Privacy Policy

Hall of Mirrors: The Tesseract · Last updated: 18 July 2026

This policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have. It is written to be read, not to be survived. If anything here is unclear, please ask.

1. Who we are

Hall of Mirrors: The Tesseract is operated by Krasimir Stoyanov Kolev, trading as Allistar Center, a self-employed sole trader registered in Cyprus. We are the data controller for the personal data described in this policy.

Contact for any privacy matter, including deletion requests: allistarcenter@gmail.com

2. What we collect

Information you give us

Account details — your email address, and your name if you provide one. If you sign in with Google, we receive your email address and basic profile information from Google.
Your intentions — the question or intention you submit to be run through the Tesseract. This is the most personal data we hold, because people often write about health, relationships, money, work, or other private matters.
Images — if you attach an image to an intention.
Avatar — a profile image, if you upload one.
Contact form messages — your name, email and message if you contact us through the site.

Information generated by using the service

Reports — the brief, the 26 agent outputs, and the final synthesis produced from your intention.
Atoms — individual claims extracted from your reports so you can explore and search your own history.
Embeddings — mathematical representations of your text, used to position reports and find related material.
Mirror balance and transaction records — how many Mirrors you have, and a ledger of purchases and usage.

Information collected automatically

IP address — recorded at signup, when you use the contact form, and when you use the Refraction feature, solely to prevent abuse and fraud.
Technical request data — our hosting provider (Cloudflare) processes standard request information such as IP address and browser type in order to deliver the site securely.

3. Why we process it, and on what legal basis

Purpose	Legal basis
Creating and running your account	Performance of a contract
Generating and storing your reports	Performance of a contract
Processing payments	Performance of a contract; legal obligation (tax records)
Sending service emails (confirmation, password reset)	Performance of a contract
Preventing abuse and fraud (IP records)	Legitimate interests
Responding to your messages	Legitimate interests

We do not use your intentions or reports for anything other than serving you. We do not use them to train AI models, to build products, to generate examples, or for research. We do not sell data. We do not run advertising or behavioural tracking of any kind.

4. Who we share it with

We use a small number of service providers to operate the product. They process data on our behalf, under contract, and may not use it for their own purposes.

Provider	What they receive	Why
Anthropic	Your intention text and any attached image	To generate the report using Claude AI models
Cloudflare	All site traffic; your text for generating embeddings; uploaded images	Hosting, security, AI embeddings, image storage
Supabase	Account details, reports, atoms, balances, avatars	Database, authentication and file storage
Stripe	Your name, email and card details, entered directly on Stripe's own checkout page	Payment processing. We never see or store your card details.
Resend	Your email address and message content	Sending emails
Google	Sign-in data if you use Google sign-in; your IP address when fonts load	Optional sign-in; web fonts

Some of these providers are based outside the European Economic Area, principally in the United States. Where that is the case, transfers are made under the European Commission's Standard Contractual Clauses or an equivalent approved safeguard.

5. How long we keep it

Data	Retention
Account details	Until you delete your account
Intentions, reports, agent outputs, atoms, embeddings	Until you delete your account or ask us to delete specific reports
Images and avatars	Until you delete your account
Payment and Mirror ledger records	Retained as required by Cypriot tax law, currently six years, then deleted
IP records used for abuse prevention	90 days
Contact form messages	Until the matter is resolved and no longer needed

When you delete your account, we delete your reports. Your intentions, reports, agent outputs, atoms and images are removed along with your account. We do not keep an anonymised copy. The only exception is financial records we are legally required to retain for tax purposes, which contain transaction details but not the content of your reports.

6. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy
Have inaccurate data corrected
Have your data deleted
Restrict or object to certain processing
Receive your data in a portable format
Withdraw consent where processing is based on consent

To exercise any of these rights, email allistarcenter@gmail.com. We will respond within one month.

There is currently no button in the interface to delete your account or an individual report. Deletion is handled manually on request, and we do it promptly. If you are ever unsatisfied with how we have handled your data, you have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy).

7. Cookies and local storage

We do not use advertising cookies, analytics cookies, or any behavioural tracking.

Authentication storage — when you sign in, your browser stores a session token locally so you stay signed in. This is strictly necessary for the service to work.
Interface preferences — small settings such as whether a panel is open are stored locally in your browser.
Translation widget — if you use the language selector on the home page, Google sets a cookie recording your chosen language.

8. Security

Data is stored with access controls that restrict each account to its own data. Payments are handled entirely by Stripe; we never receive card details. No system is perfectly secure, but we do not log your intentions, do not expose them to other users, and keep the number of systems that touch them as small as possible.

9. Children

This service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we change this policy in a way that materially affects you, we will notify registered users by email. The date at the top of this page always reflects the current version.