Privacy Policy
Last Updated: December 23, 2025
Ddosify Inc., doing business as Gurubase ("Gurubase," "we," "us," or "our"), is committed to protecting your privacy and ensuring transparency in our data practices. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our AI-powered knowledge assistant platform and related services (collectively, the "Services").
1. Data Controller Information
Legal Entity: Ddosify Inc.
Trade Name: Gurubase
Contact Email: contact@gurubase.io
Data Protection Officer: privacy@gurubase.io
Address: 1401 Pennsylvania Ave. Unit 105, Wilmington, Delaware 19806, County of New Castle
2. Information We Collect
2.1 Information You Provide Directly
When you register for an account or use our Services, we collect:
- Account Information: Name, email address, password (encrypted)
- Profile Information: Avatar, bio, preferences, timezone
- Payment Information: Processed through Stripe (we do not store full payment card numbers)
- Content Data: Questions you ask, documents you upload, knowledge bases you create
- Communication Data: Support tickets, feedback, correspondence with our team
2.2 Information Collected Automatically
When you access our Services, we automatically collect:
- Device Information: IP address, browser type, operating system, device identifiers
- Usage Data: Pages visited, features used, click patterns, session duration
- Log Data: Access times, error logs, API calls, performance metrics
- Location Data: Approximate location based on IP address (country/region level)
2.3 AI Processing Data
When you interact with our AI features, we process:
- Input Data: Questions, prompts, and queries you submit
- Context Data: Referenced documents, knowledge base content
- Output Data: AI-generated responses and citations
- Feedback Data: Ratings, corrections, and improvement suggestions
3. Legal Basis for Processing
We process your personal data based on the following legal grounds:
Contract Performance (Article 6(1)(b) GDPR)
To provide our Services, process transactions, and fulfill our agreements with you.
Legitimate Interests (Article 6(1)(f) GDPR)
To improve our Services, ensure security, prevent fraud, and conduct analytics.
Consent (Article 6(1)(a) GDPR)
For marketing communications, cookies, and AI model training (where applicable).
Legal Obligations (Article 6(1)(c) GDPR)
To comply with applicable laws, regulations, and legal processes.
4. How We Use Your Information
Service Delivery
- Provide and maintain the Gurubase platform
- Process and respond to your AI queries
- Create and manage your knowledge bases
- Authenticate and authorize access
Service Improvement
- Analyze usage patterns to enhance features
- Debug and optimize system performance
- Develop new functionalities
- Conduct A/B testing and user research
Communication
- Send service notifications and updates
- Respond to support requests
- Provide security alerts
- Send marketing communications (with consent)
5. AI Services and Automated Processing
5.1 AI Service Providers
We use the following AI services to power our platform:
OpenAI API
- Purpose: Natural language processing and response generation, text embeddings
- Data Retention: Not retained by default
- Training: Your data is NOT used for model training
- Location: Processing in United States
ElevenLabs
- Purpose: Text-to-speech for audio responses
- Data Retention: Not retained by default
- Training: Your data is NOT used for model training
- Location: Processing in United States
VoyageAI
- Purpose: Reranking search results for improved accuracy
- Data Retention: Not retained by default
- Training: Your data is NOT used for model training
- Location: Processing in United States
6. Third-Party Service Providers
We work with trusted third-party providers to deliver our Services. For a complete list of sub-processors, please visit our Sub-Processors page.
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Auth0 | Authentication, SSO | Email, name, profile data | United States |
| Stripe | Payment Processing | Payment info, billing address, email | United States |
| Mailgun | Transactional Emails | Email addresses | United States |
| Sentry | Error Tracking | Error logs, request data, IP addresses | United States |
| Cloudflare | CDN, DNS, Security | Request metadata, IP addresses | Global |
| Microsoft Azure | Infrastructure, Storage | Platform data, uploaded files | United States/EU |
| AWS | Infrastructure, Static Assets | Platform data | United States |
| Plausible Analytics | Website Analytics (gurubase.io) | Aggregated usage data (no personal data) | EU |
| Google Analytics | App Analytics (app.gurubase.io) | Usage data, device info | United States |
| Hotjar | User Analytics (app.gurubase.io) | Session recordings, heatmaps | EU (Ireland) |
| Slack | Customer Support | Support conversations, user inquiries | United States |
| GitHub | Code Repository, Issue Tracking | GitHub profiles, issue content, code | United States |
| Firecrawl | Website Scraping | Public website content | United States |
| Webshare | Proxy Service | Request metadata | United States |
| YouTube Data API | Video Transcript Extraction | Public video content | United States |
7. Cookies and Tracking Technologies
7.1 Types of Cookies We Use
Essential Cookies
Required for authentication, security, and core functionality. Cannot be disabled.
Analytics Cookies
Help us understand usage patterns and improve our Services. Our marketing website (gurubase.io) uses Plausible Analytics, which is privacy-focused and does not use cookies. Our application platform (app.gurubase.io) uses Google Analytics and Hotjar for logged-in users.
Functional Cookies
Remember your preferences and personalization settings.
7.2 Managing Cookies
You can control cookies through:
- Browser settings - Block or delete cookies
- Google Analytics Opt-out (app.gurubase.io) -Install opt-out browser add-on
- Cookie preferences - Manage via our cookie banner on app.gurubase.io
Note: Our marketing website (gurubase.io) uses Plausible Analytics, which is privacy-focused and does not use cookies or require consent.
