2. Categories of data and purposes
| Category | Examples | Purpose | Typical legal basis |
|---|
| Account and authentication | account identifier, profile preferences, session | creating an account, signing in securely | performance of a contract / legitimate interest in security |
| Conversations | prompts, answers, conversation title, model, time | providing and syncing the chat | performance of a contract |
| Attachments and metadata | name, type, size, storage key, link to a message; the bytes themselves in storage | uploading, displaying and syncing a file | performance of a contract |
| Devices | revocable device token, last use, device name | connecting and protecting a device | performance of a contract / legitimate interest in security |
| Operational and security data | IP or pseudonymous identifier, error logs, rate-limit information | abuse prevention, security and incident response | legitimate interest / legal obligation |
| Voluntary model-improvement opt-in | the consent choice, the time it was switched on or withdrawn, and the revocable queue of new text messages | future supervised model improvement, only on a separate choice | consent |
1. Controller and what this document is for
Controller: DouTok corporation, contact doutok@icloud.com. This document describes how DouTok AI processes the personal data of users of the website, the PWA and connected devices. In the EU the GDPR is the basic framework for personal data protection; in Czechia it has to be read together with Act No. 110/2019 Coll.
3. Chats and uploaded content
We process chats and attachments in order to run the service, sync between authorised devices, for security, for support, and to meet legal obligations. Authorised people or processors may access content in limited and recorded cases, where that is necessary for support, security, incident response, moderation under the terms, or a legal obligation.
Running the core service is not conditional on consenting to your content being used to improve a model. Where we offer that option it must be separate, voluntary, informed and revocable. Once you actively switch it on, newly sent text messages may join a revocable queue for future supervised processing; attachments do not join it on their own, and this is not automatic live retraining of a model from the chat. After withdrawal, further queueing stops and active candidates are marked as revoked for this purpose, unless another valid legal basis exists. The EDPB guidelines on consent support keeping a choice of this kind separate from the necessary provision of the service.
Chats can be read by authorised people, including the operator of the service personally, for the purposes set out in the terms of use: support, security, investigating abuse, enforcing the terms, the quality and safety of the service, and legal obligations. We may keep and disclose chats and related records where that is necessary to comply with the law or a court decision, or to establish, exercise or defend legal claims, including as evidence in proceedings. The legal basis is, depending on the case, our legitimate interest, a legal obligation, or performance of the contract. Prompts are also passed to the AI provider that answers them, which processes them under its own terms.
4. Sharing and processors
We share data only as far as necessary with providers of hosting, database, storage, authentication, payments, monitoring, AI/model services and customer support. We do not sell personal data or content as a data product to third parties.
5. International transfers
Where data from the EU/EEA is transferred outside the EU/EEA, DouTok uses an appropriate mechanism under the applicable rules — an adequacy decision or standard contractual clauses, for example — together with proportionate technical and organisational measures.
6. Retention
We keep account and chat data for as long as the account is active. After content or an account is deleted we remove it from operational systems without undue delay, and from backups within 90 days at the latest, unless the law, a security investigation or a dispute requires keeping it longer. Revoked device tokens grant no further access. Attachments that have not been deleted are kept on the same basis as the conversation they belong to.
7. Your rights
To the extent applicable law provides, you can ask for access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Send requests to doutok@icloud.com. A user in Czechia may lodge a complaint with the Office for Personal Data Protection.
8. Security
We use proportionate technical and organisational measures. No provider AI or storage keys run in the browser; model calls and storage access happen on the server, and connected devices use separate revocable tokens. No system, however, can be guaranteed to be absolutely secure.
9. Children, changes and contact
The service is not intended for anyone under the age applicable law requires without valid consent from a legal guardian. We will give reasonable notice of changes to this notice before they take effect. Contact: doutok@icloud.com.
Welcome to