Privacy Policy

1. Introduction

This Privacy Policy explains how Dafydd Thomas Software Ltd trading as sgwrs.cymru ("Dafydd Thomas Software Ltd", "we", "us"), collects, uses and protects your personal data when you use the sgwrs.cymru service ("Service").

Dafydd Thomas Software Ltd trading as sgwrs.cymru is the data controller for personal data processed through this Service, under the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described, you must not use the Service.

2. Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Legitimate interests: Providing, securing and improving the Service, preventing abuse, and ensuring the safety of the platform.
• Performance of a contract: Processing payments and managing subscriptions for the current Pro plan and existing legacy Premier subscriptions.
• Consent: Sending optional marketing communications where you have given specific consent.
• Legitimate interests (chat storage): Storing conversation history as a core feature of the Service, enabling users to review and continue previous conversations. For paid users, this also falls under performance of a contract.

You may withdraw consent at any time in Settings → Account, by contacting us at data-protection@sgwrs.cymru, or by using the unsubscribe link in any marketing email. Product news is off by default. This choice does not affect important account and service notifications.

3. Data We Collect

Account information (via Clerk): We use Clerk for authentication and organisation membership. When you register an account, Clerk collects and stores your name, email address, and OAuth profile (if you sign in via Google, GitHub, etc.). If you create or join an organisation, Clerk also processes its name, your membership, role, permissions, and the organisation selected in your session. Please refer to Clerk's privacy policy for full details of how Clerk handles this data.

Usage data (via Vercel Analytics): We use Vercel Analytics to collect anonymous traffic and usage statistics, including aggregate page views and anonymised behavioural events (such as feature usage and billing actions). No personally identifiable data is collected by this system, and all tracked events are subject to strict data sanitisation to prevent the inclusion of personal information.

Payment data (via Stripe): Payments are processed directly by Stripe. We do not store credit card details or sensitive financial information on our own servers. Transaction records are held by Stripe.

Email notifications and optional product news (via Resend): We use Resend to send account and service notifications to your account email address. Resend processes the recipient address, message content, and delivery information. If you choose to receive Sgwrs product news, Resend also stores your email address and subscription status to manage these emails and unsubscribe requests. Your news preference belongs to your account, independently of your selected Personal or organisation profile.

Chat messages and prompts: The content of conversations you send to the Service is stored on our servers (Convex) in order to provide the service and maintain conversation history. Conversations are associated with the Personal or organisation profile selected when you use the Service and, within an organisation profile, with the member who created them.

Organisation profile data: An organisation profile has its own subscription, aggregate usage, settings, and member state. Ordinary member chats, prompts, memories, files, and preferences remain private to that member unless they deliberately share them through a Service feature. Organisation administrators may access billing, membership, policy, and privacy-minimal aggregate usage information, but administrator status alone does not grant access to private member content.

Google Drive Integration (optional): If you connect one or more Google accounts via the in-app Google Drive Integration (@Drive), we request permission to search and read files across the connected Drive and to create or update files you use with Sgwrs. We store encrypted OAuth refresh tokens on our servers (Convex); tokens are never returned to the browser. Opening the @ menu retrieves recent file metadata to suggest files. Selecting an account or file lets the assistant search that account and read supported file content when needed for your request. Content read from Drive is sent to the AI provider to answer your request; the answer may include excerpts that are stored in your chat history. Original files remain in Google Drive. We store file references (title, file id, link, and short change summaries) so you can revisit them in chat. Sgwrs can create Google Docs, Sheets, and Slides and update files it created in the conversation when you ask. You may connect multiple Google accounts and disconnect them at any time. Existing connections must be reconnected to grant account-wide read access. This Integration is separate from signing in to sgwrs.cymru with Google via Clerk.

4. How We Use Data

We use your personal data for the following purposes:

• Service provision: Processing and returning AI responses to your queries, storing profile-specific conversation history, maintaining settings, and confirming organisation membership and access.
• Billing: Processing separate Personal and organisation subscription payments, managing billing periods, attributing usage to the active profile, and complying with tax obligations.
• Email communications: Sending important account and service notifications, and optional Sgwrs product news only when you have subscribed.
• Abuse prevention: Monitoring for activity that violates our Terms of Service, or that is harmful or inappropriate, in order to protect other users and the platform.
• Anonymous analytics: Understanding how the Service is used at an aggregate level to improve performance and user experience.

We will not process your data for any other purpose without informing you and establishing an appropriate lawful basis.

5. AI Providers and Data Processing

The Service sends your prompts and relevant conversation content directly to OpenAI to generate responses and images, extract conversation memory, and carry out web searches when requested. Uploaded files may be included where needed to answer your request. Vercel hosts the web app.

