Legal, Privacy & Support

1. Data Controller & European Regulatory Framework (GDPR)

AGAPES Studio is published and operated under AGAPES AI, an open research initiative maintained by Esteban Sánchez (FosanzDev) (contact: about@agap.es). All data processing is strictly governed by the European Union General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR) and applicable European data protection legislation.

2. Categories of Data Processed & Zero-Log MCP Policy

When accessing AGAPES Studio, data is handled under strict minimization:

• Strict Zero-Log Policy for MCP Tool Calls: Invocations to the Model Context Protocol (MCP) server at https://studio.agap.es/mcp operate under a strict zero-log policy. Tool requests (verse queries, Strong's concordance codes, cross-references, and commentaries) are executed purely in-memory against local self-hosted databases. No query payloads, tool arguments, or client IP addresses are persistently stored or recorded.
• MCP Input Boundaries & No Chat Log Harvesting: MCP tool endpoints solicit only minimal, task-specific parameters (such as book, chapter, verse, or strongs_id). The MCP server never requests, captures, reconstructs, or infers conversation history, full chat transcripts, or prior-turn message arrays.
• Response Minimization & Zero Diagnostic Telemetry: Tool responses return strictly the requested textual, lexical, or commentary data without diagnostic metadata, trace IDs, request IDs, session identifiers, or telemetry beacons.
• No User Location Collection: AGAPES Studio and its MCP service do not request, solicit, or process precise or coarse user geographic location (such as GPS coordinates, city, or physical street addresses).
• Client-Side Local Storage (Web Application): When using the Studio web interface, user preferences (last active book, chapter, selected Bible versions, commentary choice, theme, and language) are stored exclusively in your browser's localStorage. This data never leaves your device and is not saved on our servers.
• Zero Web Analytics & Zero Cookies: AGAPES Studio operates with strictly zero analytics trackers, zero behavioral telemetry scripts, and zero advertising or tracking cookies.
• Direct Reverse Proxy & Ephemeral Logs: Traffic routes directly through a self-hosted Nginx / Dokploy reverse proxy in the European Union (without intermediate third-party CDNs). Ephemeral connection metadata (IP address, user-agent) is processed transiently in server memory strictly for network routing, DoS mitigation, and rate limiting, purged within a rolling 14 to 30 day window.

3. Purposes & Legal Basis of Processing

Processing is performed under GDPR Article 6(1)(b) (contract / service execution) and 6(1)(f) (legitimate interest in security):

• Executing passage lookups, lexicon queries, cross-references, and interlinear alignments.
• Ensuring service availability, security, and preventing abusive or denial-of-service traffic.

We do not perform behavioral tracking, commercial surveillance, profiling, or targeted advertising.

4. Hosting in the European Union (EU) & Zero Third-Party Data Sales

All core servers, Keycloak SSO instances, RAG vector stores, and databases for AGAPES Studio and AGAPES Chat are physically hosted within the European Union (EU). External model inference routed through OpenRouter to commercial foundation model providers operates under strict Zero Data Retention (ZDR) and No-Training model configurations, supported by European Standard Contractual Clauses (SCCs). We do not share, sell, rent, or disclose personal data, chat conversations, or query history to third-party data brokers, marketers, or advertisers.

5. Data Retention & User Rights under GDPR

Because AGAPES Studio operates anonymously on the web and under a strict zero-log policy for MCP, no personal dossiers or identifying search records exist on our systems. Under GDPR (Articles 15–22), you hold the rights of access, rectification, erasure, and restriction. For any privacy requests, contact about@agap.es. You also hold the right to lodge a complaint with your competent national European Data Protection Supervisory Authority under the GDPR framework.

6. No AI Foundation Model Training

Conversations, prompts, and study inquiries submitted to AGAPES Studio are never used by AGAPES AI, its OpenRouter gateway routing, or its inference partners to train or fine-tune public artificial intelligence foundation models.