Privacy Notice for Socialism AI

Effective date: November 17, 2025

Services covered: the chatbot available at https://ai.wsws.org and any paid access sold by Left Insight LLC (418 N. Main Street, Suite 200-#3872, Royal Oak, MI 48067–1813), doing business as Socialism AI (also referred to as we, our, or the Service).

1) Who we are and how roles work

Socialism AI is the controller of your personal data when you use the Service.

A controller is the entity that determines why and how your personal data is processed.

Contact for privacy matters (Data Protection Officer)

Address: Data Protection Officer

418 N Main St, Suite 200 #3872

Royal Oak, MI 48067, USA

Email: privacy@ai.wsws.org

2) What we collect

We collect information in three ways: (1) data you provide, (2) data collected automatically, and (3) data we receive from other sources.

2.1 Data you provide

• Account data: email, username, billing details for paid subscriptions.
• Payment data (via Stripe): card details, billing address, transaction metadata.
  • We do not store card numbers; Stripe, our PCI/DSS-certified processor, stores them.
• Prompts and outputs: the text and files you enter or upload and the responses generated.
• Support messages: emails or support tickets you send.
• Submitted URLs: When you submit a URL (e.g. a link to an article), our service retrieves the content of that URL on your behalf and stores it as part of your conversation record. This allows you to make follow-up requests about that content in future sessions, in the same way as text you type directly into the chat. You are responsible for not submitting URLs whose content contains personal data of third parties that you are not authorised to process.
• Profile photos (optional): if you upload a photo. These files may contain EXIF metadata with additional personal information.
• File uploads: When you upload a file, we use it to process your request and to make the relevant conversation work. We extract the relevant text or generate a summary or description from the file. We may keep the extracted text, summary, or description as part of your conversation history so that you can return to the conversation later. We do not use uploaded files or extracted file content to train our models by default. If we offer training or product-improvement use based on uploads, we will do so only where this is clearly explained and permitted by your settings or consent. If you delete a conversation or your account, we delete the associated uploaded files and extracted content, subject to limited exceptions where retention is necessary for legal compliance, security, abuse prevention, dispute handling, or protection of our service. Deleted content may also remain for a limited period in backups before being removed in the ordinary course of backup deletion. You can also remove an uploaded file from a conversation manually at any time. Keep in mind this may impede the continuity of the conversation. For image uploads, we may generate a text description, optical character recognition (OCR) text, or other derived text from the image.

2.2 Data collected automatically

• Technical/usage data: IP address, timestamps, request identifiers, user‑agent, error codes, coarse location (derived from IP for localization and security).
• Cookies/SDKs: strictly necessary cookies; optional analytics tools (e.g., PostHog) if enabled.
• Regional flag (derived from IP): used server-side to determine your region (e.g., EEA vs. non‑EEA) and show correct consent settings and legal notices.
  • We do not derive precise location.
  • Only a transient region flag is stored; the IP is discarded immediately.
• Outbound URL retrieval: When our servers retrieve external content at your request, the request originates from our server infrastructure (hosted by Hetzner). Third-party servers receiving such requests will log our server's IP address and the request timestamp. We do not transmit your account identity or personal data to those third-party servers; however, we cannot control what information third-party servers may infer from such requests.

2.3 Data from other sources

We may receive limited data used for fraud detection and abuse prevention—for example from Stripe (see below).

2.4 Using the Service without an account

Where it is available, you can ask a limited number of questions without creating an account. Reading pages creates nothing: an anonymous identity is created only when you submit your first question.

