Privacy Policy

Data controller: Intleacht Research Ltd, Co. Cork, Ireland (CRO 817817) · Effective date: [DATE] · Version 0.1 — DRAFT for review

1. What we collect

• AI generation requests: the natural-language description you submit, sent to our AI provider (OpenRouter) to generate dashboard JSON.
• Rate-limiting data: your IP address, hashed before storage, used only to enforce per-IP and daily usage limits. The raw IP is not retained by us.
• Community submissions (optional): dashboard JSON you choose to publish to the community gallery.
• Android app: dashboards, settings and any connected-account tokens are stored locally on your device. We do not receive copies.

We do not require an account, and we do not sell personal data.

2. Lawful basis

• AI generation and security/rate-limiting: legitimate interests (providing and protecting the Service, Art. 6(1)(f) GDPR).
• Optional community publishing and any cookies beyond strictly necessary: consent, withdrawable at any time.

3. AI provider and prompt retention

Generation requests are routed through Cloudflare Workers to OpenRouter. Our provider configuration denies prompt/output retention and training on your inputs. OpenRouter acts as a processor under a data processing agreement. See their privacy policy for their handling.

4. Retention

• Hashed rate-limit counters: rolling 24-hour window, then deleted.
• Community dashboards: retained until you ask us to remove them or the gallery is discontinued.
• Android app data: retained on your device until you delete it or uninstall.

5. Your rights (GDPR)

You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. Because we hold almost no identifiable data, most requests will be confirmed as "no data held". To exercise any right, email [SUPPORT EMAIL]; we respond within 30 days. You may complain to the Data Protection Commission (dataprotection.ie).

6. Security

All traffic is encrypted in transit (HTTPS/TLS). Secrets are held server-side in Cloudflare Workers; the generation endpoint is origin-locked, protected by Cloudflare Turnstile, and rate-limited. No payment or account credentials are stored on our infrastructure.

7. Transfers outside the EEA

Cloudflare and OpenRouter process data outside the EEA under EU Standard Contractual Clauses / their applicable transfer frameworks.

8. Breach notification

If a personal data breach is likely to affect your rights, we will notify the Data Protection Commission within 72 hours and affected users without undue delay, per Art. 33–34 GDPR.

9. Changes

Material changes will be announced on this page with a new effective date.

10. Contact

Intleacht Research Ltd · [SUPPORT EMAIL] · Co. Cork, Ireland.