVIDER VERIFICATION — third-party terms or data practices must be confirmed.
  • FUTURE FEATURE — expected later in the platform.

Public statements in an effective policy must not claim capabilities that Tarseek does not actually provide. Until a control exists, the Center records a target policy and an implementation status rather than a false present-tense promise.

Acceptance tracking

Tarseek should record legal-document acceptance so it can prove which version a user or organization agreed to.

Intended record fields: account_id, organization_id, document_slug, version, timestamp, event, actor, source.

Example events: Terms v2 accepted at signup; Privacy Policy acknowledged; API Terms accepted; Enterprise agreement signed.

Product requirements derived from this framework

The policies below imply platform work. This list is an internal specification checklist. It is not a public representation that the features currently exist.

AreaRequirementStatus
Privacy rightsUsers can request access to personal data associated with their account.IMPLEMENTED
Privacy rightsUsers can request deletion of account data, chat history, files, and memory, subject to lawful retention.IMPLEMENTED
Privacy rightsUsers can request correction of inaccurate account information.IMPLEMENTED
Privacy rightsUsers can export a portable copy of applicable account, chat, and usage data.IMPLEMENTED
AccountsUsers can close/delete their Tarseek account.IMPLEMENTED
API dataAPI prompt and output content is not retained long-term by Tarseek by default.IMPLEMENTED
API dataPrompts are not stored indefinitely in application logs, tracing, error systems, or backups beyond documented windows.IMPLEMENTED
API dataUsage metadata (model, provider, tokens, estimated cost, latency, request ID, and deployment) is retained for history and operations.IMPLEMENTED
ChatHosted Chat conversation history can persist as an explicit product feature.IMPLEMENTED
ChatUsers can delete hosted Chat conversations.IMPLEMENTED
MemoryMemory, if offered, can be viewed, disabled, and deleted separately from Chat history.IMPLEMENTED
FilesUploaded files can be deleted and are not retained longer than needed for processing unless the user stores them.IMPLEMENTED
Routing / privacyThe gateway enforces no-collection requests using verified ZDR and no-training flags and fails closed when no eligible deployment exists. Provider claims still need contractual verification.REQUIRES PROVIDER VERIFICATION
Routing / privacyStructured provider legal/privacy metadata is maintained and surfaced per deployment.REQUIRES PROVIDER VERIFICATION
Provider credentialsEvery customer inference request uses a compatible project-owned Provider Credential for the explicit model's primary Deployment, with no platform-key or secondary-deployment fallback.IMPLEMENTED
API keysUsers can revoke, rotate, and disable API keys. Tarseek can suspend keys for abuse, fraud, or security.IMPLEMENTED
Cost controlsProject monthly and API-key monthly/lifetime cost guardrails are enforced against recorded estimates before additional usage.IMPLEMENTED
CookiesIf non-essential cookies are used, users can Accept, Reject, Customize, and later change choices.FUTURE FEATURE
AccountsPassword accounts must verify control of their email before accessing the application.IMPLEMENTED
CommunicationsOptional Tarseek communications are controlled separately from essential account mail and project notifications, by category and channel.IMPLEMENTED
CommunicationsEvery optional marketing email contains a functioning unsubscribe or preference-management mechanism and senders suppress opted-out recipients.IMPLEMENTED
CommunicationsVerification, password reset, security, billing, legal and other required service mail remains independent of marketing consent.PARTIALLY IMPLEMENTED
EligibilityService is limited to users 18+; accounts for minors are not supported by default.IMPLEMENTED
ContractsRecord document, version, timestamp, and acceptance event per user/account.IMPLEMENTED
AbuseAbility to block requests, rate-limit, suspend keys/accounts, preserve records, and report when legally required.IMPLEMENTED
Legal processAuthenticated intake for law-enforcement and legal requests, with preservation and disclosure procedures.REQUIRES IMPLEMENTATION
SecuritySecurity reporting mailbox and vulnerability intake process.REQUIRES IMPLEMENTATION
AI transparencyWhere required, machine-readable labeling of synthetic image/audio/video content.FUTURE FEATURE
Enterprise privacyExecutable DPA, SCCs/UK mechanisms, and subprocessor notice process.REQUIRES LEGAL DECISION

Contact

Legal: legal@tarseek.com. Privacy: privacy@tarseek.com. Security: security@tarseek.com. Entity, office, governing law, and dispute forum remain TBD.