• Anonymous identity: when you submit your first question, we create an anonymous account for you. It has a random identifier, a placeholder email address on a domain that receives no mail (temp-…@anonymous.socialism.ai), the generic name "Anonymous" and no password. Your browser receives the same session cookie that signed-in users receive (see section 5); it is what lets you return to your conversations. We never send email to the placeholder address and never add it to a mailing list.
• Questions and answers: your questions, the answers generated for them, and the conversations, collections and bookmarks you create are stored and processed as described for accounts in 2.1, linked to the anonymous identifier, including by our model inference provider. Uploading files and creating share links are not available without an account. Your questions may reveal your political opinions (see "Special-category data" in the Addendum).
• Consent: where we ask for it, you give your consent by ticking the statement next to the question box before your first question. We record it as described in section 5 (including the IP address from which it was given).
• Question screening: before an answer is generated, the text of each question asked without an account is checked by an automated classifier, to keep out hostile, abusive, spam, prompt-injection and off-topic use and to protect the free allowance. The classifier is run by OpenAI as our processor (see Part 2). It receives the text of the question only, not your identifier or IP address. If a question is not accepted, you are asked to sign in or create a free account; no reason is given.
• Usage counters: we count the questions asked under each anonymous identity to apply the allowance for use without an account. We also keep one total per day for all use without an account; it contains no identifier.
• Limit on new anonymous identities: to prevent abuse, we limit how many anonymous identities can be created from one internet address per day. For this we store a keyed hash of your IP address (for IPv6, of its /64 network prefix) combined with the date, so the same address produces an unrelated value every day and the value cannot be turned back into the address without our secret key. Values from previous days are deleted when the next identity is created from any address, so a day's values are kept at most until the next identity is created. If no reliable IP address is available, no anonymous identity is created and you are asked to sign in.
• Technical data: as for accounts, the session record stores the IP address and browser user agent of the request that created it.
• Keeping your conversations when you sign in: when you sign in or create an account from an anonymous session, the sign-in window offers an unticked choice, "Keep my conversations in my account". Only if you tick it do we move your conversations, collections and bookmarks (and the feedback you gave on those answers) to your account and then delete the anonymous identity. If you do not tick it, nothing is moved: the anonymous identity and its conversations stay as they are until they are erased under the retention rule below. In both cases the question allowance starts fresh on your account, and you give your consents again for the account.
• Analytics: when you sign in or create an account from an anonymous session, with or without that choice, the analytics records kept under your anonymous identifier are linked (aliased) to your account. They then stay attached to your account and are not deleted with the anonymous identity. Analytics events that our app records about use without an account carry your anonymous identifier only if you accepted analytics cookies; otherwise they are recorded under a shared identifier that does not identify anyone. These app events contain fixed codes only (for example "allowance reached"), never the text of your questions or answers. Separately, our chat service records an event for every question it answers, with or without an account, and that event contains the text of the question and of the answer together with your account or anonymous identifier. These events are processed in the service's analytics pipeline: they are published through Amazon Web Services (Amazon SNS), archived in Amazon S3, loaded into our analytics database (ClickHouse, on our servers at Hetzner) and sent to PostHog. This happens whatever you chose for analytics cookies, because the chat service does not see that choice, and these records are not deleted when an anonymous identity is erased under the retention rule below. We use them to monitor and improve the quality, speed and cost of answers.
• Retention: an anonymous identity with no activity for 90 days (no question asked and no visit with its session) is erased together with its conversations, collections, bookmarks, usage counters and consent records, through the same deletion process we use for accounts. Conversations you chose to keep in an account follow the account's retention. If you clear your cookies, or your session cookie expires (see section 5), you can no longer open those conversations; they are still erased after the 90 days.
• Your choices: you can delete any of your conversations from History at any time. Because an anonymous identity carries no name or contact details, we may be unable to tell from an email request alone which data is yours.

3) Why we use data (purposes) and legal bases

3.1 Core operation

We process data to:

• operate the chatbot,
• route requests to model providers,
• return responses,
• manage accounts and subscriptions,
• provide user support,
• process payments,
• maintain availability and reliability,
• prevent abuse and security issues,
• measure system capacity.

If you upload a profile photo, it may be shown in your account or chat interface.

Where you upload a file, its content is transmitted to the model inference provider that generates your answer (see "Model inference providers" in Part 2) solely for generating your response. File content is subject to the same retention period as chat prompts. Files are not used to train AI models.

Legal bases: - In the EEA/UK: see the EEA/UK Addendum for GDPR bases.

