Privacy Policy

1. Scope and Definitions

This Privacy Policy applies to personal information processed by AiWondertales in connection with the Service. It does not apply to third-party websites, applications, or services that may be linked from, or accessed through, the Service, including large language model providers whose terms govern their own processing.

"Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. "Dedicated Server" means the virtual private server provisioned and operated by AiWondertales exclusively for your account. "Agent" means the AI-assisted software that runs on your Dedicated Server. "Content" means messages, prompts, uploaded files, documents, images, audio, calendar data, and any other material you submit to the Service or that your Agent generates on your behalf.

2. Information We Collect

2.1 Information you provide directly

• Waitlist and account information. When you join the waitlist we collect your email address. When an account is created for you we collect a username (your "space name"), a password (stored only as a salted cryptographic hash), and the email address associated with your invitation.
• Content. Messages you send to your Agent, files you upload, and any other information you choose to submit. Content may include personal information about you or about third parties. You are responsible for ensuring you have the right to submit any Content containing third-party personal information.
• Third-party account credentials. If you elect to connect a ChatGPT subscription, we store the resulting authorization token on your Dedicated Server solely to authenticate requests to OpenAI on your behalf. Connected accounts such as Google are described in Section 2.5.
• Communications. If you contact us by email for support, security, or privacy matters, we collect the information you include in that correspondence.

2.2 Information generated by your use of the Service

• Agent output and tool results. Responses, documents, images, and other artifacts your Agent generates, and the results of tools your Agent runs (for example, web search results or transcribed audio). This information is stored on your Dedicated Server so your Agent can maintain context across sessions.
• Memory and library data. Your Agent may record notes about your preferences, prior work, and files it has created so it can reference them later. This information resides on your Dedicated Server.
• Server snapshots. Your Dedicated Server periodically records version-controlled snapshots of its data directory so that changes can be rolled back. Snapshots are stored on the same Dedicated Server (or on a block storage volume attached exclusively to it) and are not copied to a shared location.

2.3 Information collected automatically

• Authentication data. A session token issued when you sign in, delivered as an HTTP cookie in the web interface or stored in secure device storage in the Arty app. This is a strictly necessary cookie used only to keep you signed in; we do not use advertising, analytics, or tracking cookies.
• Server and request logs. Our application servers write diagnostic log output, which may include IP address, request path, timestamp, response status, and user agent, to the container's standard output stream. Log data is used for security, abuse prevention, rate limiting, and troubleshooting.
• Operational telemetry. Your Dedicated Server periodically reports aggregate operational metrics to our control plane, including disk and memory utilization, uptime, number of sessions and library files, session activity timestamps, model request counts, token totals, latency statistics, and estimated usage cost. Telemetry consists of numeric and timestamp values only. Telemetry does not include the content of your conversations, files, or Agent output.
• Device identifier (Arty app only). The Arty app generates a random identifier that is not derived from hardware identifiers or advertising identifiers. It is used to bind calendar-related requests to a specific device and persists after sign-out.

2.4 Information we do not collect

The Service does not include any third-party analytics SDK, advertising SDK, or crash-reporting SDK. We do not collect precise geolocation, contacts, advertising identifiers, or biometric identifiers. Biometric authentication in the Arty app is performed entirely by the device operating system; biometric data never leaves your device and is never accessible to us.

2.5 Connected third-party accounts

You may choose to connect third-party accounts, such as a Google account, so that your Agent can act on your behalf. Connecting an account is optional, and each kind of access is requested separately at the time your Agent first needs it.

Google. When you connect a Google account, we use Google's OAuth authorization to request only the access you approve. Depending on what you grant, your Agent may read your calendars and events, create or update calendar events, read your Gmail messages, and send email from your Gmail address. Google Docs and Sheets access is requested separately: you select individual documents and spreadsheets through Google's file picker for ongoing read and edit access, not access to all files in your Drive. Your Agent reads this data to carry out your requests. Actions that change or send data, including each document or spreadsheet edit, are presented through the Service's approval cards before execution.

Google refresh tokens for Gmail and Calendar services and for selected files are stored separately in a dedicated credential store on your Dedicated Server, isolated from your Agent's runtime. Our control plane performs token exchange and refresh on your server's behalf but does not retain Google tokens or Google user data. Google data your Agent reads is transmitted to the model provider you have selected (Section 5.1) only as needed to generate a response. File contents may remain in your conversation history. We also retain selection metadata on your Dedicated Server, such as selected file IDs, names, and types, so your Agent can find those files again across sessions until you remove the selection or disconnect the account.

Removing a file from your selections blocks further access through the Service but does not revoke Google's underlying grant. Disconnecting a Google account from Settings deletes both stored credentials and the selection metadata and requests revocation with Google. You can also revoke access from your Google Account permissions page. Google's revocation can affect all access granted to this app, including Gmail and Calendar. Reducing the permissions we request does not by itself narrow grants you previously gave Google. Resetting those grants requires revocation and reconnecting the services you still want. Removing a selection or disconnecting does not delete content already saved in your conversations.

