Privacy Notice

In short

BioPolicy is a portfolio project rather than a commercial service. Documents you upload are deleted after 24 hours, your conversations stay in your account until you delete them, and nothing is sold or used for advertising.

The clause that matters most: to answer your question, the relevant parts of your document are sent to AI providers. Details below.

Who processes it

This project is run by one person, Bilal Gürkan Şanlı. Contact: bilalsanli129@gmail.com

What is collected

This list is exhaustive:

• ·Account: your name, email address and the URL of your profile picture, from Google sign-in.
• ·Documents: the PDF you upload and the text extracted from it.
• ·Conversations: the questions you ask, the answers produced, and the citations they rest on.
• ·Usage: which model each call went to, how many tokens it spent, and what it cost. Daily limits are computed from this.
• ·Measurement: only if you accept — page interactions via Microsoft Clarity. See the cookie notice.

Why

Account data identifies who a daily limit belongs to. Documents and questions are processed only to answer what you asked. Usage records feed the budget breaker that keeps this demo from being switched off by a single visitor.

Legal basis: performance of a service at your request, and legitimate interest in operating the project. The measurement cookie rests on your consent, which you can withdraw at any time.

Where your document goes

This is the section most privacy notices are vague about. When you ask a question, the passages retrieved from your document are sent, with your question, to model providers:

• ·Anthropic — producing and verifying the answer.
• ·Google (Gemini) — making the text searchable (embeddings), reading scanned pages (OCR), and answering if Anthropic is unavailable.
• ·Supabase — database, file storage and authentication.
• ·Vercel — hosting.

How long it is kept

Uploaded documents and their extracted text: deleted 24 hours after upload. The file goes from storage first and the rows second — that order is deliberate, since the reverse would leave a file nobody can find.

Conversations: until you delete them. Deleting a document takes its conversations with it.

Usage records: kept so spending stays auditable. They hold no personal content — how many tokens were spent, not what you asked.

Deleting your account removes your documents, your conversations and the account together.

There is one exception, stated here rather than buried: the counter behind your daily allowance outlives the account by 7 days. What it holds is an irreversible digest derived from your Google account's identifier, plus how many questions were asked and documents uploaded that day — not your name, not your address, not your questions. The reason is plain: a counter tied to the account would reset every time somebody deleted theirs and signed in again, which would make the daily limit mean nothing. The lawful basis for this processing is the legitimate interest in keeping the demo running.

Your rights

You can access, correct, delete and object to the processing of data about you. You do not have to wait for the timer or ask anyone: account deletion is in the profile menu and removes every document and conversation you own.

For anything else: bilalsanli129@gmail.com

The limits of this text

This notice was not drafted by a lawyer. It aims to describe accurately what the system does; it is not a legal opinion.