Privacy Policy
Last updated: January 13, 2026
Early Adopter Program
This Privacy Policy applies to participants in the Fine-Tuning Studio Pro Early Adopter Program. As a pre-release platform, we are committed to maintaining the highest standards of data protection while actively developing and improving our software. This policy reflects our privacy-first architecture and commitment to enterprise-grade security standards.
100% Local Processing
Your data never leaves your computer
No Telemetry
Zero usage tracking in the app
You Own Everything
Complete IP ownership retained
Security Architecture
Fine-Tuning Studio Pro uses a local-first architecture where your training data remains on your own infrastructure. This design can help organizations maintain their existing compliance posture since sensitive data never passes through our systems.
All AI training, data processing, and model storage occurs exclusively on your local machine or your designated infrastructure. Training data, model weights, and generated content are never transmitted to Fine-Tuning Studio servers.
The application functions fully offline after initial installation. No persistent internet connection is required for training, inference, or export operations. Ideal for classified environments and high-security facilities.
API keys for optional services (Hugging Face, RunPod, Vast.ai) are stored in Windows Credential Manager, which encrypts credentials using your Windows login. Keys are never written to disk in plaintext or stored by our application directly.
The desktop application contains no usage tracking, telemetry, or analytics code. No "phone home" functionality exists. The application makes no network requests unless you explicitly initiate model downloads or cloud training.
How Local Processing Helps Your Compliance
Note: Fine-Tuning Studio Pro is not certified for any compliance standard. However, because your training data never leaves your infrastructure, the following considerations apply:
Since sensitive data stays on your systems, your existing security controls and compliance measures remain in effect. The application does not introduce new data egress points for your training content.
If you use protected health information (PHI) for training, it remains on your infrastructure. We never access, store, or process your training data. Consult your compliance officer about your specific requirements.
Personal data processed for AI training remains under your control. We do not act as a data processor for your training content since we never receive it.
Any financial data used in model training stays on your systems and never enters our infrastructure.
1. Scope and Definitions
This Privacy Policy governs the collection, use, and protection of personal information by Fine-Tuning Studio Pro ("we," "our," or "the Company") in connection with our website (www.finetuningstudio.com), desktop application, and related services (collectively, "Services").
Critical Distinction: This policy addresses data we may collect through our website and business operations. Your training data, documents, AI models, and inference outputs processed by the desktop application are not subject to this policy because we never receive, access, or store this information.
2. Information We Collect
2.1 Website and Business Operations
- Contact Information: Name, email address, and optional organization/role when you join our waitlist, newsletter, or contact us.
- Communication Records: Content of messages you send us through contact forms or email.
- Transaction Data: Billing information processed through our secure payment processor. We do not store credit card numbers.
- Technical Data: Browser type, anonymized IP address (hashed), and access timestamps for security and website optimization.
2.2 What the Desktop Application Does NOT Transmit
The desktop application makes NO network connections for:
- Your training documents, PDFs, web content, or any source material
- Your trained model weights, adapters, or merged models
- Your dataset configurations or content library entries
- Your inference prompts, responses, or chat histories
- Usage patterns, feature usage, or training run statistics
- Hardware information, system configuration, or performance metrics
- Error logs, crash reports, or diagnostic information
The application only makes network requests when you explicitly initiate: (1) model downloads from Hugging Face, (2) cloud training through RunPod/Vast.ai using your own accounts, or (3) license validation during initial activation.
3. How We Use Information
Information collected through our website and business operations is used to:
- Process and respond to your inquiries and support requests
- Provide product updates, early access notifications, and (with consent) promotional materials
- Process transactions and deliver license keys
- Improve our website based on aggregate, anonymized usage patterns
- Comply with legal obligations and protect our legitimate business interests
4. Optional Cloud Training Features
Fine-Tuning Studio Pro offers optional integration with third-party cloud GPU providers (RunPod, Vast.ai). When you choose to use cloud training:
- Direct Transfer: Your training data is transferred directly from your machine to the cloud provider you select using secure SSH/SFTP connections.
- No Intermediary: Fine-Tuning Studio does not proxy, cache, or have access to your data during cloud operations.