• Outside the EEA/UK: contractual necessity, legitimate interests (e.g., security), consent where required, and compliance with legal obligations.

3.2 Communications

Transactional emails about your account, legal notices, and service updates; optional product updates and other non-transactional emails only with your opt-in.

3.3 Analytics (if enabled)

Product analytics and diagnostics (e.g., PostHog, see below). Posthog is used to see how frequently various product features are used.

Legal basis: Consent where required by local law.

3.4 Model training

By default, inputs/outputs are not used to train foundation models. If training on your inputs/outputs is proposed, we will only do so with appropriate consent or as required by applicable law.

Stripe, Inc. (payments) – processor / independent controller

Registered addresses

• US: Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA
• EU: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin D02 H210, Ireland
• EU tech entity: Stripe Technology Europe, Limited, The One Building, 1 Lower Grand Canal Street, Dublin 2, Ireland

Data processed

User ID, name (for paid accounts), billing email, billing address, transaction ID, card details, device/IP data, amount, and fraud‑detection telemetry. We do not store card numbers; Stripe stores them and is PCI/DSS‑certified.

Purposes

Payment execution, fraud prevention, bookkeeping, AML and regulatory duties.

Legal basis (EEA/UK)

See the EEA/UK Addendum.

Transfers & safeguards

Primarily USA; SCCs and DPF used where applicable.

Retention

As needed for service delivery and statutory obligations.

Official documentation

• Privacy Policy: https://stripe.com/privacy
• Data Processing Agreement: https://stripe.com/legal/dpa
• DPA FAQs: https://stripe.com/legal/dpa/faqs
• EU imprint: https://stripe.com/au/legal/imprint
• US licenses/contact: https://stripe.com/legal/spc/licenses

Hetzner Online GmbH (server hosting & infrastructure) – processor

Registered address

Industriestr. 25, 91710 Gunzenhausen, Germany

Data processed

Service data stored on our servers (chat transcripts, settings, uploaded files), server logs (IP, timestamps, metadata), and backups.

Purposes

Hosting, infrastructure operation, backups, monitoring, disaster recovery.

Legal basis (EEA/UK)

Art. 6(1)(b) and Art. 6(1)(f) GDPR.

Transfers & safeguards

Data stored in Germany; SCCs for any transfers.

Retention

Active data retained during service use; backups for 30 days.

Official documentation

• Privacy Policy: https://www.hetzner.com/legal/privacy-policy
• Data Privacy FAQ: https://www.hetzner.com/legal/data-privacy-faq
• Security & Compliance: https://www.hetzner.com/unternehmen/zertifizierung/

Neon, Inc. (database hosting) – processor

Registered address

Neon, Inc., 221 Main Street, Suite 300, San Francisco, CA 94105, USA

Region

AWS eu-central-1 (Frankfurt)

Data processed

User accounts, chat transcripts, settings, metadata, query logs, connection data, backups.

Purposes

Database hosting, replication, diagnostics, performance monitoring.

Legal basis (EEA/UK)

See Addendum.

Transfers & safeguards

EU storage; SCCs for external transfers.

Retention

Active data remains for duration of service.

Official documentation

• Privacy Policy: https://neon.tech/privacy-policy
• DPA: https://neon.tech/dpa
• Security: https://neon.tech/security
• Subprocessors: https://neon.tech/subprocessors

PostHog (Cloud EU/US) – processor

Registered address

PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA

Data processed

Cookie/SDK identifiers, truncated IP, page views, clicks, timestamps, event metadata.

Purposes

Product analytics and diagnostics.

If analytics captures political inferences or chat content, explicit Art. 9(2)(a) consent is required.

Legal basis (EEA/UK)

Consent.

Region & transfers

Data stored in AWS eu-central-1 (Frankfurt). PostHog states no EU→US transfers on the EU Cloud.

Retention

90‑day auto‑deletion of event‑level data.

