Privacy policy

DirectOS (directos.dev, app.directos.dev, api.directos.dev) is operated by Denys Soloviov, Poland, who is the data controller for the data described here. Questions and requests: bezposrednik.app@gmail.com.

directos.dev sets no cookies and runs no analytics, advertising or tracking scripts. Fonts are served from our own host, not from a third party. Your light/dark theme choice is kept in your browser’s local storage and never leaves your device.

Like any web host, our hosting provider processes your IP address to deliver the pages and protect the service.

Accounts are created by a workspace admin. For each account we store the email address, an optional name, the role, and the time of the last sign-in. Passwords are stored only as a salted scrypt hash; session tokens and API keys only as hashes. Signing in keeps a session token in your browser’s local storage — that is what keeps you signed in, and it is not a tracking cookie.

Security-relevant actions (such as changes to users, API keys and credentials) are recorded in an audit log with the account, the action and the time.

The public demo is a shared, read-only account. Everything it shows is sample data.

We store the content you create or send so the service can work: workflow definitions, run inputs and outputs, agent runs, memory items, documents you add to knowledge bases, and credentials for connected services (encrypted with AES-256-GCM; no endpoint ever returns them decrypted).

When a workflow, agent or gateway call uses an AI model, the relevant text is sent to the model provider listed below to produce the answer.

For the LLM gateway we log metadata only — project, requested and served model, token counts, cost, latency and status. Prompt and response content is not stored.

The DirectOS application itself does not log IP addresses. Our infrastructure providers may process them in their own logs to operate and secure their platforms.

• Providing the service you or your organization signed up for — accounts, workflows, runs, the gateway (GDPR Art. 6(1)(b), contract).
• Keeping it secure — password hashing, the audit log, abuse prevention (Art. 6(1)(f), legitimate interests).
• Legal obligations, where they apply (Art. 6(1)(c)).

Some of these companies are based in the United States. Transfers outside the EEA rely on the safeguards those providers offer, such as the EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework. Under their API terms, Anthropic and OpenAI do not use API data to train their models by default.

Donations are handled by Ko-fi under its own privacy policy; we only see what Ko-fi shares with us.

We do not sell personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

• Account data — while the account exists, and deleted within 30 days of a request.
• Workflows, runs, agent runs, documents and gateway metadata — until you delete them or ask us to.
• Memory items — until deleted, or earlier if they were stored with an expiry.
• Database backups at our provider may keep copies for a limited period.

You can ask for access to your data, its correction or deletion, restriction of processing, a portable copy, or object to processing based on legitimate interests. Email bezposrednik.app@gmail.com — we reply within one month.

You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or to the authority in your own EU country.

When you run your own customers’ or users’ data through workflows, agents or the gateway, you are the controller of that data and DirectOS acts as your processor. A data processing agreement is available on request.

DirectOS is not directed at children under 16. If this policy changes, the date at the top of this page changes with it.