Privacy Policy

1. Data controller and contact details

Data controller: [CONFIRM: full name of the individual or registered name of the provider]. Contact for privacy questions and the exercise of data protection rights: [CONFIRM: email address]. Address or registered office: [CONFIRM: information required for the legal notice].

2. Personal data we process

When you register, we process your name, email address, and information needed for authentication. Your password is stored in the database as a protected cryptographic hash, not as plain text. When you use the service, we may store conversations and messages, conversation titles, AI Memory that you enter yourself, session information, request timestamps, and technical data needed for security (such as your IP address in server logs).

Please avoid entering other people's personal information, passwords, or particularly sensitive data in conversations or AI Memory unless there is a clear reason and appropriate authorization to do so.

3. Why we process data

Account, session, conversation, and memory data are used to create accounts and provide the features you request. Technical logs and request limits are used to protect the service against misuse and maintain security. The legal bases may include processing necessary to provide the service and relevant legitimate interests in security; for optional features, users provide the information voluntarily. [CONFIRM: final legal bases for each type of processing].

4. Where data is processed and who can access it

RuthenAI uses a dedicated Netcup server for the web application and database. Network routing and infrastructure may involve Cloudflare. When AI generation becomes available, selected parts of conversations and, where relevant, AI Memory will be sent to a separate model server operated by the RuthenAI provider to generate responses. [CONFIRM: processing locations, agreements with service providers, any international data transfers, and safeguards].

Do not assume that your data remains exclusively on your own device.

5. Cookies and technical data

Sign-in uses a functional session cookie with the HttpOnly, Secure, and SameSite security attributes. The current interface does not include separate advertising or analytics cookies. However, network infrastructure providers may process technical data necessary to operate their services. [CONFIRM: the complete list of cookies and external services before public release].

6. How long we keep data

Account data, user conversations, and AI Memory remain available until the user deletes them using the relevant features, or while the account exists, subject to possible exceptions required by law. Deleting data from the active database does not necessarily remove it immediately from existing backups. [CONFIRM: actual retention periods for backups, server logs, AI request records, and the periods for their deletion].

7. Your rights

You may request information about the processing of your personal data, access to it, its correction or deletion, restriction of processing, data portability where applicable, and object to processing in circumstances provided by law. The application allows you to delete conversations, AI Memory, and your account. For other requests or problems, use the contact details in Section 1. You may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs).

8. Security

We use technical measures such as HTTPS, password-protected sign-in, access controls for user data, and an authenticated connection between the application and AI service. No security measure can guarantee absolute protection.

9. Changes to this notice

This notice may be updated when the service's features or data processing practices change. The current version should be readily available on the website before registration and during use.