Official documentation

• Privacy Policy: https://posthog.com/privacy
• GDPR Compliance: https://posthog.com/docs/privacy/gdpr-compliance
• Privacy Controls: https://posthog.com/docs/privacy
• EU Cloud FAQ: https://posthog.com/blog/posthog-cloud-eu
• DPA generator: https://posthog.com/dpa

Model inference providers – processors

Answers are generated by large language models that we do not run ourselves. To answer a question, our chat service sends the provider that hosts the model the text of your question, the earlier messages of the conversation, the content of files you uploaded and of web pages you asked us to read, and the search results used for the answer; the provider returns the answer. We do not send your name, email address or IP address. A technical conversation identifier may be sent so that follow-up questions reach the same server.

Which provider answers

• Default: answers are generated by DeepSeek V4 Pro, an open-weight model, hosted by Together AI. If Together AI is unavailable, the same model hosted by DeepInfra is used, and then DeepSeek V4.1 Flash hosted by DeepInfra. DeepSeek, the company that published the model, does not receive your data.
• Other models: a conversation that started while another model was the default stays on that model, and a small number of accounts can choose a model in their settings. These models are provided by Anthropic (Claude, see below), OpenAI (GPT), Google (Gemini), and, for other open-weight models, by DeepInfra, Together AI or Fireworks AI.
• Search: to find relevant articles, the search queries formed from your question are converted into numerical representations (embeddings) by Fireworks AI, which also re-ranks the articles found. The search itself runs on Qdrant (see below).
• Question screening without an account is done by OpenAI (see "OpenAI (question screening)" below).

Legal basis (EEA/UK)

Art. 6(1)(b) GDPR (contract), Art. 9(2)(a) GDPR (explicit consent)

Transfers & safeguards

Most of these providers are established in the United States. Transfers to them rely on EU Standard Contractual Clauses and supplementary measures (see Addendum F).

Anthropic – processor (model inference)

Registered addresses

• EEA/CH: Anthropic Ireland, Limited, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
• US: Anthropic, PBC, 1455 3rd Street, San Francisco, CA 94158, USA

Data processed

Prompts, File-Content, URL-Content, outputs, minimal logs (timestamps, request IDs, edge IP), abuse‑signal metadata.

Training on inputs is OFF by default unless you opt in.

Purposes

Model inference.

Legal basis (EEA/UK)

Art. 6(1)(b) GDPR (contract), Art. 9(2)(a) GDPR (explicit consent)

Transfers & safeguards

EU Standard Contractual Clauses and supplementary measures.

Retention

Your inputs and AI-generated responses are automatically deleted from Anthropic's systems within 30 days. In cases where content is flagged by Anthropic's safety systems, retention may be extended to up to 2 years.

Official documentation

• DPA: https://www.anthropic.com/legal/data-processing-addendum
• Enterprise privacy/security: https://trust.anthropic.com/

OpenAI (question screening) – processor

Data processed

The text of each question asked without an account (see 2.4). No account identifier, email address or IP address of the person asking is sent.

Purposes

Automated screening of questions asked without an account, before an answer is generated, for hostile, abusive, spam, prompt-injection or off-topic use.

Legal basis (EEA/UK)

Art. 6(1)(f) GDPR (legitimate interests: abuse prevention and protection of the free allowance); Art. 9(2)(a) GDPR (explicit consent, where we ask for it).

Region & retention

The text of your question is used only to return a classification and is not used to train OpenAI's models. Under OpenAI's API terms, inputs may be retained for up to 30 days to monitor for abuse and are then deleted. Transfers outside the EEA are covered by OpenAI's Data Processing Addendum and Standard Contractual Clauses.

Official documentation

• Privacy Policy: https://openai.com/policies/privacy-policy/
• Data Processing Addendum: https://openai.com/policies/data-processing-addendum/

Qdrant Solutions GmbH (vector database & semantic search) – processor

Registered address

Chausseestraße 86, 10115 Berlin, Germany

Data processed

Vector embeddings and metadata for retrieval-augmented generation (RAG) and semantic search.

We do not store raw user data in Qdrant.

