Privacy Policy

Last updated 30 August 2026. This policy explains what we do with your information, in plain language. Where the law requires a specific term we use it, but we have tried not to hide behind them.

Who is responsible for your data

RootCause AI is operated by Demetris Charalambous, a pharmacist registered in Cyprus. For data protection purposes he is the data controller. You can reach him at hello@rootwauseai.com or through the contact page.

What we collect

If you have an account

• Your name and email address.
• Your subscription status and billing history. We never see or store your card number. Payments are handled by our payment provider, who holds those details.
• Basic records of which parts of the site you have used, so we can keep the service working and spot abuse.

If you message us

• Whatever you put in the form, plus your name and email so we can reply.

If you use the assistant

We do not store your conversations. What you type is sent to our AI provider so an answer can be generated, the answer comes back to your browser, and no copy is kept on our systems. Closing the page ends the conversation permanently. We keep only a count of how many questions you have asked today, so that daily limits work.

Automatically

• Standard server logs including your IP address, browser type and the pages you requested. These are used for security and troubleshooting.

Health information

If you tell the assistant about your health, that is special category data under Article 9 of the GDPR, and it gets stricter treatment than ordinary information.

Our approach is to collect as little of it as possible. We do not ask you for a medical history, we do not build a health profile about you, and we do not retain your questions after the conversation ends. The lawful basis for processing what you do choose to type is your explicit consent, given when you use the assistant. You can withdraw that at any time by simply not using it, and because nothing is stored there is nothing left behind to delete.

Please do not send us health information by email or through the contact form, because email is not a secure channel and messages sent that way are stored in an ordinary inbox.

Why we process your data, and on what legal basis

• To provide the service you paid for (account, access, billing). Basis: performance of a contract.
• To answer your questions through the assistant. Basis: your explicit consent, as described above.
• To keep the site secure and working. Basis: our legitimate interests in running a functioning service.
• To reply when you contact us. Basis: your consent, or our legitimate interest in responding.
• To meet accounting and tax obligations. Basis: legal obligation.

Who else is involved

We use a small number of providers who process data on our behalf, under contract:

• Hosting. Our hosting provider stores the website and its database.
• AI processing. Questions you type into the assistant are sent to our AI provider to generate an answer.
• Payments. Our payment provider handles card details and billing directly.
• Email delivery. Used to send account and service messages.

We do not sell your data. We do not share it with advertisers. Nobody buys access to our subscriber list.

Transfers outside the EEA

Some of our providers operate outside the European Economic Area. Where that happens, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard. You can ask us which providers are involved and we will tell you.

How long we keep things

• Assistant conversations: not kept at all.
• Account details: for as long as your account exists, and then up to twelve months in case you come back.
• Billing and invoices: for as long as tax law requires us to keep them.
• Contact messages: up to two years.
• Server logs: a short rolling period, typically weeks.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the data we hold about you;
• correct anything that is wrong;
• delete your data;
• restrict or object to how we use it;
• send your data to you or another provider in a portable format;
• withdraw a consent you previously gave.

Ask at hello@rootwauseai.com. We will respond within one month. There is no charge.

If you think we have handled your data badly, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the authority in the country where you live. We would rather you told us first so we can put it right, but that is your choice, not a requirement.

Cookies

We use the cookies WordPress needs to keep you logged in and to remember your session. We do not use advertising cookies or third party tracking pixels. If that changes, this page changes first and we will ask for your consent.

Children

This service is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has registered, tell us and we will remove the account.

Changes to this policy

If we change anything meaningful we will update the date at the top and, for significant changes, tell account holders by email.