# Tellop Invited Alpha Privacy Notice

**Effective:** 17 October 2026

This notice explains how **Pathnomic Labs FZ-LLC** ("Pathnomic", "we") handles
information in the Tellop desktop application and its supporting online services. The
short notice for tellop.ai covers the company website separately.

- Address: Compass Building - Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, 16111, United Arab Emirates
- Privacy contact: support@pathnomic.com

## 1. Information Tellop handles

| Information | What it includes |
|---|---|
| Account and access | Email address, verification status, declared country/region, age and business/consumer capacity declarations, user, device and session identifiers, authentication cookies on the sign-in service, and protected refresh-token values |
| Legal acceptance | The accepted Terms, provider-policy and privacy-notice version identifiers and hashes, acceptance time, account identifier, email address, displayed language and the declarations listed above |
| AI request content | For Tellop's own work: your instructions and the project context needed to answer them, including records Chat reads from your app’s database, together with the AI response. For AI inside your apps: what the app's code sends, which can include text, pictures and records from the app’s database, including information about other people, together with the AI response |
| Service and metering | Project and task identifiers, work category, selected model/provider, request outcome, token counts, cost, credits and entitlement events; whether a request came from Tellop or from one of your apps, and the app's AI level when the request has one |
| Picture fingerprints | A fingerprint (hash) of each picture the AI drew for you or your apps, kept so that only those pictures can be edited |
| Billing | Customer, invoice, payment and subscription information when paid service is enabled |
| Optional crash reports | Error type, cleaned error message, application-relative stack information, application version, release channel, platform, event/time identifiers and child-process exit details |
| Optional usage measurement | Five fixed events—session start, project created, build started, build finished and export completed—plus time and a random installation identifier |
| Support | Your email address, message, attachments and related correspondence when you ask for help |

Tellop projects remain files on your device. Pathnomic does not upload a complete project
as a cloud backup. Relevant portions may nevertheless be included in an AI request when
needed to perform the task you asked for.

Your apps can also use AI. When an app you made or added asks for AI, the app's own code
decides what it sends, and Tellop carries it to the AI provider as the app asked. This can
include records from the app’s database and anything you or other people put into the app.
Section 3 explains how.

## 2. Why we use it

We use this information to confirm alpha eligibility and record your legal acceptance;
create and secure your account; provide the application and AI
features you request; route work to a suitable model; enforce credits and service limits;
process payments; investigate abuse or faults; answer support requests; meet legal duties;
and protect legal rights.

Where a legal basis is required, these activities rely on performing our agreement or
taking steps you request, our legitimate interests in providing and securing the service,
and applicable legal obligations. Optional crash reporting and optional usage measurement
each rely on your separate consent.

When one of your apps sends information about other people, we process it only to carry
the request to the AI provider, return the answer, meter the request and keep the service
secure. We rely on our legitimate interest in providing the service you asked for, and we
do not use that information for any other purpose.

## 3. AI providers, project context and AI inside your apps

AI requests pass through Pathnomic's proxy. The proxy is designed not to retain prompts,
responses or provider error bodies in application logs, and AI Gateway prompt logging is
disabled. Network and security metadata may still be processed by the infrastructure
provider.

Chat requests that contain records from your app’s database, or a retained history of
database reads, use only current eligible Anthropic or OpenAI routes. This covers the
initial request, descriptions of the database, database reads, the final answer, retries
and resumed conversations, including when database reading is off. Earlier unrelated building work can still use xAI or Nebius.
The table includes those other provider paths too.

| Model family | Provider receiving the request | Standard content handling |
|---|---|---|
| OpenAI | OpenAI API | Pathnomic’s founder attested on 13 October 2026 that the account has Zero Data Retention enabled. This applies to eligible requests, subject to feature, safety and legal exceptions; not used for model training by default |
| Anthropic | Anthropic API | Pathnomic’s founder attested on 13 October 2026 that the account has Zero Data Retention enabled. This applies to eligible requests, subject to feature, usage-policy and legal exceptions; not used for model training by default |
| xAI | xAI API | User content is ordinarily deleted no later than 30 days after the interaction, subject to safety, security, compliance and legal exceptions; not used to train foundation models under the enterprise terms |
| DeepSeek models | Nebius Token Factory—not DeepSeek's first-party API | EU processing is pinned and Nebius Zero Data Retention is enabled; prompts and responses are not stored after the request or used for training |
| Moonshot models | Nebius Token Factory—not Moonshot's first-party API | EU processing is pinned and Nebius Zero Data Retention is enabled; prompts and responses are not stored after the request or used for training |

