Privacy Policy

1. Data Controller & Contact

Company: AI Chat Platform

Data Protection Contact: adam@captivewifi.com

Website: ai.captivewifi.com

For all privacy-related inquiries, data requests, or to exercise your GDPR rights, please email: adam@captivewifi.com

2. Information We Collect

We collect the following categories of personal information:

• Account Information: Username, email address, encrypted password, account creation date
• Conversation Data: Chat messages, AI responses, conversation titles, timestamps
• Authentication Data: Multi-factor authentication codes, verification status, session tokens
• Usage Data: Agent selections, validation modes, feature usage patterns
• Analytics Data: Question patterns, KB interactions, model preferences
• System Logs: API usage, token consumption, costs, error logs

3. How We Use Your Information

We process your personal data for the following purposes:

• Provide and maintain AI chat services
• Authenticate your identity and secure your account with mandatory MFA
• Process conversations with AI models and generate responses
• Improve service quality through analytics and usage patterns
• Send verification codes and service notifications via email
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and regulatory requirements

4. Legal Basis for Processing (GDPR Article 6)

• Consent (Art. 6.1.a): You provide explicit consent during registration
• Contract (Art. 6.1.b): Processing necessary to provide AI chat services
• Legitimate Interests (Art. 6.1.f): Security, fraud prevention, service improvement
• Legal Obligation (Art. 6.1.c): Compliance with applicable laws

5. Third-Party AI Providers

Your chat messages are processed by the following third-party AI services:

• Google Gemini 2.0 Flash: Google Cloud AI services for fast, cost-effective AI responses
• Anthropic Claude Sonnet 4.5: Premium AI conversation processing
• OpenAI GPT-4o-mini: Balanced AI model for general queries
• Postmark: Email delivery service for MFA codes and notifications

These providers process your messages solely to generate AI responses and are bound by their own GDPR-compliant privacy policies. We never sell or share your data for marketing purposes.

6. Your GDPR Rights

Article 15 - Right to Access:

You have the right to request a copy of all personal data we hold about you. Use the "Export My Data" button to download your complete data in JSON format.

Article 16 - Right to Rectification:

You can request correction of inaccurate or incomplete personal data through your account settings or by contacting adam@captivewifi.com.

Article 17 - Right to Erasure ("Right to be Forgotten"):

You can permanently delete your account and all associated data using the "Delete Account" button. This action is irreversible and removes all conversations, messages, and analytics.

Article 18 - Right to Restriction of Processing:

You can request temporary suspension of data processing while we verify accuracy or resolve objections. Contact adam@captivewifi.com to request processing restriction.

Article 20 - Right to Data Portability:

You can export your data in a structured, machine-readable JSON format using the "Export My Data" feature.

Article 21 - Right to Object:

You can object to processing based on legitimate interests or for direct marketing purposes. Contact adam@captivewifi.com to file an objection.

7. How to Exercise Your Rights

Automated Self-Service:

• Export Data: Click "📥 Export My Data" in the chat sidebar to download all your data
• Delete Account: Click "🗑️ Delete Account" to permanently erase all your personal data

Email Requests: For all other rights (rectification, restriction, objection), email adam@captivewifi.com with your request. We will respond within 30 days as required by GDPR.

8. Data Retention

• Active Accounts: Data retained while your account is active
• Deleted Accounts: All data permanently deleted within 30 days
• Backup Retention: Removed from backups within 90 days
• Legal Hold: Some data may be retained longer if required by law

9. Data Security

We implement industry-standard security measures:

• Encryption: Passwords hashed with bcrypt; HTTPS/TLS for data in transit
• Multi-Factor Authentication: Mandatory email-based MFA for all accounts
• Access Controls: Role-based permissions with admin approval for new accounts
• Database Security: PostgreSQL with encrypted connections and access logs
• Session Management: Secure session tokens with automatic expiration

10. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately at adam@captivewifi.com.

11. International Data Transfers

Your data may be processed in data centers located in the EU and United States. All transfers comply with GDPR requirements through Standard Contractual Clauses or adequacy decisions.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email notification. Continued use after changes constitutes acceptance.

13. Supervisory Authority

If your privacy concerns are not adequately addressed, you have the right to lodge a complaint with your local data protection supervisory authority. EU users can find their authority at: https://edpb.europa.eu

14. Consent & Withdrawal

By using our service, you consent to this Privacy Policy. You may withdraw consent at any time by deleting your account. This does not affect the lawfulness of processing before withdrawal.