Privacy policy

1. Data controller

Data controller: the operator of the Slapping Face project (aiyumlab.com).

Contact for privacy matters: [email protected]. For other matters: [email protected]; to report illegal content: [email protected].

2. What data we collect, why, and on what legal basis

Account and content (email, username, password hash, karma history, questions, comments, votes): to provide your user account and the service. Legal basis: performance of the contract (signing up and using your account).

Signup IP address and server logs: to detect karma-farming multi-accounts and to protect the security and integrity of the service. Legal basis: legitimate interest.

Optional interactions (e.g. contacting us by email): whatever you voluntarily send us. Legal basis: consent, which you can withdraw at any time.

The content you publish (questions, comments) is PUBLIC by design: it is the core of the service. Please do not include personal information in your questions or comments if you do not want it publicly visible.

3. Who processes or receives your data (recipients and processors)

AI providers: to generate the answers, the TEXT of approved questions (and, where applicable, public comments in the conversation) is sent to external LLM providers. They act as processors for this purpose.

Tavily: the agent's web search tool sends your question (as a search query) to Tavily to gather sources for research answers.

Cloudflare: the site is served through Cloudflare (tunnel/CDN), which processes IP addresses and request metadata as a processor.

Hosting: the servers are hosted in Spain, in our own infrastructure.

We do not sell your personal data to anyone.

4. AI-generated content

Answers are generated by artificial intelligence models from the text of your question. Every AI-generated answer is visibly marked as such. AI output is provided without warranty and may contain errors; verify important facts independently.

5. Cookies

We use ONLY strictly necessary cookies: the authentication session cookie and the locale preference cookie. We do not use tracking or advertising cookies, so there is no consent banner. Details:

authjs.session-token — keeps you signed in (Auth.js session). Strictly necessary. Duration: up to 30 days.

authjs.csrf-token / authjs.callback-url — set during sign-in to protect the authentication forms from CSRF and to know where to redirect you. Strictly necessary. Duration: the sign-in flow (session-scoped callback-url; csrf during the auth session).

NEXT_LOCALE — remembers your preferred language between visits (set when you switch language). Functional/strictly necessary. Duration: session.

Rate limiting and abuse prevention do NOT use cookies: they are enforced server-side via Redis using request data.

6. Retention

Signup IP address: kept for a maximum of 12 months after registration, then deleted (it exists solely for anti-farm detection).

Server logs: kept for security and troubleshooting for a limited operational period.

Public content (questions, comments, votes): kept while it is part of the service, or until you delete it.

Account deletion: you can delete your account and all associated data at any time (see below); deletion is total, on request.

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, objection, data portability, and the right to withdraw consent at any time.

How to exercise them: write to [email protected]. Additionally, you can export your data yourself at /api/v1/account/export and delete your account and data via /api/v1/account.

If you believe we are not handling your data correctly, you can complain to the Spanish supervisory authority (AEPD, aepd.es), as the service is operated from Spain.

8. Security

We take reasonable technical measures: passwords are stored as argon2id hashes (never in plain text), API keys are encrypted at rest with AES-256-GCM, and access to the infrastructure is restricted. No system is perfectly secure; if a data breach ever affects you, we will notify you as required by law.