The dated account statement above is a founder attestation, not a live account check.
Zero Data Retention does not mean that no data can ever be stored. Eligibility depends
on the request and feature. Provider safety reviews, legal duties and some temporary
processing or caching can have exceptions.

**Chat and your app’s database.** Chat can read your app’s database to answer your requests.
The permission is on by default for each project. You can turn it off or on in that
project’s Permissions. Tellop does not ask for a separate approval before each read.
Before Chat changes your app’s database, Tellop asks for a separate one-press approval.

Read results can contain exact values, including ordinary tax numbers, identity details,
financial-account details and information about your clients or other people. These
values can be sent to the AI provider. Tellop hides the actual values stored in your
app’s Keys before sending read results. It does not hide ordinary personal or account
information merely because it is sensitive. Turn reading off if you do not want Chat
to read your app’s database. This does not remove values already in a conversation.

Tellop’s service keeps no copy of what Chat reads from the database. Read values remain in the local
conversation until you erase it and can be sent again when that conversation continues.
Turning reading off prevents new reads. It does not remove earlier conversation values.

Local recovery copies keep the exact values needed to undo database changes. The Database
page shows the latest 50 successfully saved change sets with a reliable order. A newer
successful set can displace the oldest eligible set and remove both recovery copies.
There is no fixed number of days. Unresolved outcomes and older sets without a reliable
order remain preserved. Tellop may refuse a new change when this preserved information
reaches its storage limit. Recovery values never go to the AI or into diagnostic reports.

Erasing a conversation removes its request words and all conversation and message links
from every recovery copy. Later updates cannot restore those links. The recovery values
remain until the retention rule above permits removal or you delete the project and its
data. Local markers made from hashes contain no conversation content. They keep resumed
conversations on the required provider route after erasure and remain until project
deletion. What your app’s own database holds remains until you change it or delete its data.

Pathnomic has requested xAI Zero Data Retention; it is not active unless we tell you that
approval has been received. Until then, Tellop applies data minimization, secret-detection
controls and an advance disclosure that selected project context is sent to external AI
providers.

**AI inside your apps.** Apps you make or add in Tellop can use AI: to write or read text,
understand pictures, and make and edit pictures. The app's own code, not Tellop, decides
what each request contains. A request can include anything the app holds, including records
from its database and information you or other people put into the app. Tellop asks you before an
app's first AI request, lets you pause AI for any app, and pauses an app's AI by itself
when the app asks for it far more often than it usually does.

Requests from your apps pass through Pathnomic's proxy and go only to the providers in the
table above, under the content handling the table states. Making and editing pictures uses
OpenAI. Requests from your apps are not sent to xAI until we tell you that xAI Zero Data
Retention is active. The proxy returns the answer or the picture to the app and keeps no
copy of the request or the answer; the app keeps what it saves on your device. Each
request uses your allowance. You can move each app's AI level up or down; you never choose
a model.

Only share records, client data, another person’s personal data or project material
when you have the lawful right to do so. You are responsible for the required lawful
basis, permissions and notices, including telling those people where the law requires it.
Ordinary database reading does not permit high-risk or regulated systems or fully automated
consequential decisions prohibited by the Terms. The alpha is not for health, biometric
or other regulated sensitive workloads. Review what your project contains before asking
Tellop to send context, and know what an app sends before you allow its AI.

Provider terms and retention practices can change. We review them and update this notice
or disable a route when a material change would make this description inaccurate.

## 4. Optional crash and usage measurement

Both controls are **off by default**. They have separate settings and separate consent;
turning on one does not turn on the other. No reporting client is created before the
corresponding choice is enabled. You can withdraw either choice for future collection.

