Política de privacidad

1. Introduction

Drephos is a product of Uncertainty Works Ltd., a company registered in England and Wales (Company No. 17169253) with its registered office at 124-128 City Road, London, United Kingdom, EC1V 2NX. In this policy, "Drephos", "we", "us", and "our" refer to Uncertainty Works Ltd.

We are the data controller for the personal information we collect through the Drephos service. This policy explains what we collect, why we collect it, how we use it, and the rights you have over it.

If you have questions about this policy or want to exercise any of the rights described below, contact us through the form on our website.

2. Information we collect

Account information. When you sign up, we collect your email address, display name, and the authentication identifiers we need to maintain your session.

Usage information. We record the models you use, usage or credits consumed, timestamps, wallet activity, and similar operational information. This powers your wallet balance, member caps, and usage view in the product.

Chat content. The messages, attachments, and other content you submit in your chats. Visibility depends on whether a chat or project is private or shared and which members have access.

Device and technical information. IP address, browser user agent, and the error and diagnostic logs we need to operate the service and investigate problems.

Product analytics. Events that describe how Drephos is used: page views, sign-ups, messages sent (the event and the model selected, never the message content), purchases, and the campaign tags (such as UTM parameters) that brought you to our site. Once you sign in, these events are linked to your account so we can understand the journey from first visit to active use.

Advertising measurement. The website and web app may use advertising tags from Reddit and Google. These tags measure public-site visits and selected business actions, including completed signup, so the providers can attribute results to advertisements and optimise campaign delivery. We do not send chat content, account details, email addresses, or message content through these advertising tags.

Billing information. Web credit purchases are handled by Paddle, our merchant of record. We never store your card or bank details. Paddle sends us the information we need to provide the purchase, handle refunds, and meet accounting obligations. This can include transaction identifiers, amounts, currency, country for tax purposes, customer or account references, purchase status, and refund status.

3. How we use information

We use your information to:

• Operate the Drephos service, including routing prompts to the AI model you select.
• Maintain your wallet, credit balance, member caps, and usage history.
• Process web credit purchases and refunds through Paddle.
• Provide customer support and respond to your requests.
• Protect the service against fraud, abuse, and security incidents.
• Debug and investigate operational issues (see section 4).
• Understand how people discover and use Drephos, and measure whether our marketing works, using the product analytics described in section 2.
• Meet our legal, tax, and accounting obligations.

4. Inspection of chat content

We do not read your chats for product or marketing purposes, and we do not use your conversations to train AI models. We may inspect chat content only when strictly necessary, for example to investigate a specific bug you have reported, to investigate suspected abuse of the service, or where we are compelled to do so by law. Such inspection is logged and is restricted to authorised personnel.

5. Legal bases (UK GDPR and EU GDPR)

We rely on the following legal bases to process your personal information:

• Performance of a contract to provide the service you have signed up for.
• Legitimate interests for security, fraud prevention, debugging, and improving the product, balanced against your rights and interests.
• Consent for any feature that explicitly asks for it, for example opt-in conversation memory. You can withdraw your consent at any time.
• Legal obligation for retention that is required by tax, accounting, and other laws.

6. Subprocessors

We use the following service providers to deliver Drephos. Each is bound by contractual obligations to protect your information.

Subprocessor	Purpose	Region
OpenRouter	AI inference routing	US
OpenAI	AI inference	US
Anthropic	AI inference	US
Google Cloud Platform	Compute, storage	US, EU
Supabase	Database, authentication	US, EU
Paddle	Web billing and merchant of record	UK, US, EU
Cloudflare	Hosting, CDN, edge network	Global
EmailJS	Contact and notify form delivery	US
PostHog	Product analytics	EU
Reddit	Advertising measurement and campaign optimisation	US, Global
Google Ads	Advertising measurement and campaign optimisation	Global

This list reflects our current setup and will change as the product evolves. We will update this section when subprocessors are added, removed, or replaced.

