What we collect
- Account details — your name, username, e-mail address and, if you provide one, a phone number.
- Conversations — the messages and images you send to the assistant, and the replies you receive.
- Usage records — how many tokens each request consumed, which model answered, and when.
- Payment records — the plan, amount, method and reference. We never see or store your card number.
- Technical data — IP address and browser type, used for security, rate limiting and audit logs.
- Telegram link — your Telegram chat id, only if you choose to connect it.
How we use it
- To provide the assistant and keep your conversation history available to you.
- To count tokens accurately and show you what you have spent.
- To verify your identity, protect accounts and detect abuse.
- To process payments and issue receipts.
- To send the alerts you have enabled — low balance, expiry reminders and payment confirmations.
We do not sell your personal data, and we do not use your conversations for advertising.
Who can see your conversations
Your conversations are private to your account. Other students cannot access them. Our administrators can see account-level information — your balance, payments and usage totals — because they need it to support you and to keep the platform running. Administrative actions are recorded in an audit log.
To generate an answer, your message is sent to our AI provider, which processes it to produce the reply. We do not send them your name, e-mail address or payment details.
Images you upload
Uploaded images are validated, re-encoded to strip embedded metadata such as location tags, and stored under a random filename. They are attached to the conversation you sent them in and are deleted when you delete that conversation.
How long we keep it
- Conversations remain until you delete them or close your account.
- Token and payment records are kept for accounting purposes, as required by law.
- Verification codes are short-lived and stored only as a one-way hash.
- Rate-limit records are cleared automatically once their window has passed.
How we protect it
- Passwords are stored as salted hashes and are never recoverable, not even by us.
- Verification codes are hashed, expire quickly and can only be used once.
- Only one active session is allowed per account, so a forgotten sign-in elsewhere is closed automatically.
- API keys and payment credentials are held in the server environment, never in the database or the code.
Your choices
- Update or correct your details at any time from your profile page.
- Delete any conversation, which removes its messages and images.
- Turn individual notification types on or off in your profile.
- Disconnect Telegram whenever you like.
- Ask us for a copy of your data, or ask us to delete your account, by e-mailing support.
Cookies
We use cookies that are strictly necessary: one to keep you signed in and one to protect forms against cross-site request forgery. Your theme preference is stored in your browser and never sent to us. We do not use advertising or third-party tracking cookies.
Contact
For any privacy question or request, write to support@epc-ai.local.