Privacy Policy

Personal Information

• Google Authentication: If you sign in using Google, we collect your email address, name, and profile picture for identity verification, personalisation, and account management.
• Google API Access (via OAuth): If you enable Google Connect, we may access Gmail (send only), Google Calendar, Tasks, and Contacts — strictly within the OAuth scopes you explicitly grant.
• User Preferences: Settings, saved memory data, custom characters, themes, and other personalisation choices you configure within Delphos.

Usage & Technical Data

• Conversation logs used for memory recall, feature delivery, and improving your experience.
• Device type, browser version, IP address, and session timestamps for diagnostics and security.
• FlayEngine™ tool execution logs — retained only as long as needed for the session or feature delivery.

• Core AI Features: To deliver intelligent responses, memory recall, web search, image generation, PDF export, voice interaction, and all other Delphos capabilities.
• Browser Agent: To operate a headless browser on your behalf — navigating websites, applying filters, filling forms, and retrieving data as instructed.
• Google Connect: When you authorise it — to send emails via Gmail, create and manage Google Calendar events, manage Google Tasks, and look up Contacts. We only use what you explicitly grant.
• AI Memory: To persist context across sessions so Delphos can personalise responses and recall information you've asked it to remember.
• Security & Fraud Prevention: To monitor for abuse, protect accounts, and maintain platform integrity.
• Legal Compliance: To meet applicable legal obligations and respond to lawful requests.

We use Google APIs to power Google Connect features within Delphos. The following OAuth scopes may be requested — always with your explicit consent before any access is granted:

• AI Model Providers: Your messages are sent to third-party AI APIs (Anthropic, Google DeepMind, Meta, Moonshot AI) to generate responses. We select vendors with strong privacy commitments. We do not control how providers handle anonymised or aggregate data on their end.
• Analytics & Diagnostics: We may share technical data (IP, browser type, session metadata) with analytics services for platform improvement — never for marketing or ad targeting.
• No Data Sales: We do not sell, trade, rent, or broker your personal information to any third party under any circumstances.
• Legal Requests: We may disclose data if required by law, court order, or to protect the rights and safety of users or the public.

We implement modern security practices to protect your data against unauthorised access, loss, or misuse:

• All data is transmitted over HTTPS/TLS — encrypted in transit at all times.
• User data and conversation logs are encrypted at rest.
• Authentication uses JWT token-based sessions — no raw passwords stored.
• Role-based access controls limit which team members can access which data.
• FlayEngine™ tool executions run in isolated environments.

Depending on your location, you may have the following rights under applicable data protection laws (GDPR, CCPA, PDPB, and others):

• Access: Request a copy of all personal data we hold about you.
• Deletion: Request deletion of your account and associated data at any time. We will honour this unless data is required for fraud prevention or legal compliance.
• Correction: Request correction of any inaccurate personal information.
• Portability: Request your data in a portable, machine-readable format.
• Revocation: Revoke Google Connect authorisation at any time via your Google Account settings. This immediately stops all Google API access.
• Objection: Object to certain types of data processing where permitted by law.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

We retain your data only as long as necessary to provide the service or comply with legal obligations:

• Account data is retained for the lifetime of your account and deleted within 30 days of an account deletion request.
• Conversation history is retained to support AI Memory and your chat history. You may clear it at any time from your account settings.
• AI Memory entries persist until you manually delete them or delete your account.
• Browser Agent session data is not stored after task completion — ephemeral by design.
• Diagnostic logs (IP, device info) are retained for up to 90 days then automatically purged.

Delphos AI is not directed at children under the age of 13 (or under 16 in the European Union). We do not knowingly collect personal information from minors.

If you believe a child has provided personal information through our platform, please contact us immediately at [email protected] and we will take immediate steps to delete the data.

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. When we make material changes, we will:

• Display a notice on the Delphos platform before the changes take effect.
• Update the "Last Updated" date at the top of this page.
• For significant changes, we may notify you by email if you have an account.

Continued use of Delphos AI after an update constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, reach out to us: