Privacy Policy

Who we are

Gully Labs LLC (Oregon, USA) runs GullyAI and is responsible for the personal data it handles. Questions or requests about your data: [email protected].

Your prompts and answers

• We do not store prompts or answers on our servers. What you send (text, files, screenshots, images and voice notes) goes through our gateway to the model, the answer comes back to you, and neither is written to our database or logs. Generated images are returned to you and not stored.
• Your chat history stays in your browser. The web app keeps your chats, projects and images in your browser’s storage (IndexedDB), per account. Clearing your browser data deletes them; we cannot restore them.
• We do not train on your data. We do not use your prompts, files or outputs to train or fine-tune models.
• Where it is processed. The model runs on serverless GPUs we rent from a GPU provider (RunPod or Modal), so your request passes through that provider’s servers to reach our model worker.

What we keep and why

• Account. Your Gully ID account identifier and name, to link your keys and credits to you. The Gully ID token is not stored.
• API keys. A SHA-256 hash of each key (never the key itself), its first characters so you can recognise it, its name and limits.
• Usage. For each API call: time, key, route, status, token counts, duration, request size and a short error code, never the content. We use it for billing, limits and debugging, and delete it after 30 days. Daily totals per key are kept for your usage charts.
• Credits. Your credit ledger (purchases, usage charges, grants and refunds) and the Gully Pay checkout sessions you started, to keep your balance right.
• x402. A hash of each payment receipt, the paying address, the amount and the token counts, so a receipt can be used only once.
• Ask Gully AI. Your IP address (or Gully ID token, if you are signed in) is used to count free answers per day; the question itself is not stored.
• Linked chat accounts. If you link a Telegram or Discord account to your GullyAI account, we keep that platform’s user id with your account; link codes are kept as hashes for 10 minutes.
• Requests. Like any web server, ours receive your IP address and browser user agent with each request, to deliver it, apply rate limits and keep the service secure.

Cookies and browser storage

• Signing in sets one session cookie for the account API (HttpOnly, Secure, SameSite=Strict, path /console) holding a random session id.
• The web app keeps your chat history, projects, images and, if you choose to save it, your API key in your browser’s IndexedDB. They never leave your browser except when you send a message.
• We use no advertising or tracking cookies.

Who else processes data

We do not sell personal data or share it for advertising. These providers process some of it to run GullyAI:

• Cloudflare carries all traffic to gullyai.xyz and api.gullyai.xyz (DNS, CDN, TLS and security), so it sees your IP address and requests.
• OVHcloud hosts the server that runs the gateway, the database and the sites.
• Our GPU provider (RunPod or Modal) runs the model worker that processes your requests.
• Gully ID signs you in (privacy policy), and Gully Pay handles checkout and x402 payments (privacy policy); card details go to Gully Pay’s checkout, never to GullyAI.
• Google Fonts serves the fonts of our sites, so Google sees your IP address when your browser loads them.

We may disclose data when the law requires it, to protect our users or services from fraud or abuse, or to a buyer if Gully Labs is sold, under this policy.

How long we keep it

Per-call usage records are deleted after 30 days. Your account, hashed keys, credit ledger and daily usage totals are kept while your account exists, and records of payments as long as the law requires. Server logs are kept only as long as needed to run and secure the service, then deleted or overwritten.

Your rights

Wherever you live, you can ask us at [email protected] to see, correct, export or delete the personal data we hold about you, or to stop using it. You can revoke keys yourself on gullyai.xyz/developers. Depending on where you live (for example under the GDPR in the EU or UK, or state laws in the US such as California’s), you may have further rights, including to object, to restrict processing and to complain to your data protection authority. Payment records we must keep by law, and data on a public blockchain (x402 payments), cannot be deleted.

Security, location and children

Traffic is encrypted with TLS, keys are stored only as hashes, and account changes need a CSRF token from our own site. Our servers are rented from OVHcloud; Cloudflare and the GPU provider process data in other countries too. GullyAI is not meant for anyone under 18, and we do not knowingly collect data from children.

Changes and contact

When we change this policy we update the date at the top, and for a material change we say so on gullyai.xyz before it takes effect. Gully Labs LLC, Oregon, USA. Questions, requests or complaints: [email protected].