Privacy Policy & Local Storage Notice

Section 1: Data Controller Identity and UK Contact

For the purposes of the UK GDPR and United Kingdom Data Protection Legislation, the Data Controller responsible for your personal data is DyausGPT (developed and maintained by Dyaus Pandey).

If you have questions regarding data governance, subject access requests, or local storage management, you may contact our designated Data Privacy Officer at support@dyausgpt.fyi.

Section 2: Lawful Bases for Processing Under UK GDPR

We only process personal information where an established lawful condition under the UK GDPR framework applies:

• Performance of a Contract: Processing prompts, managing active chat context, and rendering conversational responses requested by you.
• Legitimate Interests: Securing the application against automated denial of service, preventing prompt injection attacks, monitoring system health, and ensuring server stability.
• Consent: Storing functional interface customisations on-device where explicit user choices have been recorded.
• Legal Obligation: Retaining safety records and cooperating with United Kingdom statutory authorities under the Online Safety Act 2023.

Section 3: Categories of Personal and Usage Data Collected

We collect and process the following categories of information when you interact with DyausGPT:

• Conversational Prompt Inputs: The questions, directives, uploaded files, and contextual history you submit in active conversations.
• Technical Telemetry: Anonymized Internet Protocol (IP) addresses, operating system version, browser user-agent strings, and request latency figures.
• Client-Side Preferences: Local layout configurations, active model IDs, UI theme preferences, and user interface customization variables stored within your browser.
• Authentication Data: If user account features are utilized, account email addresses and secure authorization tokens managed via Supabase infrastructure.

Section 4: Third-Party AI Model Processing and International Data Transfers

To generate real-time conversational responses, DyausGPT securely transmits prompt payloads to third-party model inference endpoints (such as OpenRouter, Google Cloud, OpenAI, or Anthropic):

• Zero Model Training: Prompt data sent through our API integrations is not used to train public foundation artificial intelligence models.
• International Data Transfers: Where prompt data is routed to cloud servers situated outside the United Kingdom, transfers are conducted in accordance with Chapter V of the UK GDPR through the UK International Data Transfer Agreement (IDTA), the UK Addendum to Standard Contractual Clauses, or UK Adequacy Regulations.
• Transient Provider Retention: Third-party API providers retain transient logs for an operational window of 30 days strictly to inspect for security threats and illegal prompt attempts.

Section 5: Zero Cookie and Local Storage Policy (PECR 2003)

In compliance with Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), this section provides clear and comprehensive information regarding storage technologies utilized by DyausGPT.

How to Control Storage: You can inspect, export, or clear your local storage items at any time via the Data Management section in Settings or through your browser settings. Clearing local storage will erase saved conversation histories stored in your client environment.

Section 6: Data Retention Schedules and Local Device Storage

We adhere to strict data minimization principles under the UK GDPR:

• Client Stored History: Conversations remain stored within your browser until you choose to delete individual chats or clear local storage.
• Server Logs: Temporary gateway access logs are purged on an automated cycle of 30 days, unless longer preservation is mandated by United Kingdom law enforcement order.
• Account Records: When you delete an account, user profile records are purged from primary databases within 30 calendar days.

Section 7: Your UK Data Subject Rights and SAR Procedures

Under Chapter III of the UK GDPR, you hold significant statutory rights concerning your personal information:

• Right of Access: You may request confirmation as to whether your personal data is processed, and receive a copy through a formal Subject Access Request (SAR).
• Right to Rectification: You may request correction of inaccurate or incomplete personal records.
• Right to Erasure: You may request the deletion of your personal data ("right to be forgotten") where no overriding legal basis for retention exists.
• Right to Restrict Processing: You may request the temporary suspension of data processing under contested accuracy conditions.
• Right to Data Portability: You may request an export of your conversation data in a structured, machine-readable format (JSON).
• Right to Object: You may object at any time to data processing carried out under our legitimate interests.
• Automated Decision-Making Rights: You have the right not to be subjected to decisions based solely on automated processing that produce legal or significant effects.

Section 8: Children's Privacy and Age-Appropriate Design Code

DyausGPT is child-friendly and fully accessible to users under 13 without parental permission, respecting the Age Appropriate Design Code (Children's Code) established under United Kingdom data protection law:

• Under 13 Accessibility Without Parental Permission: Because DyausGPT operates on an absolute zero-data-collection, local-only model where no personal data, telemetry, analytics, or cookies are collected or processed remotely, statutory parental consent mandates under national data protection legislation (which apply strictly to remote personal data processing) are not triggered. Children under 13 can freely and independently use DyausGPT.
• Default Child Safety: The Service is designed to be universally child-friendly, prohibiting discussions of gore, graphic violence, and self-harm, with automatic crisis helpline referrals.
• No Profiling or Tracking: For all users, including children under 13 and teenagers under 19, high-privacy settings are enforced by default, with strictly zero behavioural profiling, geo-location tracking, or commercial marketing.

Section 9: Security Architecture and Technical Safeguards

We implement robust technical and organizational measures to ensure a level of data security appropriate to risk:

• Transport Encryption: All communications between your browser and our platform utilize Transport Layer Security (TLS 1.3) with cryptographic cipher suites.
• Content Isolation: Client-side chats are compartmentalized inside isolated browser storage contexts.
• Minimization of Surface: DyausGPT operates an ephemeral inference proxy architecture, eliminating superfluous storage of raw conversational prompts on intermediate servers.

Section 10: Right to Lodge a Complaint with the ICO

If you are dissatisfied with how we handle your personal data, or believe our processing violates United Kingdom data protection law, you possess the legal right to lodge a formal complaint with the supervisory authority:

Section 11: Modifications to This Privacy Notice

We may periodically update this Privacy Policy to reflect modifications in our technology, statutory guidance under the UK GDPR, or advisory updates from the Information Commissioner's Office. Material updates will be highlighted by updating the effective date at the top of this document.

Section 12: Privacy Contact Information and Requests

For questions regarding this Privacy Policy, your local storage preferences, or our data handling practices, please contact: