Privacy Policy

Data controller: Intleacht Research Ltd, Co. Cork, Ireland (CRO 817817) · Effective date: [DATE] · Version 0.1 — DRAFT for review

1. What we collect

• AI generation requests: the natural-language description you submit, sent to our AI provider (OpenRouter) to generate dashboard JSON.
• Rate-limiting data: your IP address, hashed before storage, used only to enforce per-IP and daily usage limits. The raw IP is not retained by us.
• Community submissions (optional): dashboard JSON you choose to publish to the community gallery.
• Android app: dashboards, settings and any connected-account tokens are stored locally on your device. We do not receive copies.
• Connected services (optional): API keys you enter for a service such as GitHub or CoinGecko are held in your browser's local storage on that device only. They are not sent to us, not sent to the AI provider, and are removed from anything you download or publish.

We do not require an account, and we do not sell personal data.

2. Lawful basis

• AI generation and security/rate-limiting: legitimate interests (providing and protecting the Service, Art. 6(1)(f) GDPR).
• Optional community publishing and any cookies beyond strictly necessary: consent, withdrawable at any time.

3. AI provider and prompt retention

Generation requests are routed through our backend (Vercel Edge Functions) to OpenRouter. Our provider configuration denies prompt/output retention and training on your inputs. OpenRouter acts as a processor under a data processing agreement. See their privacy policy for their handling.

3a. Signing in to Google

Some tools read your own Google Analytics, Search Console or Google Sheets data. Signing in happens directly between your browser and Google, through Google Identity Services. The access token Google returns is held in your browser's memory for as long as that tab is open and is written to no storage; it is not sent to us, does not appear in a tool you download or publish, and ends when you close the tab. We are not a party to that sign-in and do not act as a controller or processor for the data it grants access to — the relationship is between you and Google, and their privacy policy governs it. The access a tool asks for is shown to you by Google before you grant it, and you can withdraw it at any time in your Google account permissions.

4. Retention

• Hashed rate-limit counters: rolling 24-hour window, then deleted.
• Community dashboards: retained until you ask us to remove them or the gallery is discontinued.
• Android app data: retained on your device until you delete it or uninstall.

5. Your rights (GDPR)

You have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. Because we hold almost no identifiable data, most requests will be confirmed as "no data held". To exercise any right, email [SUPPORT EMAIL]; we respond within 30 days. You may complain to the Data Protection Commission (dataprotection.ie).

6. Security

All traffic is encrypted in transit (HTTPS/TLS). Secrets are held server-side in our hosting provider's environment (Vercel) and Supabase; the generation endpoint is origin-locked, protected by Cloudflare Turnstile, and rate-limited. No payment credentials are stored on our infrastructure.

7. Transfers outside the EEA

Vercel, Supabase, Cloudflare (Turnstile) and OpenRouter may process data outside the EEA under EU Standard Contractual Clauses / their applicable transfer frameworks.

8. Breach notification

If a personal data breach is likely to affect your rights, we will notify the Data Protection Commission within 72 hours and affected users without undue delay, per Art. 33–34 GDPR.

9. Changes

Material changes will be announced on this page with a new effective date.

10. Contact

Intleacht Research Ltd · [SUPPORT EMAIL] · Co. Cork, Ireland.