Short version: Locally runs on your computer. Your business data, AI conversations and app keys stay there. We only receive what we need to sell you Locally and check your license.
1. Who is responsible
Aion B.V., Havenpark 4F, 4301 CD Zierikzee, the Netherlands, KVK 98223704, is the "controller" for the personal data described in this policy. Contact: info@locallyai.nl.
2. What we do NOT receive
Locally is built so that we never get:
- your business data, files, customers, orders or emails;
- your prompts, agent drafts or AI conversations;
- your ChatGPT, Claude or business-app passwords and API keys (these are stored encrypted on your computer);
- your payment card details (Whop handles payments).
Data you send through Locally to OpenAI, Anthropic, your webshop or other apps goes directly from your computer to them, under your own account with them. Their privacy policies apply.
3. Your role: you control your business data
When you use Locally to work with your customers' personal data, you are the controller of that data under the GDPR. We are not involved in that processing (except during a Done-for-you session, see section 9).
4. What we process, why, and for how long
| Data | Why | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|
| Order data from Whop: name, email, country, plan bought, price, order date, payment status, VAT ID (if given) | To deliver your purchase, invoices/tax, support, refunds | Contract (6(1)(b)); legal obligation (6(1)(c)) for tax records | 7 years (Dutch tax retention duty) |
| License data: license key, a hashed machine ID (not your device name or serial), product/kit, activation and refresh dates, update-period end date, revoked/refunded status | To activate your license on one computer, check it weekly, stop key sharing | Contract (6(1)(b)); legitimate interest in preventing misuse (6(1)(f)) | While your license is active + 12 months |
| Consent record: that you ticked the "start delivery now" consent, the date/time and the text version | To prove we followed EU consumer law | Legal obligation (6(1)(c)); legitimate interest (6(1)(f)) | 2 years after purchase |
| Technical request data: IP address and timestamp when the app contacts our license server | Security and keeping the server working | Legitimate interest (6(1)(f)) | Short-lived logs at our hosting provider (Cloudflare), not used to identify you |
| Support and calls: your emails, booking details, notes from setup / help calls | To help you and handle refund requests | Contract (6(1)(b)) | 2 years after the last contact |
| Anonymous usage stats (if enabled): a random install ID, app version, operating system, and simple events like "app started" or "agent started" | To understand which features are used and improve Locally | Legitimate interest (6(1)(f)) | 24 months |
We don't sell your data, don't use it for advertising, and don't make automated decisions about you.
5. Usage stats and cookies
- The app: current versions of Locally send no usage statistics at all. If we ever add them, they stay off until you switch them on yourself.
- This website: no tracking, analytics, advertising or session-recording tools, no tracking cookies, and no fonts or scripts loaded from third parties (fonts are hosted on our own site). Our host only sets one strictly necessary security cookie (
__cf_bm, bot protection, about 30 minutes). Checkout happens on Whop, under Whop's own privacy and cookie policy.
6. Who helps us (recipients)
| Who | What for | Where |
|---|---|---|
| Whop, Inc. | Checkout, payment, license keys, refunds. Whop is its own controller for payment data; see Whop's privacy policy. | USA |
| Whop, Inc. (hosting) | Hosts this website and our license server (activation checks) | USA |
| GitHub, Inc. | Hosts app downloads and update files — your app contacts it when checking for updates | USA |
| Microsoft (Microsoft 365) | Our email | EU / USA |
| Zoom Video Communications, Inc. | Holding setup calls and Done-for-you sessions | USA |
| Accountant / tax authorities | Bookkeeping and legal obligations | Netherlands |
7. Transfers outside the EU
Some providers are in the USA. We use providers certified under the EU-US Data Privacy Framework or covered by the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards.
8. Security
License data is stored minimally (the machine ID is hashed), connections use HTTPS, and the license token on your computer is digitally signed so it can't be faked. Your app keys never leave your computer.
9. Done-for-you and setup sessions (Data Processing Terms)
During a setup call or Done-for-you session we may see your screen or use remote access that you start. If we can see personal data of your customers at that time, we act as your processor under these terms:
- we only act on your instructions and only to install and configure Locally;
- we don't copy, keep or use any of your data after the session;
- everyone helping in the session is bound to confidentiality;
- we use only the session tool named above as sub-processor;
- we tell you without undue delay about any data breach we become aware of;
- we help you with data-subject requests where relevant, and you may ask us for information to check we keep these promises.
These terms are meant to meet GDPR art. 28. If your business needs a separate signed agreement, email info@locallyai.nl.
10. Your rights
You can ask us to access, correct, delete, or export your data, to restrict its use, or object to processing based on legitimate interest. Email info@locallyai.nl; we reply within one month. Note: we must keep tax records for 7 years, and deleting license data ends your license.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own EU country.
11. Children
Locally is for businesses and adults (18+). It is not directed at children, and we don't knowingly sell to or collect data from anyone under 16.
12. Changes
We'll update this page if anything changes and show the date at the top. Big changes are announced in the app or by email.
13. Contact
Aion B.V. · Havenpark 4F, 4301 CD Zierikzee · info@locallyai.nl
