Privacy Policy
Last updated: September 4, 2026
1. Who we are
CiStars (“CiStars”, “we”, “us”, “our”) provides an AI assistant that answers questions using documents you upload, with source citations. This Privacy Policy explains what data we collect, why, and how we handle it.
CiStars is operated by Stanislav Liakhouchyk, an individual based in Poland.
If you have questions about this policy, contact us at lstanislav1924@gmail.com.
2. What data we collect
Account data: email address, password (stored encrypted, we never see it in plain text), company name.
Documents you upload: the files you choose to upload to your workspace (PDF, Word, Excel, PowerPoint, CSV, text files), and copies of any documents you connect from third-party sources (like Google Drive or Notion), if you use those features.
Usage data:questions asked through the chat (processed to generate answers, not permanently stored by us beyond what's needed for the service to function), document upload/access logs (filename, status, timestamps — not document content), login timestamps.
Payment data: if you subscribe to a paid plan, payment processing is handled entirely by our payment provider (Lemon Squeezy). We do not store your card details ourselves.
Data from connected employees/team members: if you share your CiStars chat link with your team, we may process basic identifiers of the people who use it (for example, a Telegram user ID and name, if you connect Telegram) — see Section 5 for how this varies by channel.
3. What we do NOT ask you to upload
CiStars is designed for general company knowledge — policies, procedures, product information, and similar. We ask you not to upload sensitive personal data(salaries, health information, national ID numbers, personal contracts, or other data about identifiable individuals beyond what's needed for general company knowledge). You, as the account owner, are responsible for what your workspace's documents contain.
4. How we use your data
- To provide the core service — indexing your documents and generating answers with citations
- To enforce usage limits (document count, storage, monthly questions) tied to your plan
- To send you service-related notifications (for example, confirming your account, or — with your consent — product updates)
- To improve the reliability and quality of the service (we do not use your document content to train third-party AI models beyond what's required to generate your own answers)
5. Third parties we share data with (subprocessors)
We use the following third-party services to operate CiStars. Each processes a limited slice of your data, only as needed for their specific function:
| Provider | What they process | Why |
|---|---|---|
| Supabase | Account data, document metadata, copies of uploaded files | Database and file storage |
| Google (Gemini / File Search API) | Document content | Indexing and answering questions |
| Dify | Chat messages, document citations | Orchestrating the chat/answer flow |
| Lemon Squeezy | Payment and billing information | Payment processing (Merchant of Record — they are the seller of record for tax purposes) |
| Vercel | Hosting infrastructure | Running the CiStars website and application |
| Telegram / WhatsApp / Slack (if you connect these) | Messages sent through the connected channel, basic user identifiers | Delivering the chat assistant through your chosen channel |
We do not sell your data to anyone.
6. Data retention
We retain your account and document data for as long as your account is active. If you delete a document, we remove it from our storage and from the search index. If you close your account, we delete your data within 30 days, except where we're required to retain records for legal or tax purposes (for example, billing records).
7. Your rights (GDPR)
If you're located in the European Economic Area, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at lstanislav1924@gmail.com. You also have the right to lodge a complaint with your local data protection authority.
8. Data security
We use industry-standard security measures — encrypted connections (HTTPS), access-controlled storage, and authentication — to protect your data. No system is 100% secure, and we can't guarantee absolute security, but we take reasonable steps to protect what you share with us.
9. International data transfers
Some of our subprocessors (for example, Google, Vercel) may process data outside the European Economic Area. Where this happens, we rely on the transfer mechanisms these providers offer (such as Standard Contractual Clauses) to ensure your data remains protected.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll notify you by email or through the product.
11. Contact
Questions about this policy or your data: lstanislav1924@gmail.com