Privacy Policy

Last updated: 2026-08-20 · Version 1.0

Socratic Gate, operated by Guyzhong（个人开发者） (referred to as "we"), respects and protects your privacy. This Privacy Policy ("Policy") explains how we collect, use, store, and share your personal information when you use the evidence-driven product-opportunity screening and MVP validation console (the "Service"), as well as the rights you have under applicable law. By using the Service, you acknowledge that you have read and agreed to this Policy.

1. Data Controller

• Entity name: Guyzhong（个人开发者）
• Privacy contact email: support@socraticgate.com
• Data Protection Officer (DPO): not yet appointed (individual developer)

2. Personal Information We Collect

2.1 Information you provide voluntarily:

• Account information: name, email (obtained via OAuth login authorization), login identifier;
• Business content: the product signals you submit, four-field forms, evidence ledgers (including original quotes and sources), one-line claims, and Sprint review data; AI search candidates and pasted-text extraction (original text slices and source links fetched when you trigger a search or extraction, for your review and adoption only — unadopted candidates never enter any verdict);
• AI assistant chats: session titles and message history with the built-in AI assistant (Copilot), used to continue conversations across devices;
• Content-safety review records: only when content matches one of the six prohibited categories are the blocked content snippet (truncated to 2,000 characters) and the matched category written to the review log (retained for 180 days, see Section 7);
• Payment information: transaction amount, payment status. We do not store full card numbers — card data is processed by the payment processor (see Section 5);
• Communication records: emails and feedback you send to support.

2.2 Information we collect automatically:

• Network information: request origin country (Cloudflare country code, country-level precision only); we do not collect device model, operating system, browser type, or timezone, and we do not use device fingerprinting;
• Usage behavior: page views, feature usage, activity logs, session duration;
• Log data: request timestamps, error logs, performance data.

Evidence Wall and semantic clustering: evidence you save in the Evidence Wall (original text, type, case) is stored only in your browser locally and is never written to our servers. When semantic clustering is enabled (on by default), the excerpt text after local redaction (phone numbers, emails, @mentions, WeChat IDs, and URL user-path segments are replaced with [redacted]) is sent to Cloudflare Workers AI to compute a vector once; the result (the vector) is returned to your browser, and our servers store neither the original text nor the vector. You can switch on "fully offline mode" in the Evidence Wall settings: semantic clustering is disabled and a lexical clustering engine that runs entirely on your device is used instead, with no data leaving your device in that mode. (Please note the distinction: the evidence ledger you submit in the screening flow — including original quotes and sources — is stored on our servers and syncs with your opportunities; see "Business content" in this section. Everything in this paragraph applies only to the Evidence Wall tool. Evidence Wall content does not migrate across devices with your account — export a backup from its settings before switching devices.)

3. How We Use Your Personal Information

• To provide and maintain the Service (contractual performance);
• Billing and payment processing (contractual performance);
• Customer support (contractual performance / legitimate interest);
• Service notifications — billing, security, policy updates (legitimate interest);
• Security and fraud prevention, including content safety review of user input and AI output (legitimate interest);
• Product optimization and analytics (legitimate interest);
• Legal compliance (legal obligation).

We may aggregate or de-identify data for statistical analysis. Such data cannot identify specific individuals. We currently do not engage in marketing promotion; if we do in the future, it will be based on your separate consent and implemented only after this Policy is updated.

4. Cookies and Tracking Technologies

• Strictly necessary (cannot be disabled): login session (ig_session), local theme and language preferences (localStorage);
• We do not use third-party analytics or marketing cookies, and we do not serve targeted ads.
• We use self-hosted, cookieless server-side page counting (path, referrer host, country only) plus Cloudflare Web Analytics (cookieless, honors Do Not Track) as a cross-check; neither builds individual profiles. See /analytics.