When you opt into the knowledge pilot, only the documents you explicitly upload are copied to OpenAI Files and vector stores for semantic search. They stay private to you within the selected profile and project. We record their source and checksum. This does not scan your Google Drive or replace course-unit material. Response storage is disabled (store:false), but hosted files and indexes retain separate state. The pilot makes sources unavailable after 24 hours and schedules deletion of local content and both hosted resources; deleting a document or project also revokes retrieval immediately. Provider expiry is a fallback, and cleanup is retried after failures. OpenAI may retain abuse-monitoring data for up to 30 days, subject to its data-control terms. See OpenAI data controls.

When you enable file analysis, OpenAI runs calculations in a temporary hosted sandbox. We send the files attached to that turn and the relevant conversation instructions. We request deletion of the sandbox after the analysis; if cleanup fails, it expires after 20 minutes of inactivity. Generated downloads are held privately by Sgwrs for up to seven days, can be deleted from chat, and require access to the original profile and conversation. OpenAI may retain abuse-monitoring logs for up to 30 days under its API data policy. These temporary containers are separate from the response-storage setting.

• OpenAI — openai.com/privacy

We encourage you to read OpenAI's privacy policy as well.

We do not use your data to train AI models.

6. Data Sharing

We do not sell your personal data.

We share personal data only with the following sub-processors, for specific purposes:

| Sub-processor | Purpose | Policy | | ---------------- | ------------------------------------- | -------------------------------------------------------------------------- | | Clerk | Authentication and account management | clerk.com/privacy | | Stripe | Payment processing | stripe.com/privacy | | Vercel | Platform hosting and analytics | vercel.com/legal/privacy-policy | | Convex | Database and conversation storage | convex.dev/privacy | | Resend | Account and service emails; optional subscribed product news | resend.com/legal/privacy-policy | | OpenAI | Generating responses | See section 5 above |

We have data processing agreements in place with all sub-processors listed above, in accordance with Article 28 of the UK GDPR.

We may also disclose data where required by law (e.g. a court order) or to protect the legal rights of Dafydd Thomas Software Ltd.

7. International Transfers

Some of our sub-processors, including Clerk, Stripe, Vercel, Convex, Resend and the AI providers, are based in the United States or in other countries outside the European Economic Area (EEA) and the United Kingdom.

Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses, as approved by the ICO. All of our sub-processors are committed to data protection standards equivalent to UK GDPR requirements.

8. Your Rights (UK GDPR)

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of access: To receive a copy of the personal data we hold about you.
• Right to rectification: To ask us to correct inaccurate or incomplete data.
• Right to erasure: To ask us to delete your personal data (the "right to be forgotten"), subject to legal exceptions.
• Right to restriction: To ask us to restrict how we process your data in certain circumstances.
• Right to data portability: To receive your data in a structured, commonly used and machine-readable format.
• Right to object: To object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, please contact us at data-protection@sgwrs.cymru. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully. The ICO can be contacted at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

The Service uses automated processing (AI model responses) to generate replies to your queries. These responses do not constitute automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR. We do not profile users for marketing purposes. Abuse-prevention monitoring does not produce legal or similarly significant effects on you.

9. Data Retention

• Personal account and profile data: Retained while the account is active. When an account is deleted, Personal profile data is removed within 30 days, subject to legal exceptions.
• Organisation profile data: Removing or leaving an organisation ends the member's access but does not automatically delete the organisation's legitimate data, billing records, or content that must be retained for the organisation. Private member content remains inaccessible to other members and administrators unless it was deliberately shared. Organisation deletion and retention requests are handled by the organisation's authorised administrator, subject to legal obligations and the rights of affected people.
• Conversation data: Chat messages are stored on Convex while the relevant profile is active and then handled under the Personal or organisation retention rule above.
• Payment records: Financial records are retained for the period required by applicable law (generally at least six years) to comply with legal and taxation obligations.
• Diagnostic logs: Anonymous system logs are retained for up to 30 days for security and analytics purposes.

10. Cookies

We use a limited number of cookies:

• Clerk session cookies (functional): Essential cookies used by Clerk to maintain your login session. These are necessary for the Service to operate.
• Vercel Analytics (anonymous): Vercel Analytics operates without cookies. It collects anonymous performance data to understand how the Service is used. No individual users are identified.

We do not use advertising cookies, third-party tracking cookies, or any cookies that build marketing profiles.

11. Children

This Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data to us, please contact us immediately at data-protection@sgwrs.cymru so that we can take appropriate action.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, technical changes, or legal changes. When we do, we will update the "Last Updated" date at the top of this page.

Where changes are material, we will endeavour to provide appropriate notice, for example by email or a prominent notice on the platform. By continuing to use the Service after changes take effect, you acknowledge the revised Policy.

13. Contact Us

If you have any questions about this Privacy Policy or about how we process your personal data, please contact us:

Dafydd Thomas Software Ltd trading as sgwrs.cymru data-protection@sgwrs.cymru

Data Protection Officer: Dafydd Thomas