Who operates this service
Qriton Technologies S.R.L. operates the public Qriton KB demo and acts as controller for the personal data processed to operate and secure it. Qriton relies on its legitimate interests in providing and protecting this optional public service.
This deployment is intended for questions about its public regulatory corpus. It is not intended for confidential information or special-category personal data.
Data and purposes
| Chat and Compare | The question you type, limited conversation context when needed for a follow-up, the passages retrieved to answer it, and the resulting answer, citations, and receipt metadata. These are processed to answer or refuse the request and show its evidence. |
|---|---|
| Service metadata | A request path, trace identifier, method, and processing time are recorded in application operational logs. The client network address is used in process memory for rate limiting when no authenticated user identity is available. Microsoft Azure operational and security logs are retained for up to 30 days. |
No solely automated decision with legal or similarly significant effect is made about a person by this public demo.
Where a question goes
- Qriton KB receives the question and retrieves candidate passages from the deployment's indexed corpus.
- The query embedding used to retrieve passages is computed inside the application deployment.
- This deployment uses OpenAI's hosted Responses API for answer generation. Qriton sends the question, any limited follow-up context, and the retrieved source passages needed to ground the answer. The application sets
store=falseon each request. That disables Responses API storage for later retrieval; it is not a zero-retention claim. OpenAI states that default abuse-monitoring logs may retain API content for up to 30 days. See OpenAI's API data controls and data processing terms. - The application checks the answer against retrieved evidence, returns the result, and writes the configured audit record.
When Compare is enabled, the same question is used for two answer-generation requests: baseline RAG and governed Qriton KB. Compare results are displayed in the tab but are not added to its saved chat transcript or the answer audit chain.
Storage and retention
| This browser tab | Up to 40 recent
question-and-response pairs are kept in sessionStorage so a refresh
does not erase the conversation. New chat clears that copy. The
client also removes the legacy persistent localStorage transcript
when the page loads. |
|---|---|
| Server context | Up to 12 recent turns are held in process memory for follow-up questions. On the next chat cleanup, a conversation idle for 6 hours is removed; a server restart also clears this context. |
| Audit record | For new chat records, question and conversation text is replaced with SHA-256 digests before the audit event is appended. A digest supports integrity and correlation checks but is not described as anonymous data. The current setting stores an answer digest and evidence metadata, not the plaintext answer, in new audit events. The application checks retention at startup, before an audit write, and during an integrity check. At the first such check after the oldest record reaches 30 days, it rotates the active audit chain. Rotation removes the complete prior chain, so individual receipts can expire sooner. |
| Application log | The local application log records operational metadata, not chat request or response bodies. On this public demo, request identifiers are generated by the application rather than accepted from the caller. Expired local application-log entries are removed at startup and before the next operational event after they reach 30 days. |
| OpenAI | For the configured OpenAI path, Qriton sends store=false. OpenAI's published default abuse-monitoring period is up to 30 days unless different account-level controls have been approved. |
Service providers and transfers
The current public demo uses Microsoft Azure for application hosting. It uses OpenAI for answer generation, so OpenAI receives the grounded generation request described above. Qriton's client page does not load third-party analytics, fonts, or runtime assets.
Where OpenAI processing transfers personal data outside the EEA, Qriton's general privacy policy describes safeguards such as an adequacy decision or Standard Contractual Clauses. OpenAI publishes its data-processing and subprocessor terms; the applicable contract and account controls determine the exact mechanism. The general Qriton policy provides the company-level privacy terms. This page does not represent that every Qriton KB deployment uses the same providers.
Your choices and rights
You can use the suggested public-corpus questions instead of entering your own text. New chat removes the transcript held by this browser tab.
To ask for access, correction, deletion, restriction, or to object to processing, email hello@qriton.com. You may also complain to your competent data-protection authority. Include the approximate time of a request or its receipt identifier if you want Qriton to locate a specific demo interaction.
Read the Qriton privacy policy for company-level information. This deployment notice records the product-specific data flow; it is not a certification of a customer's use case.