Privacy
policy.

1. Controller and contact

The data controller is ExeliaLabs, ul. Chmielowicka, 45-758 Opole, Poland. For personal data inquiries, contact: biuro@exelia.pro.

2. Contact form and correspondence

Providing data is voluntary, but your name, email address, subject and message are needed to submit and answer an inquiry. After you confirm the form, the data is sent via SMTP to our mailbox. This also applies to an inquiry drafted with the AI assistant; chatting alone does not send an email. Do not submit sensitive data, passwords or other people’s personal data.

3. AI assistant

The assistant uses the OpenAI API (gpt-6-luna model). When you send a message, its content and a limited conversation context pass through our server to OpenAI to generate a reply. The conversation remains in the browser memory of the open page; we do not save its content in the application database. The assistant does not request your name or email. You enter contact details in a separate form, which does not send these fields to the model.

We use store: false to disable storing responses for later retrieval through the API. This does not eliminate all retention by OpenAI. Under the provider’s policy, API data is not used for model training by default, and abuse monitoring logs may contain content and be retained for up to 30 days, with legal and safety exceptions. We use global processing, which may take place outside the EEA; we do not claim EU-only processing or Zero Data Retention.

OpenAI data processing information

4. Purposes, legal grounds and retention

We handle inquiries and voluntary use of the assistant to answer questions or prepare a business relationship (Article 6(1)(b) GDPR for steps before entering into a contract, or Article 6(1)(f) for our legitimate interest in responding to inquiries). Security, abuse prevention and cost control rely on Article 6(1)(f) GDPR. We retain correspondence for the time needed to handle the matter and reasonably protect legal claims; you can ask about deleting a specific message.

The application database stores technical identifiers, HMAC digests for abuse prevention and duplicate submission control, and AI accounting metadata, without inquiry or conversation content. Request limit counters expire after one minute and duplicate submission records after 24 hours. Expired records are removed while handling subsequent requests; expiry does not mean immediate physical deletion. Server logs may contain IP addresses, timestamps, request paths and response status for security and diagnostics.

5. Hosting and email

The website and database run on an AlphaVPS VPS in Nuremberg, Germany. Email is handled by a self-hosted Stalwart server on the VPS. AlphaVPS provides infrastructure, while OpenAI processes content sent to the assistant. Email messages may also pass through the sender’s or recipient’s email provider servers.

6. Cookies, theme and analytics

The technical exelia_preferences cookie stores your analytics choice for 180 days, and exelia_chat identifies the assistant session for 24 hours. They are signed and unavailable to JavaScript (HttpOnly); on the public HTTPS website they use the Secure flag. Your theme preference stays in localStorage until changed or browser data is cleared. You can delete these records in your browser settings; this may reset preferences and the session.

Umami analytics is disabled at launch. We do not use advertising or marketing tracking. Optional analytics can operate only after configuration and your consent; simply not rejecting it does not enable measurement. You can change your choice using the privacy settings button in the footer. Withdrawing consent does not affect the lawfulness of earlier processing.

7. Your rights and contact

Subject to the conditions of the GDPR, you can request access, rectification, erasure, restriction or portability of your data and object to processing based on legitimate interests. You can complain to the President of the Polish Personal Data Protection Office (UODO). We do not use AI conversations to make automated decisions with legal or similarly significant effects. For privacy inquiries, write to biuro@exelia.pro.