Privacy Policy

Last updated: January 27, 2026

At PsiCo, LLC ("we," "us," "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and protect information when you use Bastian, our AI assistant service powered by the PsiGuard coherence-monitoring architecture.

1. Information we collect

1.1 User inputs & conversations

When visitors interact with the Bastian widget on your website:

• Messages: text entered by users into the chat widget
• Chat history: stored in your browser's localStorage (client-side only) for conversation continuity
• Timestamps: when interactions occur

Legal basis (GDPR): legitimate interest in providing the service you've configured.

1.2 Website content (indexing)

If you enable site indexing:

• We read and store approved pages from your website
• This content is used to answer from your own site, rather than guessing
• You control which pages are indexed via the allowed domains setting

Legal basis (GDPR): contract performance — providing answers based on your site content.

1.3 Usage analytics & diagnostics

• Request counts and response times
• Error logs and debugging information
• PsiGuard interventions (when an answer is stopped before it's shown)
• Browser localStorage usage (for maintaining conversation state)

Legal basis (GDPR): legitimate interest in improving service quality and security.

1.4 Account information

For paid plans:

• Email address
• License key (generated by us)
• Billing information (processed securely by Stripe — we never store credit card details)
• Usage limits and subscription status

Legal basis (GDPR): contract performance and legal compliance.

1.5 Cookies & browser storage

Bastian uses localStorage (not cookies) to:

• Store conversation history locally in the visitor's browser
• Maintain chat continuity across page refreshes
• Remember user preferences (if configured)

This data stays on the visitor's device and can be cleared at any time by clearing browser data.

2. How we use information

We use collected information to:

• Provide AI responses: generate context-aware answers from your content
• Monitor answers: watch how each reply holds together using PsiGuard's coherence engine, and stop ones that drift before they're shown
• Improve performance: analyze usage patterns and optimize response quality
• Manage accounts: process subscriptions, enforce usage limits, and provide support
• Ensure security: detect abuse, prevent unauthorized access, and maintain platform integrity
• Comply with laws: meet legal and regulatory requirements

We do NOT:

• Sell or rent your data to third parties
• Use your data for advertising
• Share user conversations without your explicit consent (except as required by law)
• Train AI models on your proprietary content without permission

3. Data sharing & disclosure

3.1 Third-party service providers

We share data only with trusted vendors who help us operate Bastian:

• Render.com: infrastructure and hosting (USA)
• Stripe: payment processing (USA)
• Google Firebase: database and authentication (USA)
• Anthropic: AI model provider (USA)

These vendors are contractually bound to protect your data and use it only for providing their services.

3.2 Legal requirements

We may disclose information if required by:

• Court orders or subpoenas
• Applicable laws and regulations
• Protection of our rights, property, or safety
• Prevention of fraud or abuse

3.3 International data transfers

Your data may be transferred to and processed in the United States, where our servers and service providers are located. We ensure appropriate safeguards are in place for international transfers in compliance with GDPR Article 46.

4. Data retention

We retain data only as long as necessary:

• Chat history (localStorage): stored locally on visitor devices indefinitely until cleared by the user
• Server-side chat logs: 30 days for debugging and safety analysis, then automatically deleted
• Indexed site content: retained while your account is active; deleted within 30 days of account closure
• Account information: retained while your account is active; deleted within 90 days of account closure
• Billing records: retained for 7 years for tax and accounting compliance

You may request deletion of your data at any time by contacting [email protected].

5. Data security

We protect your information using industry-standard measures:

• Encryption: HTTPS/TLS for all data in transit
• Access controls: role-based permissions and authentication
• Monitoring: anomaly detection and security logging
• PsiGuard safety layer: real-time coherence monitoring that stops answers which drift or come apart before they reach a visitor
• Regular audits: security assessments and updates

However, no system is 100% secure. We cannot guarantee absolute security but continuously work to protect your data.

6. Your rights (GDPR & CCPA)

6.1 Rights for EU residents (GDPR)

If you are in the European Economic Area, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Restriction: limit how we process your data
• Objection: object to processing based on legitimate interests
• Withdraw consent: revoke consent at any time (where processing is based on consent)
• Lodge a complaint: file a complaint with your local data protection authority

To exercise these rights, contact: [email protected]

6.2 Rights for California residents (CCPA)

If you are a California resident, you have the right to:

• Know: what personal information we collect, use, and share
• Delete: request deletion of your personal information
• Opt-out: we do not sell personal information, so no opt-out is needed
• Non-discrimination: we will not discriminate against you for exercising your rights

To exercise these rights, contact: [email protected]

We will respond to your request within 30 days.

6.3 Clearing browser data

To delete locally stored chat history:

• Chrome/Edge: Settings → Privacy → Clear browsing data → check "Cookies and other site data"
• Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data
• Safari: Preferences → Privacy → Manage Website Data → Remove All

7. Your responsibilities

As a Bastian user, you agree to:

• Disclose AI usage: inform your website visitors that an AI assistant is being used
• Avoid sensitive data: do not collect or process highly sensitive personal data (medical records, financial data, etc.) through Bastian
• Comply with laws: follow applicable privacy laws (GDPR, CCPA, etc.) in your jurisdiction
• Review responses: monitor AI-generated content for accuracy and appropriateness

8. Children's privacy

Bastian is not intended for children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately at [email protected].

9. Changes to this policy

We may update this Privacy Policy as Bastian evolves or as legal requirements change. When we make material changes:

• We will update the "Last updated" date
• For significant changes, we will notify you via email (if you have an account)
• Continued use of Bastian after changes constitutes acceptance

We recommend reviewing this policy periodically.

10. Contact us

For privacy questions, data requests, or concerns:

• Email: [email protected]
• Mail: PsiCo, LLC
• Response time: we aim to respond within 72 hours

For EU residents: if you have unresolved concerns, you may contact your local data protection authority.

This Privacy Policy was last updated on January 27, 2026 and is effective immediately. By using Bastian, you acknowledge that you have read and understood this policy.