1. Who controls your data
The data controller for ChadGPT is AyyLabs Ltd.
Controller details▼
14/2E Docklands Business Centre 10-16 Tiller Road London E14 8PX United Kingdom
For anything about your data, email hello@chadgpt.plus. We are based in England and we follow the UK GDPR and the Data Protection Act 2018.
2. What we collect, why, and our lawful basis
This table reflects what the app actually stores today.
| Data | Why we have it | Lawful basis |
|---|---|---|
| Email address (account record and profile record) | To create your account, sign you in, send confirmation and password reset emails, and contact you about the service | Performance of our contract with you |
| Password, stored only as a secure hash | To sign you in safely | Performance of our contract with you |
| Google account identifier, if you sign in with Google | To link your Google sign in to your account | Performance of our contract with you |
| Account creation date and sign in timestamps | Account management and security | Contract, and our legitimate interest in keeping accounts secure |
| Daily reply count (your user id, the date and how many replies you used) | To apply the free daily limit fairly and prevent abuse | Contract, and our legitimate interest in preventing abuse |
| The messages you type and the replies ChadGPT gives you | Sent to our AI provider so a reply can be generated, and saved to your account so you can read your past conversations | Performance of our contract with you |
| Technical logs: error reports, IP address and browser information captured by our hosting and error reporting | To keep the service running, debug faults and detect attacks | Our legitimate interest in security and service reliability |
Your conversations are saved to your account. You can read them on the history page, and you can delete any conversation there at any time. Deleting a conversation removes it from our database permanently.
We do not run marketing emails, advertising or profiling. If we ever do, we will ask for your consent first and you will be able to withdraw it at any time.
3. Who else processes your data
These are the only third parties involved, and what each one receives.
| Service | What it receives | Role |
|---|---|---|
| Lovable Cloud (built on Supabase) | Your email, password hash, Google account identifier, profile record and daily reply counts | Hosts our database and authentication |
| Lovable AI Gateway | The message you type and the last ten turns of the conversation | Routes your message to the AI model and returns the reply |
| Google (Gemini model, google/gemini-3.8-flash) | The message text passed on by the gateway | Generates the reply |
| Google Sign In | Your sign in request; returns your email and account id to us | Optional login method |
| Lovable hosting and error reporting | Requests to the site, IP address, browser details and error reports | Serves the website and reports faults |
Model training: your messages are sent to the AI provider only to produce your reply. We do not permit your input to be used to train models, and we do not sell or share your data for advertising. You can read the providers' own policies here: Lovable privacy policy and Google privacy policy.
We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.
4. International transfers
Our infrastructure and AI providers operate globally, so your data may be processed outside the UK and the EEA, including in the United States.
Where that happens we rely on the UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with technical measures such as encryption in transit. You can ask us for details of the safeguard used by emailing hello@chadgpt.plus.
5. How long we keep things
| Data | Retention |
|---|---|
| Account record and profile (email, creation date) | For as long as your account exists, then deleted within 30 days of closure |
| Daily reply counters | 12 months, then deleted |
| Saved conversations | Until you delete them or close your account, then deleted within 30 days |
| Technical and error logs | Up to 90 days |
| Chat messages | Not retained. Nothing is stored on our servers |
| Records we must keep by law | Only for as long as the relevant legal obligation requires |
What deletion actually does: when you close your account we remove your login record, your profile row and your usage rows from our live database. Backups roll over and are overwritten within 30 days. After that your data cannot be recovered and you would need to create a new account to use ChadGPT again.
6. Your rights under UK GDPR
You have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of data that is wrong or incomplete.
- Erasure of your data, by closing your account or asking us directly.
- Restriction of how we use your data while a query is resolved.
- Portability, receiving your data in a common machine readable format.
- Objection to processing we carry out under legitimate interests.
- Withdraw consent at any time where we rely on consent. Withdrawing does not affect anything done before you withdrew.
To exercise any of these, email hello@chadgpt.plus from the address on your account and tell us what you want. We will respond within one month. If a request is complex we may extend that by up to two further months and will tell you why. There is no charge in normal circumstances.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put it right first.
8. Minimum age and children
ChadGPT is for people aged 16 or over. It is not designed for children and we do not knowingly collect data from anyone under 16.
Sign up does not currently ask for a date of birth, so we rely on the age requirement in our Terms of Service. If you are a parent or guardian and believe a child has created an account, email hello@chadgpt.plus and we will delete the account and its data promptly.
9. Security and data breaches
We protect your data with measures including:
- Encryption in transit using HTTPS for everything.
- Passwords stored only as salted hashes, never in readable form.
- Database access rules so an account can only ever read its own profile, usage rows and saved conversations.
- Administrative access limited to those who need it, with credentials kept secret.
- The ability to delete any saved conversation yourself at any time.
No system is perfectly secure. If a breach happens that is likely to be a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware, and we will tell affected users without undue delay where the risk is high, explaining what happened and what to do.
10. Changes to this policy and effective date
We will update this policy when the app changes. Material changes will be announced by email or in the app before they take effect. The date at the top of this page always shows the current version.
Effective date: 18 September 2026