- Your Accounts: You use your own accounts with these providers and are bound by their terms and privacy policies.
- Opt-In Only: Cloud features are disabled by default and require explicit configuration.
- Ephemeral Processing: Cloud instances can be configured to automatically destroy training data upon job completion.
5. Data Protection and Security
We implement appropriate technical and organizational measures to protect personal information:
- HTTPS encryption for all website communications
- Access controls and authentication for administrative systems
- IP address hashing with automatic purging within 24 hours
- No storage of payment card data (handled by PCI-compliant processors)
Note: The desktop application communicates with its local backend engine over localhost and does not transmit data over the internet unless you explicitly use cloud training or model download features.
6. Your Rights (Global Coverage)
6.1 Universal Rights
Regardless of your location, you have the right to:
- Access: Request a copy of personal information we hold about you
- Correction: Request correction of inaccurate personal information
- Deletion: Request deletion of your personal information
- Opt-Out: Unsubscribe from marketing communications at any time
- Portability: Receive your data in a structured, machine-readable format
6.2 EU/EEA Residents (GDPR)
Under the General Data Protection Regulation, you additionally have:
- Right to restrict processing
- Right to object to processing based on legitimate interests
- Right to withdraw consent at any time
- Right to lodge a complaint with your local supervisory authority
Legal basis for processing: Consent (marketing), contract performance (product delivery), legitimate interests (security, fraud prevention).
6.3 California Residents (CCPA/CPRA)
Under California law, you have the right to:
- Know what personal information is collected, used, and shared
- Delete personal information held by us and our service providers
- Opt-out of the sale or sharing of personal information (we do not sell personal data)
- Non-discrimination for exercising your privacy rights
- Limit use of sensitive personal information (we do not collect sensitive PI)
6.4 Canadian Residents (PIPEDA/Provincial Laws)
You have the right to access your personal information, challenge its accuracy, and withdraw consent to its collection, use, or disclosure, subject to legal restrictions.
6.5 Other Jurisdictions
We respect privacy rights under applicable laws worldwide, including but not limited to: UK GDPR, Brazil's LGPD, Australia's Privacy Act, Japan's APPI, and South Korea's PIPA. Contact us to exercise rights under your local law.
7. Cookies and Tracking
Our website uses minimal, functional cookies. We do not use:
- Third-party advertising or retargeting cookies
- Cross-site tracking mechanisms
- Social media tracking widgets
- Browser fingerprinting technologies
Essential cookies (session management, security tokens) are used solely for website functionality and cannot be disabled while maintaining site operation.
8. Third-Party Services
We integrate with the following third-party services:
- Hugging Face (optional): Model downloads using your personal API key and account
- RunPod (optional): Cloud GPU training using your account
- Vast.ai (optional): Cloud GPU marketplace using your account
- Payment Processor: Secure transaction processing for purchases
- Email Service: Transactional and marketing email delivery
These services operate under their own privacy policies. For cloud training providers, you establish a direct relationship with them; we do not act as an intermediary for your data.
9. Data Retention
- Waitlist/Newsletter: Until you unsubscribe or request deletion
- Contact Messages: 2 years for support continuity and legal purposes
- Transaction Records: As required by tax/accounting laws (typically 7 years)
- Security Logs: 90 days for incident investigation, then anonymized or deleted
10. International Data Transfers
Website data may be processed in jurisdictions where our infrastructure providers operate. We implement appropriate safeguards including Standard Contractual Clauses (SCCs) for EU/EEA data transfers where required.
Important: Your training data and AI models processed by the desktop application are not transferred internationally as they remain solely on your local infrastructure (unless you choose cloud training with providers in specific regions).
11. Children's Privacy
Our Services are intended for business and professional use and are not directed at individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete the information promptly.
12. Policy Updates
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email to registered users and posted prominently on our website. Your continued use of Services after changes constitutes acceptance.
13. Contact and Data Protection Inquiries
For privacy questions, data subject requests, or concerns about this policy:
We aim to respond to all privacy-related inquiries within 30 days. For GDPR requests, we will respond within the legally mandated timeframe.