Artifables' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train or improve machine learning models, do not sell it, do not use it for advertising, and do not transfer it to third parties except as necessary to provide the feature you requested, for security purposes, or as required by law.

3. How We Use Personal Information

We use personal information for the following purposes:

• To provision, operate, maintain, secure, and improve the Service and your Dedicated Server;
• To authenticate you and maintain your session;
• To transmit your Content and context to the model provider you have selected in order to generate responses;
• To perform tasks you request, such as web searches, speech-to-text transcription, image generation, browsing, or scheduled jobs;
• To monitor capacity, reliability, and usage cost across our infrastructure;
• To respond to support, security, and privacy requests;
• To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
• To communicate with you about your account, the waitlist, and material changes to the Service or this Privacy Policy;
• To comply with applicable law, legal process, and enforceable governmental requests; and
• For any other purpose disclosed to you at the time of collection or with your consent.

We do not use your Content, including data from connected accounts, to train, fine-tune, or otherwise improve machine learning models, and we do not permit the AI model providers listed in Section 5.1 to do so under the API terms applicable to our integration, except where you have connected your own ChatGPT or Claude subscription, in which case OpenAI's or Anthropic's terms with you govern.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

4. Dedicated Server Architecture and Operator Access

Each account is served by a Dedicated Server that is not shared with other customers. Your Content, Agent memory, and snapshots are stored on that server and, where applicable, on a block storage volume attached exclusively to it. Our control plane stores only your account record, server configuration metadata, and the operational telemetry described in Section 2.3.

AiWondertales retains administrative access to Dedicated Servers to provision, deploy, update, diagnose, and repair them. Administrative access is used only for support, security, and maintenance purposes. Our personnel do not routinely read conversations or files as part of operating the Service. Where diagnosing an issue requires inspection of a Dedicated Server, we limit inspection to what is reasonably necessary to resolve the issue.

5. Disclosure of Personal Information

We disclose personal information to the following categories of recipients, in each case only as necessary for the purposes described in Section 3.

5.1 AI providers

Your Agent is powered by AI models and services operated by other companies. To answer you, your Dedicated Server sends them the Content needed for that request. Depending on what you ask, this can include your messages and conversation history; files, photos, links, and text you attach or share to the Agent; audio you record for dictation; calendar events your Agent reads from your phone when you ask it to; data from accounts you connect, when your Agent uses them; and notes your Agent has saved about you. Your account password and biometric data are never sent.

Each provider processes this information under the terms that govern our use of its service and its privacy policy. Where you have connected your own ChatGPT or Claude subscription, requests are made to that provider as you, under the terms of your account with them.

5.2 Service providers and subprocessors

We may update this list as our vendors change. Service providers are contractually restricted from using personal information for any purpose other than providing services to us.

5.3 How third parties protect your data

We share personal information with the providers in Sections 5.1 and 5.2 only for the purposes in this Privacy Policy, and only with providers whose terms with us give it protection equal to the protection this Privacy Policy describes:

• Anthropic may use your Content only to provide its service to us, may not train models on it, and must protect it under a data processing agreement with appropriate security safeguards and confidentiality duties.
• OpenAI may use your Content only to provide its service, comply with law, and prevent abuse, may not use it to develop or improve its services or models, and must maintain documented security measures. It keeps abuse-monitoring logs for up to 30 days.
• Google, for the paid Gemini API and Vertex AI services we use, does not use your prompts or responses to improve its products or train its models, and processes them under its data processing terms. It keeps logs for a limited period to detect abuse.
• Brave may use search queries only to provide search results to us, and must protect them with reasonable technical, administrative, and physical safeguards.

Where you connect your own ChatGPT or Claude subscription, that provider's terms with you apply instead, and they may differ.

5.4 Websites your Agent visits

When you ask your Agent to fetch a web page or browse a site, your Dedicated Server connects directly to that site. The operator of that site will receive your Dedicated Server's IP address and any information your Agent submits to it at your direction.

5.5 Legal and safety disclosures

We may disclose personal information if we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process; is necessary to protect the rights, property, or safety of AiWondertales, our users, or the public; or is necessary to detect, prevent, or address fraud, security, or technical issues.

5.6 Business transfers

If AiWondertales is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy that provides no less protection.

6. Arty Mobile Application

6.1 Device permissions

Each permission below is requested only when you use the feature it supports. The app functions without any of them.

6.2 Data stored on your device

On iOS, Keychain data may survive deletion and reinstallation of an app with the same bundle identifier. Uninstalling the app is not a reliable way to remove your saved sign-in. Sign out before uninstalling.

6.3 Local network and background processing

The app declares local network access, which is used only by development builds to locate a local server during engineering. Released builds do not use this capability. The app declares background processing capability to refresh Home Screen widgets; background processing does not collect location or other sensor data.

