Privacy Notice

What we use and why

Your assessment and wellbeing information is used to support your reflection and create the outputs you request. Saved personal answers are encrypted. To generate a letter or report, the necessary content is processed automatically by Aletheia and its AI service providers, OpenRouter and the providers serving OpenAI models. Aletheia does not save prompts or generated text to your account; outputs remain in your browser session unless you download them. OpenRouter routes generation requests to OpenAI models, served by OpenAI, Microsoft Azure or Amazon Bedrock depending on the available endpoint. Provider retention and temporary caching depend on that endpoint; we do not promise zero retention across all providers. Optional feedback is separate and is readable by Aletheia’s owner.

We use your email and account settings to sign you in, maintain your account and provide the service you request (GDPR Article 6(1)(b)). Essential security and technical records help prevent abuse and keep the service working (Article 6(1)(f), our legitimate interest in operating a secure service).

Assessment responses, personal context, wellbeing checks and generated reflections can reveal sensitive information, including mental health. We process this information with your explicit consent (Articles 6(1)(a) and 9(2)(a)). You choose whether to use these features and may stop at any time. The Privacy Notice informs you; agreeing to Terms does not itself give this consent.

We keep the versions and times of your Terms acceptance, sensitive-data consent and withdrawal to administer your choices and demonstrate accountability. We do not use your information for advertising, sell it, or make decisions with legal or similarly significant effects through AI.

Who processes information

Supabase provides account authentication and database storage; Resend delivers sign-in email; Vercel hosts the application; OpenRouter routes AI requests to OpenAI models; OpenAI, Microsoft Azure or Amazon Bedrock may serve them. Cloudflare forwards support mail to the operator’s mailbox. Their systems process the information needed for those services. Generation is automatic and does not involve routine human reading by Aletheia. Encrypted saved answers cannot be read by Aletheia without your browser-held key; content you submit for generation is briefly available to the application while it prepares and returns your output.

Sentry receives limited technical error information, excluding assessment text, generated text, email addresses and request bodies from our reporting. Support correspondence and feedback you choose to send are readable by Aletheia’s operator. Please avoid names or identifying details about other people in free-text fields.

Some providers process information outside the European Economic Area. Provider contracts and applicable transfer safeguards, including standard contractual clauses where used, govern those transfers. Contact us for details or a copy of the applicable safeguards. Hosting in Europe does not mean every processing step stays in Europe.

Saving and deletion

Your account and saved assessment information remain available until you reset the relevant data or delete your account. Automatic inactivity deletion is not currently enabled. Reset assessment data has a 30-day recovery and purge design. Backup expiry and provider records follow their separate retention arrangements. Browser copies and downloaded documents are under your control; browsers may restore a previous tab session.

OpenRouter prompt/output logging and response caching are disabled for the configured account, and routing excludes providers marked as collecting data for training. These settings do not establish zero retention everywhere. The providers serving OpenAI models may temporarily retain or cache content under their endpoint-specific policies; we have not established that provider caching is disabled. Security, abuse-prevention and operational records can have different retention periods. Contact us about provider-specific retention or deletion.

Account deletion removes the active account and its linked content, including acceptance history. A limited security record of deletion and reset actions remains, containing an account identifier and a one-way network fingerprint. Backup and provider technical records can expire later under their retention arrangements; deletion cannot remove files you downloaded or sent elsewhere. We do not promise immediate removal from every backup or provider system.

Optional feedback

Feedback is a separate choice, with its own participation notice before you submit it. Product feedback is linked to your account and readable by the owner to improve Aletheia. Optional personal or health-related feedback requires a further explicit choice, is kept separately, and expires 12 months after its first save (editing does not extend this). The Feedback notice explains editing, withdrawal, retention and the limits on publication. Accepting Terms or assessment processing does not opt you in to feedback.

Your choices and rights

You can review these documents, withdraw assessment consent, export your information, reset saved data or delete your account in Account. Withdrawal stops further assessment and AI generation; it does not undo earlier lawful processing or automatically erase existing records. You can still access Account to export or delete them. Feedback has separate withdrawal controls.

Contact support@aletheia.page to request access, correction, erasure, restriction, portability, or to object to processing based on legitimate interests. These rights depend on the processing and applicable law. We normally respond within one month; where a lawful extension is needed, we will explain it. We may ask for proportionate information to verify your identity.

You may complain to the Hellenic Data Protection Authority or the supervisory authority where you live or work. Essential cookies and browser storage support sign-in, security, preferences and your current work; see the storage explanation on Privacy & Security. There are no advertising trackers.

Changes to this notice

We will explain material changes before applying them to your information and seek fresh consent where required. The current version is available here and through Account.