Privacy Policy

1. Plain-English Summary

This policy applies to the Sulci cloud service at app.sulci.xyz, the sulci.xyz marketing website, the Chrome extension, the VS Code extension, the MCP server, and the API proxy. The self-hosted version is covered separately in Section 9.

2. Who We Are

Sulci is operated by Lopez Business Performance (Y-tunnus 3122380-5), a Finnish company ("we", "us", "our"). References to "Sulci", "the service", or "the platform" mean the software and infrastructure described above.

We are the data controller for personal data processed in connection with the cloud service.

3. What We Collect

3.1 Account data

When you create a cloud account: your email address, name (optional), and a hashed password (bcrypt — we cannot recover it). If you sign in with Google, we receive your Google account ID, email, and display name from Google's OAuth service.

3.2 Knowledge atoms

The core of the service. Facts, preferences, decisions, and entities you (or an AI tool acting on your behalf) store. These are created by you and owned by you. We store them on your behalf to deliver the service.

3.3 Integration data

If you connect Google Calendar, Google Docs, or Slack, we read and extract knowledge from those sources with your explicit permission. We store OAuth tokens (encrypted at rest) to maintain access, and extracted knowledge atoms from those sources. We do not store raw document text beyond the extraction window.

3.4 Usage data

Standard server logs (IP address, timestamp, endpoint, response code) retained for 30 days for security and debugging. Aggregate quota counters (extractions per month, context queries per day) for billing enforcement. We do not use behavioural analytics tools like Mixpanel or Amplitude.

3.5 Chrome extension

The extension reads conversation text from ChatGPT, Claude, Gemini, and Perplexity pages in your browser to detect and extract knowledge. This processing happens locally in your browser before sending extracted atoms to the API. The extension does not read any other pages, does not collect browsing history, and does not transmit raw conversation text — only the extracted atoms.

3.6 What we do NOT collect

• Payment card details (handled entirely by Stripe)
• Browsing history outside of configured AI tool pages
• Microphone, camera, or location data
• Raw LLM conversation transcripts (only the extracted atoms)
• Any data from minors (see Section 10)

4. How We Use It

We use the data collected solely to:

• Deliver the service — store, retrieve, and surface your knowledge atoms across tools
• Authenticate you — verify your identity on each request via JWT tokens
• Enforce quotas — track extraction and query counts against your tier limits
• Run LLM extraction — your conversation text is sent to OpenAI (GPT-4o-mini) or Anthropic (Claude) to extract atoms. We use our own API keys in cloud mode; your text is sent under our account, governed by their API terms
• Improve reliability — server logs and error tracking for debugging
• Communicate with you — transactional emails (account creation, billing receipts). We will ask separately before sending marketing emails

5. Where Data Is Stored

Cloud service data is stored in the following systems:

• Primary database — PostgreSQL hosted on Railway (EU or US region). Knowledge atoms, user accounts, OAuth tokens.
• Vector index — Stored in the same PostgreSQL instance using pgvector. Embedding vectors for semantic search.
• Backups — Automated daily backups retained for 7 days, stored in the same region.

Data at rest is encrypted using AES-256. Data in transit is encrypted using TLS 1.2+. OAuth tokens are additionally encrypted using a server-side key before database storage.

If you are in the EU, you may request that your data be stored in EU infrastructure. Email us at the address in Section 12.

6. Sharing & Third Parties

We share data with the following sub-processors only as necessary to operate the service:

• Railway — cloud infrastructure and database hosting. Privacy policy
• OpenAI — LLM extraction (cloud mode). Your conversation fragments are sent under our API account. OpenAI's API data is not used to train models per their API terms. API data policy
• Anthropic — alternative LLM provider (if configured). Privacy policy
• Google — OAuth authentication, Calendar/Docs integration. Your integration data is processed under your Google account's terms. Privacy policy
• Stripe — payment processing. We pass your email and billing details to Stripe; we never see or store card numbers. Privacy policy

We do not sell or rent your personal data to any third party. We do not share your data with law enforcement unless legally compelled, in which case we will notify you if permitted to do so.

7. Data Retention

• Account data — retained while your account is active. Deleted within 30 days of account deletion request.
• Knowledge atoms — retained until you delete them or delete your account.
• OAuth tokens — deleted when you disconnect an integration or delete your account.
• Server logs — 30 days, then automatically purged.
• Billing records — 7 years, as required by financial regulations.

When you delete your account, we permanently delete your atoms, OAuth tokens, and profile within 30 days. Anonymised aggregate statistics (e.g. "total extractions that month") may be retained.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of all personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — export your knowledge atoms via POST /api/v1/admin/export at any time
• Restriction — request we stop processing while a dispute is resolved
• Objection — object to processing based on legitimate interests
• Withdraw consent — disconnect integrations or delete your account at any time

EU/EEA residents: you have rights under GDPR. UK residents: you have rights under UK GDPR. California residents: you have rights under CCPA, including the right to know, delete, and opt out of sale (we do not sell data).

To exercise any of these rights, email us at privacy@sulci.xyz. We will respond within 30 days.

9. Self-Hosted Users

The self-hosted version is open source (MIT licence). You are the sole data controller for any data processed through your own deployment.

The only data we may receive from self-hosted users is what you voluntarily send to us (e.g. a bug report email or a GitHub issue). That is covered by ordinary correspondence, not this policy.

10. Children

Sulci is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@sulci.xyz and we will delete it promptly.

11. Changes to This Policy

We may update this policy as the service evolves. For material changes, we will notify you by email (if you have an account) at least 14 days before the change takes effect. The "Last updated" date at the top will always reflect the current version.

Continued use of the service after a change takes effect constitutes acceptance of the updated policy.

12. Contact

Questions, requests to exercise your rights, or privacy concerns:

For security vulnerabilities, please email security@sulci.xyz.