Legal
Privacy policy
Data controller
Who is responsible for the processing described here
- Controller
- LLM Tier
- Service
- www.llm-tier.com
- Contact for data protection
- lab@llm-tier.com
- Data protection officer
- Not appointed. Article 37 does not require one for processing at this scale
- Supervisory authority
- The data protection authority of your habitual residence or place of work
LLM Tier is the controller for all personal data described below. It decides why and how that data is processed. Where a supplier processes data on our behalf, it acts as a processor under a written agreement and cannot use the data for its own purposes.
What we process and why
Purpose, categories of data, lawful basis and retention
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Answering an enquiry or a correction request | Name, email address, organisation, topic, message body, submission timestamp | Legitimate interests, Article 6(1)(f): running a correctable public benchmark and replying to the people who write to us | 24 months from the last message in the thread, then deleted |
| Creating a reader account | Name, email address, username, password (stored as a salted hash, never in plain text), consent timestamp | Consent, Article 6(1)(a), given when you submit the registration form | Until you delete your account, at which point the account record is deleted and published contributions are attributed to a removed account |
| Publishing a reader review of a measured product | Display name, optional role, rating, review title and body, submission timestamp | Consent, Article 6(1)(a), given when you submit the review form | Until you withdraw consent, or 36 months after publication |
| Scoring a product, writing a lab note, commenting or upvoting as a reader | Username, per axis scores, note or comment text, vote records, submission and edit timestamps | Consent, Article 6(1)(a), given when you submit the form. Public display of your username on this content is part of that consent | Until you edit or delete the item, or delete your account, whichever is sooner |
| Keeping the site available and defending it against abuse | IP address, stored only as a salted cryptographic hash that cannot be reversed to the original address, together with user agent, request path and timing, used to enforce rate limits per account and per address | Legitimate interests, Article 6(1)(f): security and service integrity | 30 days rolling, then overwritten |
| Remembering your cookie choice | A single browser storage entry recording accept or reject. No identifier, no profile | Article 6(1)(f) for the strictly necessary record of your own choice | 12 months, or until you clear site data |
No advertising, no tracking pixels
We do not run advertising, we do not embed third party tracking pixels, we do not build advertising profiles and we do not sell or rent personal data. There is no cross site tracking on this site. Traffic measurement, where used, is aggregate and does not attempt to identify individual visitors. See the cookie policy for the full storage inventory.
Recipients and processors
Personal data you submit through a form is stored in the database that backs this site and is accessible only to the people who operate the lab. We use a hosting and content delivery provider to serve pages, an email provider to reply to you, and a managed database provider to store records. Each acts as a processor under Article 28. We do not disclose personal data to the vendors whose products we measure, including when they dispute a result. A correction request is discussed on its evidence, not on who sent it.
International transfers
Our infrastructure is operated from the European Economic Area where possible. Where a processor stores or accesses data outside the EEA, the transfer relies on an adequacy decision under Article 45, or on the European Commission standard contractual clauses under Article 46 together with a transfer risk assessment. You can request a summary of the safeguards in place for a specific processor at the address above.
Public content you submit
A reader review is published content. If you submit one, the display name, role, rating and text you enter become visible on the relevant product page and may be included in the public data exports and in structured data that search engines and language models read. Do not put anything in a review that you would not want quoted. Your email address, if you give one, is never published. Reviews are moderated before publication and we may decline to publish, or later remove, a review that is abusive, defamatory, obviously written by the vendor, or unrelated to using the product.
Reader accounts and public profiles
If you register an account, your public profile at /u/username shows your username, display name, optional bio, join date and your contributions: axis scores, lab notes, comments and upvotes. Your email address and password are never shown on that page or anywhere else on the site. A profile with no published contributions is marked non indexable so search engines do not list it. Scores you submit are shown only as a separate reader index, next to the lab index, and are never merged into the measured number: that separation is structural to how the site is built, not a display choice. First time contributions are held in a moderation queue before they publish. You can edit or delete your own scores, notes and comments from your account page at any time, and you can delete your account entirely by writing to lab@llm-tier.com.
Automated decision making
The composite index is computed automatically from measurements of software, not from personal data. No decision producing legal or similarly significant effects concerning a person is made by automated means within the meaning of Article 22.
Children
This is a professional publication and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, write to us and we will delete it.
Security
Data in transit is protected with TLS. Access to the database and to the administrative interface is restricted to named operators and is authenticated with a secret held in the deployment environment, never in the code. We keep the number of people with access small and we review it. No system is perfect, and we will notify affected people and the competent supervisory authority under Articles 33 and 34 if a breach is likely to result in a risk to your rights.
Your rights
Exercise any of these by writing to the lab address
Access
A copy of the personal data we hold about you, Article 15
Rectification
Correction of inaccurate or incomplete data, Article 16
Erasure
Deletion where we no longer need the data or where you withdraw consent, Article 17
Restriction
Freezing processing while a dispute is resolved, Article 18
Portability
Consent based data in a machine readable format, Article 20
Objection
Objection to processing based on legitimate interests, Article 21
Withdraw consent
At any time, without affecting processing carried out before withdrawal
Write to lab@llm-tier.com with the request and enough detail to find your record. We answer within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. There is no charge unless a request is manifestly unfounded or excessive. If you are not satisfied with our answer you have the right to lodge a complaint with your supervisory authority under Article 77.
Changes to this policy
When this policy changes materially we update the date at the top and record the change in the lab notes. Continued use of the site after a change means the current version applies. Related documents: the terms of use and the cookie policy.