Privacy Policy

Scope

This policy covers the Gyda service at askgyda.com, operated by [FILL: company name] of [FILL: registered address], Portugal, on servers in Spain.

Two kinds of person, and our two roles

This distinction runs through the whole policy, so it is worth stating first. Our customer is a business. It signs in to the dashboard, uploads its catalogue, builds an assistant and pays. For everything about that account we decide what is collected and why, so we are the controller. A guest is that business's own customer. They open a published assistant from a QR code, a link or a widget, they never sign in, and we never ask who they are. Everything a guest types goes into an assistant a business built, about a catalogue that business uploaded. For that traffic the business is the controller and we only process on its instructions.

What we collect about an account

Held in our database in Spain, for as long as the account exists.

• Your full name, email address, phone number, whether the email is verified, your preferred language and your chosen avatar.
• Sign in credentials, handled by our own self-hosted SuperTokens instance. Passwords are stored hashed and never reach our application code.
• If you sign in with Google, the email address and basic profile Google tells us about the account signing in.
• Your workspace name, its owner, its members and their roles, and invitations by email address.
• Billing: your plan, its status, the current period, the payment provider's customer identifier, and a record per payment with amount, currency, status and provider identifiers.
• Notification records and your per channel notification preferences.

The catalogue you upload

Content items with their titles, descriptions, prices, tags, links and call to action buttons, and the media files attached to them. Media is stored in object storage in Spain and served through a content delivery network. If you upload photographs of identifiable people, staff names, or reviews with names in them, that is personal data you decided to put there: you are the controller for it, and the processing agreement in our terms covers it.

What a published assistant records about a guest

When a guest chats with a published assistant we record the following, per conversation and per turn. The business that published the assistant is the controller for all of it.

• A random session identifier, generated in the guest's own browser and kept in that browser tab's session storage. It is not a cookie, it is not linked to a person, and it exists so a guest can return to their own conversation during the visit. It is gone when the tab is closed.
• The conversation itself: every message the guest types and every answer the assistant gives, kept so the conversation can be resumed and so the assistant has context for the next question. A short title is generated for each conversation from the guest's first message.
• Any images the guest attaches.
• A log entry per turn, which feeds the statistics the business sees: which assistant and workspace, the session and conversation identifiers, whether the turn succeeded, which catalogue items were served, which one was tapped, the language, the number of images, token counts and timings.
• When the assistant could not answer, that log entry also keeps the guest's question and the text that was searched for. This is what makes the "questions you could not answer" view work, and it means free text a guest typed is retained.
• Which call to action buttons were tapped and which links were shared.
• On a failed turn, the type of the error. Never its message, and never the guest's content.

What we never collect about a guest

No account, no name, no email address and no phone number. A guest is never asked to identify themselves and there is nowhere in our database to hold it.

How answers are generated

To generate an answer, the guest's question, the catalogue text retrieved for it and any images the guest attached are sent to a language model. Search embeddings are generated the same way. The provider is AWS Bedrock, and it is the only model provider this service uses. Answers are generated in Frankfurt. Search embeddings are requested from Spain, and AWS may process each request in any of its EU Regions. Either way the data stays inside AWS and inside the EU, and no third party model vendor is in the path. [FILL: quote AWS Bedrock's commitment not to train on your data, verbatim from its service terms, rather than paraphrasing it.]

Technical data

Your IP address is processed on every request for rate limiting and abuse prevention, read from a header our content delivery network adds. It is not stored as part of a chat or account record. Our servers keep request logs for operational debugging. Public endpoints are protected by a proof of work challenge served by our own self-hosted instance, so no third party is involved and nothing about the visitor is sent anywhere.

Support

Support runs on our own self-hosted system on our server in Spain. It holds your company, the contact details of the people we deal with, and the tickets themselves including whatever you write in them. New tickets are matched to your workspace. To answer a support request, our support staff can open a read-only view of your workspace; we are telling you because customers reasonably assume otherwise. They can look but cannot change anything. Each visit is opened deliberately rather than standing open: it records which member of staff, which workspace, when, and why, and it lapses within an hour. Your workspace's owners and admins are notified and can see every visit under Settings > Support Access.

If you write to us or apply to partner

When you send us a message from our website, such as the partner application on our partners page, we use what you type into the form only to reply to you and, for a partner application, to assess it and, if we agree to work together, to run that partnership. We do not add you to any mailing list.

• What we receive: your name, your email address, your company or studio if you give one, your city, your website or portfolio, and your message.
• Where it goes: our own self-hosted customer records on our server in Spain, the same system described under Support. Nobody else receives it.
• How the form is protected: by our self-hosted anti-bot check and by rate limiting, which reads your IP address as described under Technical data.
• Why we may: you asked us to reply, and we take the steps you asked for before any agreement between us.
• How long we keep it: if we never go on to work together, it is deleted 24 months after you contacted us. If we do, it becomes part of the partnership's records and follows their retention. You can ask us to delete it sooner at any time.

