Privacy Policy

1. Introduction

This Privacy Policy explains how Dafydd Thomas Software Ltd trading as sgwrs.cymru ("Dafydd Thomas Software Ltd", "we", "us"), collects, uses and protects your personal data when you use the sgwrs.cymru service ("Service").

Dafydd Thomas Software Ltd trading as sgwrs.cymru is the data controller for personal data processed through this Service, under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described, you must not use the Service.

2. Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Legitimate interests: Providing, securing and improving the Service, preventing abuse, and ensuring the safety of the platform.
• Performance of a contract: Processing payments and managing subscriptions for paid plans (Pro and Premier).
• Consent: Sending optional marketing communications where you have given specific consent.
• Legitimate interests (chat storage): Storing conversation history as a core feature of the Service, enabling users to review and continue previous conversations. For paid users, this also falls under performance of a contract.

You may withdraw consent at any time by contacting us at data-protection@sgwrs.cymru or by using the unsubscribe link in any marketing email.

3. Data We Collect

Account information (via Clerk): We use Clerk for authentication. When you register an account, Clerk collects and stores your name, email address, and OAuth profile (if you sign in via Google, GitHub, etc.). Please refer to Clerk's privacy policy for full details of how Clerk handles this data.

Usage data (via Vercel Analytics): We use Vercel Analytics to collect anonymous traffic and usage statistics, including aggregate page views and anonymised behavioural events (such as feature usage and billing actions). No personally identifiable data is collected by this system, and all tracked events are subject to strict data sanitisation to prevent the inclusion of personal information.

Payment data (via Stripe): Payments are processed directly by Stripe. We do not store credit card details or sensitive financial information on our own servers. Transaction records are held by Stripe.

Chat messages and prompts: The content of conversations you send to the Service is stored on our servers (Convex) in order to provide the service and maintain conversation history. Conversations are associated with your account.

4. How We Use Data

We use your personal data for the following purposes:

• Service provision: Processing and returning AI responses to your queries, storing conversation history, and maintaining account settings.
• Billing: Processing subscription payments, managing billing periods, and complying with tax obligations.
• Abuse prevention: Monitoring for activity that violates our Terms of Service, or that is harmful or inappropriate, in order to protect other users and the platform.
• Anonymous analytics: Understanding how the Service is used at an aggregate level to improve performance and user experience.

We will not process your data for any other purpose without informing you and establishing an appropriate lawful basis.

5. AI Providers and Data Processing

The Service uses Vercel AI Gateway to route your prompts to third-party AI model providers. These providers may include:

• OpenAI — openai.com/privacy
• Anthropic — anthropic.com/privacy
• Google — policies.google.com/privacy
• Perplexity — perplexity.ai/privacy

When a prompt is sent to the Service, it is transmitted to the relevant model provider in order to generate a response. We encourage you to read the privacy policies of these providers as well.

We do not use your data to train AI models.

6. Data Sharing

We do not sell your personal data.

We share personal data only with the following sub-processors, for specific purposes:

| Sub-processor | Purpose | Policy | |---|---|---| | Clerk | Authentication and account management | clerk.com/privacy | | Stripe | Payment processing | stripe.com/privacy | | Vercel | Platform hosting and analytics | vercel.com/legal/privacy-policy | | Convex | Database and conversation storage | convex.dev/privacy | | AI Providers | Generating responses | See section 5 above |

We have data processing agreements in place with all sub-processors listed above, in accordance with Article 28 of the UK GDPR.

We may also disclose data where required by law (e.g. a court order) or to protect the legal rights of Dafydd Thomas Software Ltd.

7. International Transfers

Some of our sub-processors, including Clerk, Stripe, Vercel, Convex and the AI providers, are based in the United States or in other countries outside the European Economic Area (EEA) and the United Kingdom.

Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, as approved by the ICO. All of our sub-processors are committed to data protection standards equivalent to UK GDPR requirements.

8. Your Rights (UK GDPR)

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: To receive a copy of the personal data we hold about you.
• Right to rectification: To ask us to correct inaccurate or incomplete data.
• Right to erasure: To ask us to delete your personal data (the "right to be forgotten"), subject to legal exceptions.
• Right to restriction: To ask us to restrict how we process your data in certain circumstances.
• Right to data portability: To receive your data in a structured, commonly used and machine-readable format.
• Right to object: To object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, please contact us at data-protection@sgwrs.cymru. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully. The ICO can be contacted at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

The Service uses automated processing (AI model responses) to generate replies to your queries. These responses do not constitute automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR. We do not profile users for marketing purposes. Abuse-prevention monitoring does not produce legal or similarly significant effects on you.

9. Data Retention

• Account data: Retained while the account is active. When an account is deleted, personal data is removed within 30 days.
• Conversation data: Chat messages are stored on Convex while the account is active. Deleting your account triggers deletion of all associated conversation data within 30 days.
• Payment records: Financial records are retained for the period required by applicable law (generally at least six years) to comply with legal and taxation obligations.
• Diagnostic logs: Anonymous system logs are retained for up to 30 days for security and analytics purposes.

10. Cookies

We use a limited number of cookies:

• Clerk session cookies (functional): Essential cookies used by Clerk to maintain your login session. These are necessary for the Service to operate.
• Vercel Analytics (anonymous): Vercel Analytics operates without cookies. It collects anonymous performance data to understand how the Service is used. No individual users are identified.

We do not use advertising cookies, third-party tracking cookies, or any cookies that build marketing profiles.

11. Children

This Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data to us, please contact us immediately at data-protection@sgwrs.cymru so that we can take appropriate action.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, technical changes, or legal changes. When we do, we will update the "Last Updated" date at the top of this page.

Where changes are material, we will endeavour to provide appropriate notice, for example by email or a prominent notice on the platform. By continuing to use the Service after changes take effect, you acknowledge the revised Policy.

13. Contact Us

If you have any questions about this Privacy Policy or about how we process your personal data, please contact us:

Dafydd Thomas Software Ltd trading as sgwrs.cymru data-protection@sgwrs.cymru

Data Protection Officer: Dafydd Thomas