Purposes

Vector storage and similarity search.

Legal basis (EEA/UK)

Contract necessity (Art. 6(1)(b) GDPR)

Transfers & safeguards

EU/EEA or adequacy regions; US transfers use Data Privacy Framework or Standard Contractual Clauses.

Retention

For duration of Cloud Service Agreement.

Official documentation

• Cloud DPA: https://cloud.qdrant.io/dpa
• Privacy Policy: https://qdrant.tech/legal/privacy-policy/
• Terms & Conditions: https://qdrant.tech/legal/terms_and_conditions/
• Impressum: https://qdrant.tech/legal/impressum/
• Service Agreement: https://cloud.qdrant.io/service-agreement

Sentry (Functional Software, Inc.) – processor

Registered addresses

• US: 45 Fremont Street, 8th Floor, San Francisco, CA 94105
• EU: Functional Software GmbH, Rothschildplatz 3, 1020 Vienna, Austria

Data processed

Error events, stack traces, URLs, headers, IPs, emails, session replay (if enabled), performance data.

Purposes

Error tracking and performance monitoring.

Legal basis (EEA/UK)

Legitimate interests (Art. 6(1)(f) GDPR)

Retention

30 days for events/logs, 90 days for backups.

Transfers & safeguards

US/EU regions depending on selection; participates in EU‑US Data Privacy Framework.

Official documentation

• DPA: https://sentry.io/legal/dpa/
• Data retention: https://docs.sentry.io/security-legal-pii/security/data-retention-periods/
• Subprocessors: https://sentry.io/legal/subprocessors/
• DPF listing: https://www.dataprivacyframework.gov/participant/5869

Loops (Astrodon Corporation) – processor (email automation & campaigns)

Registered address

9450 SW Gemini Dr, PMB 22902, Beaverton, OR 97008‑7105, USA

Data processed

Email, user ID, optional name, subscription status, interaction metadata, deliverability/abuse logs.

No chat transcripts are sent.

Purposes

Transactional emails, newsletters (opt‑in), personalization (explicit Art. 9(2)(a) consent), segmentation, unsubscribe management.

Legal bases (EEA/UK)

• Transactional emails: Art. 6(1)(b) GDPR
• Newsletters: Art. 6(1)(a) GDPR
• Political‑inference personalization: Art. 9(2)(a) GDPR
• Deliverability/abuse logs: Art. 6(1)(f) GDPR

Retention

Personalization labels until withdrawal; events up to 13 months; suppression lists maintained to honor opt‑outs; logs 30–90 days.

Official documentation

• Privacy: https://loops.so/privacy
• DPA: https://loops.so/dpa
• Security: https://loops.so/security

Third‑party sign‑in (Google)

Data received

Provider user ID, email, profile name/avatar (if authorized).

We do not receive your password or contacts.

Purposes

Authentication and fraud prevention.

Legal basis (EEA/UK)

See Addendum.

SDK/Cookies

Google scripts load only after you click Sign‑In.

One‑Tap prompts run only with consent in EEA/UK.

Roles

Google: independent controller for identity services

Socialism AI: controller for your chatbot account

Retention

We retain your provider ID and email for as long as your account exists.

Official documentation

• Privacy Policy: https://policies.google.com/privacy

5) Cookies and similar technologies

We use cookies and similar technologies to operate the Service and, where permitted, to run analytics.

Strictly necessary storage

These cookies run without consent where allowed because they are required to deliver the Service you request (e.g., authentication tokens, quota management).

Consent records (EEA/UK)

We keep minimal proof of your consent decisions as described in the Addendum:

• a user/account or consent-token ID,
• consent purposes (including explicit Art. 9 consent, if given),
• timestamp,
• IP address,
• consent policy version presented.

We do not store device fingerprints, browsing history, or chat content for consent proof.

Records are kept until withdrawal + 3 years for legal compliance, then deleted or anonymized.

Analytics and measurement

Analytics cookies or SDKs (such as PostHog) run only with consent in the EEA/UK and where otherwise required.

