Legal, Privacy & Support

1. Data Controller & European Regulatory Framework (GDPR)

AGAPES Chat is published and operated by AGAPES AI, governed by Regulation (EU) 2016/679 (GDPR) and European Union digital privacy directives. We are committed to protecting user spiritual confidentiality and privacy.

2. Categories of Data Processed & AI Inference Data Boundaries

When accessing AGAPES Chat, data is handled under strict minimization:

• Ephemeral Guest Mode (Unauthenticated): Anonymous guest sessions are 100% ephemeral in browser memory and are never persisted in any server database.
• Chat History & Instant Hard Deletion (SSO Users): If you authenticate via AGAPES Single Sign-On (Keycloak), your conversations are stored securely on our servers in the European Union for cross-device access until you choose to delete them. Deleting an individual thread or clearing your entire history triggers an immediate hard deletion from active storage tables.
• Account Information (Keycloak SSO): User registration via our self-hosted Keycloak SSO in the European Union collects strictly minimal data: username, email address, and securely hashed passwords (or OAuth identity tokens). We never collect phone numbers, physical addresses, or financial data.
• OpenRouter Routing & Commercial AI Inference: Inference queries are routed through OpenRouter to commercial foundation model providers (OpenAI, Anthropic, MiniMax, Inception) under strict Zero Data Retention (ZDR) and No-Training model configurations. User account identities, emails, and client IP addresses are never transmitted to LLM providers. Please note: if you explicitly type personal identifiers (such as a phone number or email) directly into your chat message, that text is transmitted as part of your prompt payload to the model without automated masking.
• Self-Hosted Vector Store & Local RAG Retrieval: The vector database for theological RAG search is hosted 100% on our own server infrastructure within the European Union (EU). Semantic retrieval executes locally across a strictly curated public domain corpus.
• Architectural Safety Guardrails (No Third-Party Scanners): AGAPES Chat uses internal system prompt instructions and backend architectural guardrails to maintain doctrinal and conversational integrity. User prompts are not sent to third-party automated moderation scanners or content inspection APIs.
• Technical Connection & Standard Nginx Logs: Standard HTTP connection headers, IP address, and session tokens are processed transiently in server memory strictly to deliver secure streaming, prevent automated abuse, and maintain rate limits. Standard reverse proxy (Nginx) connection logs are retained for operational security within a rolling 14 to 30 day window before automatic rotation.

3. Purposes & Legal Basis of Processing

Processing is performed under GDPR Article 6(1)(b) (contract / service execution) and 6(1)(f) (legitimate interest in security):

• Formulating generative AI responses grounded in verified Christian publications and scripture.
• Storing your conversation history across sessions (for registered users) and allowing you to revisit past studies.
• Maintaining platform security, rate limiting, and preventing system misuse.

We do not perform behavioral tracking, commercial surveillance, profiling, or targeted advertising.

4. Hosting in the European Union (EU) & Zero Third-Party Data Sales

All core servers, Keycloak SSO instances, RAG vector stores, and databases for AGAPES Studio and AGAPES Chat are physically hosted within the European Union (EU). External model inference routed through OpenRouter to commercial foundation model providers operates under strict Zero Data Retention (ZDR) and No-Training model configurations, supported by European Standard Contractual Clauses (SCCs). We do not share, sell, rent, or disclose personal data, chat conversations, or query history to third-party data brokers, marketers, or advertisers.

5. Data Retention & User Rights under GDPR

Registered users maintain complete control over their saved chats. Conversations remain stored on EU servers until you choose to delete them. Deleting an individual thread or clearing your entire history triggers an immediate hard deletion from all active database tables. Ephemeral Nginx server connection logs are purged within a standard rolling 14 to 30 day window. For complete account deletion or data subject access requests, contact about@agap.es.

6. No AI Foundation Model Training

Conversations, prompts, and study inquiries submitted to AGAPES Chat are never used by AGAPES AI, its OpenRouter gateway routing, or its inference partners to train or fine-tune public artificial intelligence foundation models.