Analytics

We measure how our site and product are used with our own self-hosted Umami instance, running on our server in Spain. It is cookieless: it identifies a visit by a rotating hash rather than storing anything on your device, and nothing is sent to any third party. It records the shape of a page view, meaning the page, the referrer, the approximate location derived from the IP address, and the browser and device type. We use no advertising networks and no third party trackers of any kind. [FILL: list exactly which properties carry the analytics script, and state whether guests of a published assistant are counted.]

Email

Verification, invitations, notifications and billing notices are sent through Resend, so the recipient's address and the message content pass through it. Marketing email, if we send any, is opt in and every message carries an unsubscribe link.

Publishing an assistant

When you publish, a temporary machine starts inside our own cloud account, builds the published version from your catalogue including its images, and is then destroyed. Your catalogue does not leave that account, other than to the language model provider described above.

Who else touches the data

The full list. We will update it here when it changes.

• Amazon Web Services: hosting, database, object storage, content delivery, DNS and backups, in Spain, with delivery network edges worldwide.
• AWS Bedrock: generating assistant answers, in Frankfurt, and search embeddings, requested from Spain and processed in an AWS Region inside the EU.
• Resend: delivering transactional email, in the United States, under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.

What we run ourselves

Authentication, analytics, support and the anti-bot challenge all run on our own servers in Spain rather than being bought from someone else, which is why the list above is four lines long and two of them are the same company.

Cookies and what is stored on a device

A short list. The dashboard sets a session cookie so you can stay signed in, which is strictly necessary for the service you asked for. A published assistant keeps a random session identifier in the guest's browser tab, together with the assistant and workspace it belongs to, so the guest can return to their own conversation during the visit; it is session storage, so nothing outlives the tab. A guest who presses 'Keep on this device' (on the toast after their first favourite, or the switch in the menu) asks for that identifier to stay in their browser so their favourites and chats are there next time; it stays until they switch it off, which removes it at once. Our analytics sets no cookie and stores nothing on your device. The help centre remembers a 'Was this article helpful' vote in your browser only when you press the button, so it does not ask again. There is no advertising, no third party tracker and no data broker anywhere on this service.

How long we keep it

We keep each kind of data only for as long as it does its job, and then it is deleted on a schedule. Once something is permanently deleted, it can still sit in our encrypted backups for up to 30 more days, until those backups expire. The full list:

• Your account details (name, email, phone number and sign-in methods): removed as soon as you close your account. An anonymous record stays in their place so your past invoices still add up.
• Your workspace and everything in it: permanently deleted 30 days after you delete it or close your account. Deleting cannot be undone.
• Catalogue items, photos, videos and assistants you delete: permanently removed within 30 days.
• Guest conversations, including any photos guests attach: deleted 90 days after the conversation was last active.
• The per-answer statistics behind your dashboard, including questions the assistant could not answer and taps on buttons, links and shares: deleted after 12 months.
• Items guests save to their favourites: deleted 12 months after they were saved.
• Request logs, which include visitor IP addresses: deleted after 30 days.
• Events from our self-hosted, cookieless analytics: deleted after 12 months.
• Support tickets, including any screenshots attached to them: deleted 24 months after they are closed.
• Records of our support team opening your workspace or your tickets to help you, and of what they did there: deleted after 24 months.
• Your contact details in our customer records: deleted with your workspace. If you contacted us but never signed up, including through a form on our website or a partner application that did not lead to a partnership, deleted 24 months after you contacted us.
• The emails we send you, such as sign-in codes and notifications: our email provider keeps a copy and a delivery log for 30 days.
• Billing records: kept for 10 years from the end of the year they belong to, because Portuguese accounting law requires it. These cannot be deleted on request.
• Marketing consent records: kept while you are subscribed and for 3 years after. The unsubscribe list itself is kept for good, because honoring an opt-out means remembering it.

Security

Passwords are stored hashed by our authentication service and never reach our application code. Each workspace's content is isolated from every other. We use administrative, technical and physical safeguards to protect information, but no method of transmission or storage is completely secure.

Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or send it elsewhere, and you can complain to your supervisory authority. Ours is Portugal's Comissão Nacional de Proteção de Dados (CNPD), and you may also complain to the authority where you live or work.

• Access, update or delete your account information from the dashboard, or by writing to us.
• Opt out of marketing email at any time.
• If you are a guest of a business that uses Gyda, your request goes to that business, not to us. It is the controller for your conversation, and we help it answer.
• We have not appointed a data protection officer, because the law does not require one for what we do. Privacy questions and requests go to info@askgyda.com.

Where the data is

Account data, catalogue content and guest conversations are stored in Spain. Answers are generated in Frankfurt. Both are in the EU. The one exception is transactional email: the recipient's address and the message content pass through our email provider in the United States (see who else touches the data). Guest conversations and catalogue content never do. Media files are served through a content delivery network with edges worldwide, so a copy of a published image may be cached near the guest who requested it.

Children

The service is sold to businesses and is not directed to children. We do not knowingly collect personal information from them.

Changes to this policy

We may update this policy. If we make material changes we will post a notice on this page and, where it affects customers, tell them by email or in the dashboard.