You may withdraw consent at any time in settings.

Geo-IP for consent settings

We derive a coarse region identifier server-side to show legally required consent banners and correct language.

Only a transient region flag is stored; the raw IP is discarded immediately.

Cookie table

Use without an account: the session cookie above is also set when you submit your first question without an account (see 2.4), and never earlier. It identifies your anonymous identity and is treated as strictly necessary, because without it we cannot deliver the conversation you asked for.

6) Data transfers

We primarily host and process data in the European Union (Germany and Frankfurt AWS regions).

Some vendors operate in the United States or other third countries.

Where international transfers occur, we apply safeguards such as:

• Standard Contractual Clauses (SCCs) under GDPR Art. 46
• EU–US Data Privacy Framework, UK and Swiss extensions (where applicable)
• Supplementary measures (encryption in transit, access controls)

Full details appear in the EEA/UK Addendum.

7) Retention

We retain personal data only as long as necessary for:

• operating the Service,
• resolving disputes,
• security and fraud prevention,
• complying with legal obligations.

Retention depends on:

• the purpose for which data was collected,
• whether consent was withdrawn,
• the nature and sensitivity of the data,
• the potential risks of misuse or disclosure,
• applicable statutory obligations.

8) Your choices

You have several options to control your data:

• Disable non-essential analytics through consent settings.
• Avoid entering sensitive data you do not want processed.
• Delete conversations to remove uploaded file content.
• Remove uploaded files from conversations manually.
• Withdraw consent at any time in your account settings.
• Close your account whenever you choose.

Accuracy of model outputs

AI-generated responses may contain inaccuracies.

If you believe generated content about you is false and want it corrected or removed, you may contact us. Requests will be handled according to:

• applicable law, and
• the technical limits of model architectures.

9) Automated decision-making

We do not engage in solely automated decision-making that produces legal or similarly significant effects.

For EEA/UK users, see the Addendum for GDPR-specific statements.

10) Children

• United States: the Service is not for children under 13.
• EEA/UK: not for children under 16, unless local laws allow a lower age and valid guardian consent is obtained.

11) U.S. state privacy disclosures

Residents of certain U.S. states (including CA, CO, CT, TX, VA, UT, OR, DE) may have statutory privacy rights such as:

• Access and deletion
• Correction
• Data portability
• Opt-out of:
  • sale of personal information
  • sharing for targeted advertising
  • certain profiling
• California residents may limit use/disclosure of Sensitive Personal Information

California (CCPA/CPRA)

• We do not “sell” or “share” personal information as defined under the CCPA/CPRA.
• We provide required controls such as “Do Not Sell or Share” and “Limit Use of My Sensitive PI.”
• We do not sell/share PI of consumers under 16; if this were ever proposed, opt-in consent would be required.

Colorado & Connecticut

We honor Universal Opt-Out Mechanisms (UOOM), including the Global Privacy Control (GPC), for targeted advertising and sale categories.

Texas and other states

Where required, you may opt out of targeted advertising, sale of personal data, and automated profiling.

Non-discrimination rules apply.

Exercising rights

Submit requests to privacy@ai.wsws.org.

We will verify your identity and provide an appeals process if required by state law.

12) How to contact us

For privacy requests or questions, email: privacy@ai.wsws.org. We route requests to the appropriate organization (ICFI, WSWS Inc., or Socialism AI) depending on your region and nature of the request.

EEA/UK/Switzerland Addendum (GDPR)

This Addendum applies to users in the European Economic Area (EEA), the United Kingdom (UK) and Switzerland.

A) Controllers and processors

Controller

Left Insight LLC (d/b/a Socialism AI)

418 N. Main Street, Suite 200-#3872

Royal Oak, MI 48067-1813, USA

Processors

We use several processors, including:

• Model inference providers: Together AI, DeepInfra, Fireworks AI, Anthropic, OpenAI and Google (see "Model inference providers" in Part 2)
• OpenAI (screening of questions asked without an account)
• Stripe
• PostHog
• Hosting and email providers (e.g., Hetzner, Neon, Sentry, Loops)

Vendor details appear in Part 2.