7. Data Retention

• Content, Agent memory, and snapshots are retained on your Dedicated Server until you delete them or your account is closed.
• Connected account tokens are deleted when you disconnect the account or your account is closed.
• Account information is retained for the life of your account and for a reasonable period thereafter as necessary to resolve disputes, enforce our agreements, and comply with legal obligations.
• Waitlist information is retained until you are invited, you ask us to remove you, or we discontinue the waitlist.
• Operational telemetry is retained in our control plane for the life of the associated server record and in our monitoring provider for approximately 30 days.
• Server and request logs are not written to persistent log storage. Log output is held in container runtime buffers and is discarded when the container is restarted or replaced.

When you close your account, we destroy your Dedicated Server and any attached block storage volume, which permanently deletes all Content, Agent memory, and snapshots stored there. We do not enable hosting-provider backups or snapshots for Dedicated Servers, so no copy of your data is retained by the hosting provider after destruction. Signing out of the Arty app clears local data on that device but does not delete any data stored on your Dedicated Server, and it does not remove calendar events you have already saved.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including: encryption of data in transit using TLS; storage of passwords as salted cryptographic hashes; isolation of each customer's data on a Dedicated Server; storage of third-party provider credentials in a restricted proxy component rather than the Agent runtime; signed, authenticated telemetry; and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your password and for the security of the devices you use to access the Service. To report a security vulnerability, contact admin@artifables.com.

9. Your Choices and Rights

9.1 Access, correction, and deletion

You may delete individual conversations and files through the Service at any time. To request access to, correction of, or deletion of your account information, or to close your account and have your Dedicated Server destroyed, contact admin@artifables.com. We will verify your identity by confirming control of the email address associated with your account before acting on a request.

9.2 Third-party connections

You may disconnect a ChatGPT subscription from your Dedicated Server at any time through the Service, which removes the stored authorization. You may also revoke authorization directly with OpenAI. After disconnection, requests to OpenAI models are made using API credentials issued to AiWondertales, which cannot be removed by you and are not associated with any account you hold with the provider.

9.3 Device permissions

You may revoke any device permission granted to the Arty app through your device's operating system settings.

10. Notice to California Residents

This section supplements this Privacy Policy and applies to California residents whose personal information is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA").

10.1 Categories of personal information

In the preceding twelve months we have collected the following categories of personal information as described in the CCPA: identifiers (such as username, email address, and IP address); internet or other electronic network activity information (such as request logs and session activity timestamps); audio, electronic, visual, or similar information (such as dictated audio, uploaded images, and photos you choose to send); and any other personal information you include in Content, which may include any of the categories enumerated in the CCPA, including sensitive personal information, depending on what you choose to submit.

10.2 Sources, purposes, and disclosures

We collect personal information directly from you and automatically through your use of the Service, for the business purposes described in Section 3. We disclose personal information for business purposes to the categories of recipients described in Section 5. We do not sell personal information and do not share personal information for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

10.3 Sensitive personal information

We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA, such as performing the services you request and maintaining the security and integrity of the Service. Any sensitive personal information you include in Content is processed only to provide the Service to you.

10.4 Your CCPA rights

Subject to applicable exceptions, California residents have the right to: (a) know the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes for collection, and the categories of third parties to whom personal information is disclosed; (b) delete personal information we have collected from you; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information (we do not sell or share); (e) limit the use of sensitive personal information (we do not use it beyond permitted purposes); and (f) not be discriminated against for exercising these rights.

To exercise these rights, email admin@artifables.com. We will verify your request by confirming control of the email address associated with your account, and may request additional information where reasonably necessary. You may designate an authorized agent to make a request on your behalf; we may require the agent to provide proof of authorization and may require you to verify your identity directly with us. We will respond within the time required by law.

10.5 Retention

We retain each category of personal information for the periods described in Section 7.

11. Other United States State Privacy Rights

Residents of other states with comprehensive privacy laws may have rights to access, correct, delete, or obtain a copy of their personal information, and to opt out of targeted advertising, sale of personal information, or certain profiling. We do not engage in targeted advertising, sale of personal information, or profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise any right available to you, contact admin@artifables.com. If we decline to act on your request, you may appeal by replying to our response with the word "Appeal" in the subject line.

12. Users Outside the United States

AiWondertales is located in the United States. Dedicated Servers are hosted by Hetzner Online GmbH in Ashburn, Virginia, and by Vultr in New Jersey. Our control plane is hosted by DigitalOcean in New Jersey. All are in the United States. The model providers and other service providers listed in Section 5 may process personal information in the United States or other countries. If you access the Service from outside the United States, you acknowledge that your personal information will be transferred to, stored, and processed in the United States and other jurisdictions that may not provide the same level of data protection as your home jurisdiction. The Service is directed to users in the United States.

13. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact admin@artifables.com and we will delete it.

14. Do Not Track

The Service does not track users across third-party websites over time and therefore does not respond to Do Not Track signals. Because we do not sell or share personal information, we do not process opt-out preference signals for that purpose.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and notify account holders by email or through the Service before the changes take effect. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acknowledgment of the revised policy.

16. Contact Us

AiWondertales LLC
North Carolina, United States
Privacy inquiries, security reports, and general support: admin@artifables.com