8. Data Retention
We retain your data for specific periods based on the type:
9. International Data Transfers
Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards through:
- EU-US Data Privacy Framework: For transfers to DPF-certified US companies
- Standard Contractual Clauses: EU Commission-approved contracts for data transfers
- Encryption: Data encrypted in transit and at rest
- Access Controls: Strict authentication and authorization measures
We conduct Transfer Impact Assessments for transfers to countries without adequacy decisions.
10. Your Privacy Rights
10.1 Rights Under GDPR (European Users)
Right to Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure
Request deletion of your data ("right to be forgotten")
Right to Data Portability
Receive your data in a structured, machine-readable format
Right to Object
Object to processing based on legitimate interests
Right to Restrict Processing
Limit how we use your data
10.2 Rights Under CCPA/CPRA (California Users)
Right to Know
Information about data collection and sharing
Right to Delete
Request deletion of personal information
Right to Opt-Out
Opt-out of sale/sharing (we do not sell your data)
Right to Non-Discrimination
Equal service regardless of privacy choices
10.3 Rights Under KVKK (Turkish Users)
Under Turkey's Law on Protection of Personal Data No. 6698 (Kişisel Verilerin Korunması Kanunu - KVKK), you have the following rights under Article 11:
Right to Learn
Learn whether your personal data is being processed
Right to Request Information
Request information about processing activities if your data has been processed
Right to Know Purpose
Learn the purpose of processing and whether data is used in accordance with that purpose
Right to Know Third Parties
Know the third parties to whom your personal data has been transferred domestically or abroad
Right to Rectification
Request correction of incomplete or inaccurate data
Right to Erasure
Request deletion or destruction of personal data under Article 7 conditions
Right to Notification
Request that corrections or deletions be notified to third parties
Right to Object
Object to processing results obtained exclusively through automated systems that produce adverse effects
Right to Compensation
Claim compensation for damages arising from unlawful processing of your data
Turkish Data Protection Authority (KVKK)
If you are not satisfied with our response, you have the right to lodge a complaint with the Turkish Data Protection Authority:
- Website: www.kvkk.gov.tr
- Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No:4, 06520 Balgat-Çankaya/Ankara, Turkey
10.4 Automated Decision-Making Rights (Article 22 GDPR)
Our AI-powered services involve automated processing of your data. You have specific rights regarding automated decision-making:
Right to Human Review
Request human intervention in decisions that significantly affect you and are made solely by automated means
Right to Express Views
Express your point of view and contest automated decisions
Right to Explanation
Obtain meaningful information about the logic involved in automated processing
Important: Our AI services provide informational outputs and do not make legally binding decisions about you. The AI-generated responses are tools to assist your decision-making, not automated decisions that produce legal effects. However, if you believe an automated process has adversely affected you, please contact us at privacy@gurubase.io.
10.5 How to Exercise Your Rights
To exercise any of your privacy rights:
- Email us at privacy@gurubase.io
We will respond to your request within 30 days (GDPR) or 45 days (CCPA). Identity verification may be required.
11. Data Security
We implement comprehensive security measures to protect your data:
In the event of a data breach, we will notify affected users within 72 hours in accordance with GDPR requirements.
12. Children's Privacy
Our Services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly. If you believe we have collected information from a child under 16, please contact us immediately at privacy@gurubase.io.
13. Marketing and Communications
We may send you marketing communications if you have opted in. You can unsubscribe at any time by:
- Clicking the "unsubscribe" link in any marketing email
- Updating your communication preferences in account settings
- Emailing us at contact@gurubase.io
Note: You cannot opt-out of service-related communications (e.g., security alerts, billing notices).
14. Self-Hosted Deployments
For enterprise customers using self-hosted Gurubase deployments:
- Data Controller: You act as the data controller for all data in your deployment
- Limited Processing: We only process data when providing support (with your permission)
- Telemetry: Optional and anonymized usage statistics (can be disabled)
- Updates: Security patches and updates do not access your data
15. California Privacy Rights
California Consumer Privacy Act (CCPA) Disclosure
We do not sell or share your personal information as defined under CCPA. In the past 12 months:
- We have NOT sold personal information to third parties
- We have NOT shared personal information for cross-context behavioral advertising
- We do NOT have actual knowledge of selling or sharing personal information of minors under 16
California residents can make up to 2 free requests per year for information about their data.
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make material changes:
- We will update the "Last Updated" date at the top
- We will notify you via email or prominent notice on our Services
- We may require you to acknowledge the updated policy
Continued use of our Services after changes constitutes acceptance of the updated Privacy Policy.
17. Supervisory Authority
If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority:
- EU Users: Your national data protection authority
- UK Users: Information Commissioner's Office (ICO) - ico.org.uk
- Turkish Users: Kişisel Verileri Koruma Kurumu (KVKK) - kvkk.gov.tr
- California Users: California Privacy Protection Agency (CPPA) - cppa.ca.gov
18. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or our data practices:
Email: contact@gurubase.io
Privacy Requests: privacy@gurubase.io
Data Protection Officer: privacy@gurubase.io
Mailing Address:
Ddosify Inc.
1401 Pennsylvania Ave. Unit 105
Wilmington, Delaware 19806, County of New Castle
United States of America