Privacy Policy
Draft, not yet in effect. Written before Phase 1 has launched or collected any real user data. Not legal advice — pending review by a qualified lawyer. Currently English-only; translated versions follow once the wording is finalized, so nothing important gets lost in translation.
Last updated: 2026-08-15 (draft)
Who we are
IotMentor ("we", "us") is a product of [legal entity name, once incorporated], established in [EU member state]. Contact: contact@iotmentor.dev.
Chat ("Try the mentor")
If you use the chat box, the message you type and the conversation history already shown in your browser are sent to our backend, which forwards them to an AI model via OpenRouter.
The chat is stateless on our side: nothing about your conversation is written to a database. Your browser resends the history each turn; once a reply is sent back, our server keeps nothing from it except the anonymous usage counters below.
Rate limiting and usage counters
To keep free chat available fairly to everyone, we track, per IP address, how many chat messages you've sent in the last minute and how many tokens you've used in total. These counters live only in server memory, are never linked to what you actually said, and reset automatically whenever the server restarts.
Bot protection (Cloudflare Turnstile)
Once enabled, a small Cloudflare Turnstile widget stops automated abuse of the chat. See the Turnstile Privacy Addendum.
Feedback (thumbs up / down)
If you rate a chat reply, we log your vote together with the related message/reply text in our hosting provider's server logs, to read manually and improve the product. Not written to a database, not linked to an account (none exist yet), entirely optional.
What we don't do (today)
| No user accounts or logins | Planned — see the project roadmap |
| No advertising or analytics cookies | — |
| No selling or sharing data for marketing | — |
| No saved chat history | Every conversation starts fresh |
Who else processes data on our behalf
| Processor | What for |
|---|---|
| OpenRouter + the model provider(s) it routes to | Chat messages, only when you use the chat |
| Cloudflare | Turnstile, DNS, and hosting for this site |
| [backend host, once chosen] | Runs our backend and its operational logs |
| Zoho Mail | Hosts our contact inbox |
Some providers may process data outside the EU/EEA, under their own standard contractual clauses or an equivalent legal safeguard.
Legal basis for processing (GDPR)
Chat replies: performance of the service you requested. Rate limiting/Turnstile: legitimate interest (keeping the free service usable and abuse-free). Feedback votes: your consent, given by voluntarily clicking a vote button.
How long we keep data
No database of your chat activity. Hosting-provider operational logs (feedback votes, errors) are retained only as long as that provider's own log-retention window.
Your rights
No accounts exist yet, so there's no persistent personal record to access, correct, or delete. Contact contact@iotmentor.dev about a specific chat message — we don't retain past conversations server-side. This section grows once accounts (M3) exist. You can also contact your national data protection authority — for Sweden, IMY.
Cookies
None set today beyond what Turnstile needs once enabled. A full cookie notice follows alongside that, and again when accounts ship.
Children
Not directed at children under 16. We don't knowingly collect their data.
Changes
Material changes posted here with an updated date; active users notified before significant changes take effect.
Full source
The canonical draft lives in the private repository's PRIVACY.md.