5. Sharing and Disclosure of Personal Information

We do not sell your personal information, including any "sale" as defined by applicable law (such as CCPA). We only share your information in the following circumstances:

• Service providers: cloud hosting (Neon/PostgreSQL for database hosting), edge runtime and storage (Cloudflare Workers/R2), payment processing (Creem or Waffo Pancake as the Merchant of Record selected at checkout, PCI-DSS compliant; card data does not pass through our servers), AI model providers (Together AI and Fireworks AI, which only receive the input text needed for your current request), semantic vector computation (Cloudflare Workers AI, which only receives redacted excerpts, see Section 2.2), email delivery (Resend), and human verification / traffic cross-check (Cloudflare Turnstile / Cloudflare Web Analytics, both cookie-free), and other vendors, all bound by confidentiality agreements;
• Legal and regulatory requirements: in response to laws, court orders, or legitimate requests from competent authorities;
• Business transactions: in the case of a merger, acquisition, or similar, we will notify you in advance and ensure protective obligations continue;
• With your consent: for other purposes only with your explicit prior consent.

6. Data Security Measures

• Transport encryption: TLS / HTTPS;
• Storage security: sensitive data such as passwords is encrypted or hashed; login sessions use httpOnly + SameSite=Lax cookies;
• Access control: principle of least privilege; user data is isolated by default, and cross-user access returns 403;
• Regular security audits and vulnerability scanning.

In the event of a security incident affecting your rights, we will notify you and the relevant regulator within 72 hours of discovery, as required by law. Please safeguard your account credentials and do not share them.

7. Retention of Personal Information

• Account information: while active; delete your account self-service from the user menu in /app (effective immediately), or submit via support@socraticgate.com (we respond within 30 calendar days) — both paths complete full deletion or anonymization within 90 days thereafter;
• Business content (signals/opportunities/reports): retained while the account is active ("archiving" is a soft delete — data is not physically removed during the account lifetime); deletion requests follow the same process and timeline;
• Transaction records: retained for 7 years as required by law (tax/accounting obligations), then deleted or archived;
• Support records: 2 years;
• Security audit logs and content review logs: 180 days;

8. Your Data Rights

To exercise any of the following rights, contact us and we will process your request within 30 calendar days:

• Right to be informed: understand what data we collect and how we use it;
• Right of access: obtain a copy of your personal information;
• Right to rectification: correct inaccurate or incomplete information;
• Right to erasure: request deletion of your data under certain conditions — exercise it self-service from the user menu in /app (“Delete account”, effective immediately), or submit via support@socraticgate.com (responded within 30 calendar days, completed within 90 days thereafter);
• Right to restrict processing: pause data processing in certain situations;
• Right to data portability: obtain your data in a machine-readable format;
• Right to object: object to processing based on legitimate interests or marketing;
• Right to withdraw consent: withdraw consent for consent-based processing.

If you believe your data has not been handled properly, you have the right to complain to your local data protection authority.

9. Marketing Communications and Unsubscription

We currently do not send you marketing messages. If we do in the future, it will only be based on your separate consent, and we will provide an email unsubscribe link and an in-account toggle; unsubscribing will not affect essential service notifications (such as billing and security alerts).

10. Cross-Border Data Transfers

Our database host (Neon/PostgreSQL), edge runtime (Cloudflare), AI model providers (Together AI and Fireworks AI), email delivery (Resend), and payment processors (Creem or Waffo Pancake as the Merchant of Record selected at checkout) may have servers located in the United States and other regions. For cross-border transfers, we protect data through the following measures: executing data-processing agreements that incorporate the EU Standard Contractual Clauses (SCCs); and transferring data only to recipients with an equivalent level of protection.

11. Protection of Minors

This Service is intended for users aged 18 and older. We do not knowingly collect information from minors under 18. If you believe your child has provided us with information, contact us immediately and we will delete it promptly.

12. Third-Party Links and Services

The Service may contain third-party links or integrate with third-party services (such as OAuth login, payment checkout, and AI model providers). This Policy applies only to information we collect directly. We are not responsible for the data practices of third parties; we recommend reviewing their policies before use.

13. Changes to This Policy

For material changes, we will notify you at least 15 days in advance via an announcement on the Platform or to your registered email, and update the "Last updated" date at the top of this page. Continued use after the effective date constitutes acceptance.

14. Contact Us

• Privacy contact email: support@socraticgate.com
• Hours: Monday to Friday 09:00–18:00 (UTC+8)

Socratic Gate V3 · https://socraticgate.com