Privacy Policy

1. Who We Are

CookieAI, operated by Teodor Petrica (“we”, “us”, “our”) operates the CookieAI platform at chat.cookieai.ch and the website at cookieai.ch. We are based in Wallisellen, Zurich, Switzerland.

Contact: contact@cookieai.ch

2. What Data We Collect

When you use CookieAI, we collect:

• Account information: username, email address, display name
• Authentication data: hashed passwords (bcrypt, never stored in plain text), session tokens
• Chat content: messages you send and receive within the platform
• Uploaded documents: files you upload to team knowledge bases
• Usage data: which AI model was used for each response, timestamps
• Contact form submissions: name, email, message

We do not collect:

• Payment information (no billing system currently active)
• Browsing behavior or tracking cookies
• Location data
• Data from third-party social logins

3. How We Use Your Data

• To provide the CookieAI service — processing your messages with AI models
• To maintain your account and authenticate your sessions
• To store and index documents in your team knowledge base
• To send transactional emails (verification, approval notifications)
• To respond to contact form inquiries

We use your uploaded documents and team chat messages to build your team’s private knowledge base. This knowledge base is used exclusively by your team — no other users or teams can access it. This is not AI model training — the underlying AI model weights are never modified by your data. Your private knowledge base can be fully deleted at any time by requesting account deletion or through the team leader panel. We never sell, rent, or share your data with third parties.

4. Who Receives Your Data

In the normal course of providing our service, your data may be shared with the following categories of recipients:

• No one — by default. Your messages and documents are processed entirely on our server and not shared with any third party.
• Web search engines (only when web search is enabled): If you enable web search for a chat, your search query (not your documents or chat history) is routed through our self-hosted SearXNG instance to public search engines (Google, Bing, DuckDuckGo). These queries leave Switzerland.
• Email provider: We use Infomaniak (Swiss company, servers in Switzerland) to send transactional emails (verification, invitations, notifications).

We do not share your data with AI providers (OpenAI, Google, Microsoft, Anthropic), advertising networks, data brokers, or any other third party.

6. Where Your Data Is Stored

All data is stored on servers physically located in Zurich, Switzerland (Oracle Cloud Infrastructure, eu-zurich-1 region). No data is ever transferred outside of Switzerland. This includes:

• Your messages and chat history (SQLite database, encrypted at rest)
• Your uploaded documents (ChromaDB vector database on the same server)
• Document embeddings (generated locally using on-server AI models)
• Email addresses (encrypted at rest with AES-256-GCM)

We do not use any US-based cloud providers for data storage or processing. AI inference is performed entirely on our Swiss-hosted servers using open-source models. No data is sent to OpenAI, Google, Microsoft, Anthropic, or any other external AI provider.

6. AI Processing

When you send a message, it is processed by locally-hosted open-source AI models running on our Swiss server. Your messages are:

• Processed in real-time and not stored by the AI model beyond the current session
• Never sent to any external API or third-party service
• Never used to train or modify the underlying AI model. Your data is only used to build your team’s private searchable knowledge base, which you control and can delete. CookieAI does not make automated decisions that have legal or similarly significant effects on you

When web search is enabled for a chat, your search queries are sent to a self-hosted SearXNG instance running on the same Swiss server. SearXNG is a privacy-respecting meta search engine that proxies your query to Google, Bing, and DuckDuckGo without revealing your identity. Your search query leaves Switzerland when web search is used (see section 12).

7. Team Data and Document Isolation

Each team’s data is completely isolated:

• Team members can only access their own team’s documents and chat history
• Documents uploaded by one team are invisible to other teams
• Team leaders can manage team membership and documents
• Deleting a team member removes their access but preserves team chat history

8. Data Retention

• Account data: retained as long as your account is active
• Chat messages: retained as long as the chat exists; you can delete individual chats at any time
• Uploaded documents: retained until deleted by a team leader or upon account deletion
• Session tokens: automatically expire after 7 days
• Contact form submissions: retained for business correspondence purposes

9. Your Rights Under Swiss Law (FADP)

Under the Swiss Federal Act on Data Protection (nFADP / DSG), you have the right to:

• Access: request a copy of all personal data we hold about you
• Rectification: request correction of inaccurate personal data
• Deletion: request complete deletion of your account and all associated data
• Data portability: request your data in a machine-readable format
• Object: object to specific processing of your data

To exercise any of these rights, contact us at contact@cookieai.ch. We will respond within 30 days.

Right to file a complaint: If you believe your data protection rights have been violated, you have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC):

Account deletion: You can request deletion of your account and all associated data at any time. This permanently removes your user account and profile, all personal and team chat messages you authored, your team membership, any documents you uploaded, and all session data. This action is irreversible.

10. Data Security

We implement the following security measures to protect your data:

• AES-256-GCM encryption for sensitive data at rest (email addresses)
• bcrypt password hashing with salt (cost factor 12)
• HTTPS encryption for all data in transit (TLS 1.2+)
• HTTP Strict Transport Security (HSTS) headers
• Content Security Policy (CSP) headers
• Rate limiting on authentication endpoints
• Fail2ban brute force protection
• Role-based access control for team features
• Session tokens with automatic expiry
• No server version disclosure in HTTP headers
• FADP-compliant access logging for sensitive data operations

12. Data Transfers Abroad

CookieAI processes all data in Switzerland. The only exception is when you explicitly enable web search for a conversation:

• Your search query is sent through SearXNG (running on our Swiss server) to external search engines
• These search engines (Google, Bing, DuckDuckGo) may process the query on servers outside Switzerland
• Only the search query is sent — never your documents, chat history, or personal data
• Web search is disabled by default and clearly indicated when active

No other data transfers abroad occur. AI inference, document processing, and data storage all happen exclusively on our Swiss servers.

11. Cookies

CookieAI uses only essential local storage:

• Session token (localStorage): used to keep you logged in. Expires after 7 days. Contains no tracking data.
• Sidebar state (localStorage): remembers whether you collapsed the sidebar. Purely cosmetic.

We do not use:

• Analytics cookies
• Advertising cookies
• Third-party tracking cookies
• Social media pixels

12. Children

CookieAI is designed for business use and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of CookieAI after changes constitutes acceptance of the revised policy.

15. Contact

For any privacy-related questions or requests: