Privacy Policy
Effective Date: [EFFECTIVE_DATE]
Data Controller: [OPERATOR_NAME], [LEGAL_FORM], registered office at [REGISTERED_ADDRESS], Tax Identification Number [TAX_ID], Trade Register Number [TRADE_REGISTER_NUMBER].
Privacy Contact: [PRIVACY_EMAIL]
1. The Service and Categories of Data
The service at [DOMAIN] requires an account for its AI features. We process account information such as your email address, display name, authentication data, account settings, and subscription-plan configuration. Authentication may be provided through the sign-in methods displayed by the application.
We store conversations and their messages in the application's database so that you can return to your conversation history. Depending on the features you use, stored content may include prompts, AI responses, conversation summaries, attachments or references to uploaded files, tool results, and technical context you provide. The application also maintains synthesis history and usage or cost records for applicable features.
Requests to the service and its APIs may generate technical and diagnostic data, including timestamps, request and error details, account and conversation identifiers, and operational events. The exact IP-address and hosting-log practices depend on the hosting and security configuration and are not specified here.
If you contact us, we process the information in your correspondence. Please avoid submitting passwords, API keys, banking details, medical or biometric information, information about children, trade secrets, or confidential information unless the feature requires it and you are authorized to provide it. Submitted content may be sent to external AI or tool providers as described below. Do not provide personal data about another person unless you have an appropriate legal basis.
2. How Data Is Processed
The application routes requests to configurable AI models. Depending on the selected model, feature, account plan, and configuration, prompts and relevant conversation context may be sent to model providers through the configured AI gateway. The code includes integrations for OpenAI and Google Gemini, among other model platforms; it does not send every request through the same fixed sequence of two models followed by a third synthesis model.
Some plans and requests can use research tools that search for and retrieve web pages. The configured research pipeline can use providers including Google Gemini, OpenAI, xAI Grok, Exa, and Brave, and can retrieve web pages through configured infrastructure. The providers used for a particular request depend on the active configuration. If Expert Mode or comparable model-detail features are enabled, intermediate model responses may be shown in your browser.
Optional context and conversation history may be included in model requests when required by the selected feature. The precise content sent depends on the request and tool flow. External providers apply their own terms, safety controls, and data handling practices.
3. Purposes and Legal Bases for Processing
We process account and request data to provide the service and features you request, manage your account, maintain conversation history, and administer plan limits and usage. Where processing is necessary to perform a contract with you, the legal basis is Article 6(1)(b) GDPR. The legal basis for processing during account creation, trials, or other situations where a contract may not yet exist must be assessed by the Controller.
Technical and diagnostic data may be processed to operate and secure the service, investigate errors, and prevent abuse. Where applicable, the legal basis may be our legitimate interests under Article 6(1)(f) GDPR, subject to the required assessment. Support correspondence is processed to handle your request, based on Article 6(1)(b) or Article 6(1)(f) GDPR as applicable. Data required for legal obligations or to establish, exercise, or defend legal claims may be processed on those respective legal bases.
The application does not train an AI model of its own using your submitted content. Whether an external provider may use data for training or product improvement depends on the service, account, settings, region, and applicable provider terms. These terms and settings must be confirmed for the accounts used by the Controller. Provider retention for safety, abuse monitoring, or service operation may still apply.
4. Data Recipients and International Transfers
Depending on the features used, data may be received by the operator's hosting and infrastructure providers; the configured AI gateway; AI model providers such as OpenAI, Google, and other enabled providers; and search, web retrieval, storage, logging, authentication, or support providers used by those services.
The legal names of the relevant contracting entities, their roles, processing locations, subprocessors, and transfer safeguards must be confirmed against the applicable agreements and current configuration. Where personal data is transferred outside the European Economic Area, the Controller must identify the applicable transfer mechanism, such as an adequacy decision or appropriate safeguards under Article 46 GDPR, and any required supplementary measures.
Hosting Provider: [HOSTING_PROVIDER]
Hosting Region: [HOSTING_REGION]
International Transfer Mechanism: [TRANSFER_MECHANISM]
For information about applicable safeguards, contact [PRIVACY_EMAIL].
5. Data Retention
Unlike a stateless question-and-answer service, this application stores account records, conversations, messages, and certain feature-history and usage records in its database. Users can delete conversations through the application, but the applicable retention periods for database backups, archived summaries, synthesis records, uploaded files, hosting logs, diagnostic logs, and support correspondence have not been established in the information available for this notice.
External AI, gateway, search, hosting, and infrastructure providers may retain request data under their own terms and configurations. The application code alone does not establish those providers' retention periods. The Controller must verify and document them before stating specific periods.
Application Data Retention: [APPLICATION_DATA_RETENTION]
Hosting and Diagnostic Log Retention: [HOSTING_LOG_RETENTION]
Support Correspondence Retention: [SUPPORT_RETENTION]
Data required to meet legal obligations will be retained for the period required by applicable law. Retention periods and deletion procedures should be completed and reviewed when the provider configuration changes.
6. Your Rights
Subject to the conditions established by applicable law, you may request access to, correction or erasure of your personal data, restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests.
To exercise your rights, contact [PRIVACY_EMAIL]. We may need sufficient information to locate your account or records, but will not request excessive data solely for identification. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at dataprotection.ro and to seek judicial remedies before the competent courts. Where processing is based on consent, you may withdraw consent for future processing.
7. Automated Decisions, Minors, and Security
The service generates text using artificial intelligence, and some features may process content using AI tools. AI-generated responses may be inaccurate. The application code reviewed does not indicate that the service makes decisions producing legal or similarly significant effects about users within the meaning of Article 22 GDPR. The service is intended for adults aged 18 or older.
The Controller should describe security measures only after they have been documented and verified. No online service can guarantee absolute security.
8. Updates to This Privacy Policy
Updated versions of this Privacy Policy and their effective dates will be published at [DOMAIN]. For significant changes, the Controller will use a reasonable notification method appropriate to the change and the service.