- Crash reports go to **Sentry** and are configured for **90-day retention**. Sentry can
  receive the source IP used to submit the report.
- Usage measurement goes to **Aptabase Cloud's EU service** and may be retained for
  **up to five years**, or until the Aptabase app or account is deleted. Aptabase
  receives the random installation identifier and may derive general location
  information from the source IP. It may also derive a temporary identifier, which
  changes every 24 hours, from the source IP and Tellop's fixed application label.

Usage measurement contains only the five events listed in section 1. It does not contain
your prompt, project content or generated work. Resetting usage measurement removes the
installation identifier from the device and creates a new one only if measurement remains
enabled.

## 5. Recipients and international processing

Information may be processed by:

- Cloudflare, for application, authentication, proxy, security and AI Gateway infrastructure;
- OpenAI, Anthropic and xAI, for the AI requests routed to them;
- Nebius B.V., for EU-hosted DeepSeek and Moonshot model inference with ZDR enabled;
- Sentry, for error reports from Pathnomic's online services, which are designed to carry
  no request content and no personal details, and for the separately enabled optional
  crash reports;
- Aptabase, only for the separately enabled optional usage measurement;
- Polar and associated payment providers, when billing is used;
- email-delivery and support providers; and
- authorities, auditors and advisers where required for a legal duty or legal right.

Pathnomic is established in the UAE and uses providers in the EU, United States and other
locations. Information may therefore be processed outside your country under the
contractual and security measures applicable to each service.

## 6. Retention

| Information | Retention approach |
|---|---|
| Pathnomic AI-proxy content | Prompts and responses are not retained in application logs, including requests from your apps and the pictures returned to them; downstream provider periods are stated in section 3 |
| Local Chat conversations and recovery copies | Read values remain until conversation erasure. Recovery values follow the latest-50 successful, reliably ordered set rule above; unresolved or unordered information is preserved. Erasure removes all request/conversation/message links from every copy. Content-free hashed routing markers remain until project deletion |
| Account and access | While the account is active and for up to 90 days after closure for deletion processing and security investigation |
| Picture fingerprints | While the account is active and for up to 90 days after closure, then deleted with the account |
| Routing records (which provider and model serve each project, and each task in progress) | Up to 90 days after each is made; after an account closes they lapse within 90 days |
| Legal acceptance evidence | While the alpha relationship is active and for up to five years afterward to establish, exercise or defend contractual and legal claims |
| Metering, entitlement, invoice and payment records supporting UAE tax or accounting obligations | Up to seven years after the end of the relevant tax period |
| Sentry error reports (from Pathnomic's online services, and the optional crash reports) | 90 days |
| Optional Aptabase usage measurement | Up to five years; earlier if the Aptabase app or account is deleted |
| Support correspondence | No more than 12 months after the request is resolved |

Relevant information may be kept longer only where required by law, fraud prevention, an
audit, an active dispute or another legal hold. When an exception ends, the information is
deleted, de-identified or anonymized as appropriate.

## 7. Your choices and requests

You can leave both optional measurements off, enable either separately, or withdraw either
choice for future collection. You may ask Pathnomic to provide information about your
personal data, correct it, delete it, restrict or object to processing where applicable,
or provide a portable copy where required by law.

Send requests to support@pathnomic.com from the email associated with your account. We
may take proportionate steps to verify your identity. Deleting an account does not require
deletion of records that Pathnomic must retain for tax, fraud, security or legal claims.

A person whose information one of your apps sent may also contact us at
support@pathnomic.com. The proxy keeps no copy of app requests, so beyond the provider
periods in section 3 we usually hold nothing about that person; the app's database stays on
your device, under your control.

## 8. Alpha limits, children and changes

The invited alpha is for people aged 18 or older. It is not intended for children or for
regulated workloads. AI output may be inaccurate; review it before relying on it.

We will update this notice before making a material change to the information collected,
its purpose, a provider route or an optional measurement. For a material change that
requires consent, we will ask again rather than treating continued use as consent.