7. AI providers and prompt routing

When you select a cloud AI model in Drephos, your prompt and any context attached to the chat are routed to the relevant provider so that the model can generate a response. Those providers process your content under their own terms and privacy policies. We do not control how each provider handles inference traffic beyond the contractual commitments they make to us. We do not, and we do not permit our routing partners to, use your conversations to train models.

8. Data storage and international transfers

We store data in the United States and the European Union. Where personal information is transferred outside the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses and, for transfers out of the UK, the UK International Data Transfer Addendum, together with appropriate supplementary measures.

9. Retention

We retain personal information only for as long as we need it for the purposes described in this policy.

• Chat content is retained until you delete it or delete your account.
• Group chat messages you have sent are replaced with a deletion notice if you delete your account, so the remaining members can still understand the structure of the shared conversation without seeing your original message text.
• Usage and billing records are retained for the period required by UK accounting and tax law (typically six years from the end of the relevant accounting period).
• Account identifiers such as your email address and a customer reference may be retained alongside billing records so that we can tie a transaction to a customer for accounting purposes.

10. Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal information we hold about you.
• Have inaccurate information corrected.
• Have personal information erased, subject to the retention rules in section 9.
• Restrict or object to certain uses of your information.
• Receive a portable copy of information you have provided to us.
• Withdraw consent for any processing that depends on consent.
• Complain to the Information Commissioner's Office in the UK, or to your local data protection authority in the EU.

To exercise any of these rights, contact us through the form on our website.

11. Deleting your account

You can request deletion of your Drephos account from your account settings or by contacting us. When you delete your account:

• Your private chats and personal preferences are deleted or anonymised.
• Messages and attachments you added to group chats are replaced with deletion notices and attachment metadata tombstones.
• Billing records and the account identifiers tied to them are retained for the period described in section 9 to satisfy our accounting and tax obligations.

12. Cookies and similar technologies

On the web, Drephos uses essential storage (a session cookie for authentication and a small amount of localStorage for your interface preferences, for example your theme choice) and analytics storage. PostHog uses a first-party cookie on the Drephos root domain to group visits into sessions, preserve campaign attribution between the public website and web app, and connect earlier visits to an account after sign-in.

When a Reddit advertising campaign is active, the website and web app also load the Reddit Pixel. It records public-site page visits and high-intent business actions, including completed web onboarding, so Reddit can attribute those actions to ads and optimise campaign delivery. The Pixel may use cookies or similar browser storage under Reddit's policies. Browser privacy settings, tracking protection, and ad blockers may limit this measurement.

The website and web app may also load the Google tag for Google Ads. It records advertising click information and completed business signup so Google can attribute that result to advertisements and optimise campaign delivery. Contact-form actions are not sent as Google Ads conversions. The Google tag may use first-party cookies or similar browser storage under Google's policies. Browser privacy settings, tracking protection, and ad blockers may limit this measurement.

We do not send chat content or message content to analytics or advertising tools.

13. Security

We take reasonable technical and organisational measures to protect your information, including encryption in transit, encryption at rest where supported by our subprocessors, access controls, and regular review of our security posture. No service can guarantee absolute security; please see the security and liability sections of our Terms of Service for how risk is allocated.

14. Children

Drephos is not directed at children under 16, or under the minimum age in your country of residence if that is higher. We do not knowingly collect personal information from anyone below that age. If you believe a child has provided us with personal information, please contact us so we can delete it.

15. Your responsibilities

You are responsible for the content you submit to Drephos, including content you submit in shared chats and content that contains information about other people. Do not paste information into a chat that you are not entitled to share. We are not responsible for the content users choose to submit.

16. Beta status

Drephos is currently a beta service. Despite our best efforts, beta software can experience defects, outages, and unexpected behaviour. Please be mindful about the information you submit while the product is in beta.

17. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes that affect your rights or our handling of your data will also be announced in the product, by email, or both, with a new "Effective" date that applies prospectively.

18. Contact

For any privacy questions or to exercise your rights, contact us through the form on our website.