← Back to Bilal AI

Privacy Policy

This Privacy Policy explains what personal data Bilal AI ("the Service", "we", "us") collects when you use chat.mbilal.works, why we collect it, and the rights you have over it. It's written to comply with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Who is responsible for your data

Bilal AI is an independently operated service, run by a single individual rather than a registered company. For the purposes of the GDPR, that individual is the data controller for any personal data processed through the Service.

2. What data we collect

Account data

• The email address you sign up with
• Your password, stored as a salted hash — we never store or have access to your plaintext password
• Email verification status

Conversation data

• The messages you send and the responses you receive, saved to your account so your conversation history is available when you return
• If you upload a file (PDF, DOCX, or plain text), its text content is extracted in your browser and included in your message — the original file itself is never uploaded to or stored on our servers

Technical data

We do not run analytics, tracking pixels, or advertising scripts of any kind. We do not maintain a persistent access-log system that records your IP address alongside your activity. Standard, short-lived system-level logs (e.g. for detecting abuse or diagnosing outages) may transiently include connection metadata, retained only briefly and not linked to your account content.

3. How we use your data

We use your data solely to operate the Service you signed up for: authenticating you, generating AI responses to your messages, and keeping your conversation history available across sessions. We do not use your data for advertising, profiling, or any purpose unrelated to providing the chat service.

4. Legal basis for processing

We process your account and conversation data under Art. 6(1)(b) GDPR — processing necessary for the performance of a contract with you (providing the chat service you created an account to use).

5. Where your data is processed

The AI model is self-hosted on our own infrastructure — your messages are not sent to any third-party AI provider (e.g. OpenAI, Anthropic, Google) for processing.

6. Who we share your data with

We do not sell, rent, or share your personal data with third parties. There are no third-party AI providers, analytics vendors, or advertising partners in the Service's data path. Your conversation data stays within our own infrastructure.

7. How long we keep your data

We retain your account and conversation data for as long as your account remains active. You can permanently delete your account and all associated conversation data at any time from Settings → Delete Account — this immediately and permanently removes your account record and every conversation tied to it from our active database. We do not currently maintain backup copies of deleted data.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data — self-service via Settings, or by contacting us
• Restrict or object to processing
• Data portability — receive your data in a portable format
• Withdraw consent at any time (e.g. by deleting your account)
• Lodge a complaint with your local data protection supervisory authority

To exercise any right not available directly in Settings, email chat@ai.mbilal.works.

9. Cookies and local storage

The Service does not use cookies. It uses your browser's local storage to keep you signed in (a session token) and to remember your preferences (e.g. theme, thinking mode). This is strictly necessary for the Service to function and is not used for tracking or advertising.

10. Children

The Service is not directed at children under 16. If you believe a child has created an account without appropriate consent, please contact us and we will delete it.

11. Security

We take reasonable technical measures to protect your data (encrypted transport via TLS, hashed passwords, access-controlled infrastructure). No online service can guarantee absolute security, and we cannot accept liability for factors outside our reasonable control.

12. Changes to this policy

We may update this policy as the Service changes. Material changes will be reflected here with an updated date at the top of this page.