B) Purposes, data, and GDPR legal bases

Special-category data (Art. 9 GDPR)

The chatbot’s core feature is personalized political interaction: it analyses your prompts and may infer your political positions, use that to tailor answers, show history and suggest follow-ups.

Because prompts and outputs may be linked to your account, this constitutes processing of special-category data under Art. 9 GDPR.

We process this data only when:

• it is necessary for the core functioning of the Service (personalized political interaction), and
• you give explicit consent (Art. 9(2)(a)).

You may withdraw this consent at any time. Keep in mind that you will then not be able to use the chatbot’s core feature anymore.

C) Cookies and SDKs (EEA/UK)

Strictly necessary storage

Runs without consent when required for service delivery. If personal data is involved, we rely on Art. 6(1)(f).

Analytics

Runs only with consent (Art. 6(1)(a)).

If analytics captures or infers political opinions through event metadata or chat content, we also request explicit Art. 9(2)(a) consent.

Email measurement pixels

Open/click tracking is considered device access under ePrivacy/TDDDG/UK PECR.

It requires consent and is off by default.

Consent records

We maintain minimal proof of your consent decisions:

• user/account or consent-token ID
• the purposes you selected (including special-category / Art. 9 consent)
• timestamp
• IP address
• the policy/consent-settings version displayed to you

We do not store:

• fingerprints
• browsing history
• chat content
  for consent logs.

Retention:

• held until you withdraw consent, plus 3 years for legal defense
• then deleted or irreversibly anonymized

You may withdraw at any time.

D) Automated decisions (GDPR Art. 22)

We do not make decisions with legal or similarly significant effects solely by automated means.

Human review is available where required.

E) Your GDPR/UK GDPR rights

You may exercise the following rights:

• Access your data
• Rectify inaccurate data
• Erase data (“right to be forgotten”)
• Restrict processing
• Portability
• Object to processing based on Art. 6(1)(f)
• Withdraw consent at any time

Withdrawal does not affect prior lawful processing.

Contact: privacy@ai.wsws.org

You may lodge a complaint with your local supervisory authority:

https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

F) International transfers

We may transfer personal data to the United States when using vendors such as our model inference providers (Together AI, DeepInfra, Fireworks AI, Anthropic, OpenAI and Google), Stripe, Sentry, Loops, and others.

Safeguards include:

• Standard Contractual Clauses (SCCs) (Art. 46)
• Participation in the EU–US Data Privacy Framework, UK Extension, and Swiss–US Framework (where applicable)
• Technical and organizational measures such as encryption and access controls

A copy of the SCCs can be provided upon request (with redactions).

G) Retention (EEA/UK)

• Prompts/outputs: retained for 30 days by default for security and abuse prevention; longer only when necessary and documented
• Analytics events (PostHog): 90 days, then aggregated
• Use without an account: anonymous identities, with their conversations, usage counters and consent records, are erased after 90 days without activity; keyed IP hashes for the identity limit are deleted when the next identity is created (they stay until then)
• Account and billing data: retained for statutory periods

  1. H) Article 27 representative

EU/UK representative for Socialism AI: Christoph Vandreier, C/o SGP, Neuenburgerstr. 13, 10969 Berlin, left-insight@gleichheit.de

13) Necessity of provision (Art. 13(2)(e) GDPR)

To use the Service:

• You must provide correct account and payment data for paid plans; without these, the subscription cannot be delivered.
• Because the chatbot involves the analysis and inference of political opinions, explicit consent under Art. 9(2)(a) is necessary for its core functionality. If you do not grant this consent, we cannot provide the personalized features of the Service.
• Other than the above, there is no statutory or contractual requirement for you to provide your personal data.

Non-essential analytics is optional.

14) Sources (Art. 14 GDPR)

Where we obtain data from third parties, categories include:

• fraud-prevention or payment-security data from Stripe
• infrastructure metadata from hosting and network providers