Privacy Policy

1. Who We Are

Responsible entity:

2. What Data We Collect

We collect the following data when you use our services:

• Technical data: IP address, browser type, operating system, device information
• Usage data: Pages visited, time spent, referring pages, search queries
• Login/account data (only if you sign up): Email address, login times
• Diagnostic input: Questions or inputs submitted via our AI chat interface

3. How We Collect Your Data

We collect data via:

• Server logs (hosted by Vercel)
• Our own application (hosted on Supabase/PostgreSQL)
• Cookies or localStorage (minimal use – only if required for login/session)

4. Why We Collect Your Data

We use your data to:

• Provide and improve our AI-powered diagnostic platform
• Ensure stability and performance of the system
• Analyze traffic (aggregated, non-personalized)
• Prevent abuse or misuse (security logs, rate-limiting)

We do not sell, rent, or share your personal data with third parties for advertising purposes.

5. Legal Basis

EU Users (GDPR)

For users in the European Union, we rely on:

• Art. 6(1)(b) GDPR – contractual necessity (when you use our service)
• Art. 6(1)(f) GDPR – legitimate interest (analytics, security)
• Art. 6(1)(a) GDPR – user consent (only if cookies are introduced later)

California Users (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising CCPA rights

To exercise your CCPA rights, contact us at:[email protected]

6. Data Storage and Hosting

Data Retention

• Account data: Retained while your account is active, deleted within 30 days of account deletion
• Diagnostic queries: Retained for up to 2 years for service improvement, then anonymized or deleted
• Server logs: Retained for up to 90 days for security and troubleshooting purposes
• Contact form submissions: Retained for up to 1 year, then deleted

International Data Transfers

While our primary data storage is in the EU, our service providers (Vercel, Supabase) may use infrastructure in multiple regions. We ensure that:

• All data transfers comply with GDPR requirements
• Standard Contractual Clauses (SCCs) are in place where applicable
• Data processing agreements are established with all service providers

7. Your Rights

Under GDPR and similar laws, you have the right to:

• Request access to your personal data
• Request correction or deletion
• Object to data processing
• Request data portability

To exercise these rights, contact:[email protected]

8. Data Security

We implement modern encryption (HTTPS), access control, and regular audits to protect your data.

9. Third Parties

Currently, we do not use external trackers (e.g. Google Analytics, Facebook Pixel). If any such tools are introduced in the future, this policy will be updated.

Service Providers

We use the following service providers who may process your data:

• Vercel: Hosting and content delivery (privacy policy: vercel.com/legal/privacy-policy)
• Supabase: Database hosting and backend services (privacy policy: supabase.com/privacy)

10. Children's Privacy (COPPA)

Our service is not directed to children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at:[email protected] and we will delete such information.

11. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact: