Privacy Policy

Effective Date: 14 October 2026

DataSense AI ("we," "us," "our," or "Company") is operated by TopN Analytics. This Privacy Policy explains what information DataSense AI actually collects, how it is used and stored, which third-party services are involved, and the choices and rights you have regarding your data. It is written to match how the application is actually built, not a generic template.

1. Introduction

DataSense AI is a data-analysis application that helps users analyze structured business data (spreadsheets, a demo database, and optional reference documents) using deterministic calculations and AI-assisted interpretation. This Privacy Policy covers account registration and sign-in (including Google, GitHub, and Microsoft sign-in), file uploads, AI/LLM processing, dashboards and chat history, usage analytics, and the "Contact TopN Analytics" enquiry form.

"Personal data" means any information that identifies or could identify you.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration: full name, email address, and password (if you sign up with email/password).
• Google or GitHub sign-in: the basic profile information described in Section 4.
• Profile preferences: your display name and your chosen preset avatar (one of five built-in options; there is no photo/image upload).
• Data you upload for analysis: CSV and Excel files.
• Knowledge Base documents: PDF, TXT, Markdown, or CSV files you add to the in-app Knowledge Base.
• Chat messages: the questions you type and the application's responses.
• Corrections/feedback: any correction you give when an analysis result is wrong (e.g., "use column X instead").
• Contact form submissions: name, email, company (optional), and message, submitted through the "Contact TopN Analytics" form.

2.2 Information Collected Automatically

• Feature usage events: which features you open and when, tied to your account ID, used for the in-app usage analytics and admin dashboard.
• Standard web/connection information: information inherent to any web request (e.g., IP address at the network/hosting level). DataSense AI's own code does not separately log or store this.

2.3 Cookies and Session Storage

DataSense AI is built with Streamlit. Your browser maintains a connection to the application using Streamlit's own session/connection mechanism; your signed-in state and in-progress work (uploaded data, chat, dashboard edits) are held in that server-side session for the duration of your visit. DataSense AI's own code does not set advertising, tracking, or analytics cookies, and does not read or write browser localStorage.

3. Account Registration and Login

When you create an account or sign in with email and password:

• Email address: used for account creation, authentication, and password recovery.
• Full name: stored in your profile and in Supabase Auth's user metadata.
• Password: never stored or seen by DataSense AI in plain text. Password hashing, storage, and verification are handled entirely by Supabase Auth.
• Account creation timestamp: recorded automatically by Supabase.

Your account and profile data is stored in Supabase (see Section 7), which encrypts data in transit (HTTPS/TLS) and at rest.

4. Signing In with Google, GitHub, or Microsoft

In addition to email and password, DataSense AI lets you sign in using Google, GitHub, or Microsoft through the OAuth 2.0 protocol, via our authentication provider, Supabase Auth.

4.1 Google User Data: What We Request and Receive

When you choose "Continue with Google," DataSense AI requests only the basic Google account/profile information needed for authentication and account identification: - Name — used to identify your account in DataSense AI. - Email address — used to create, identify, and maintain your DataSense AI account. - Google account identifier — used to associate your Google sign-in with your DataSense AI account and recognize you on return visits.

DataSense AI does not request access to your Google Drive files, Gmail, contacts, calendar, Photos, Ads, or any other Google service.

4.2 GitHub User Data

When you sign in with GitHub, DataSense AI receives the basic account/profile information GitHub makes available for sign-in — typically your name, email address, and GitHub account identifier — used only for authentication and to associate your GitHub account with your DataSense AI account. DataSense AI does not request access to your repositories, organizations, or any other GitHub data.

4.3 Microsoft User Data

When you sign in with Microsoft, DataSense AI requests only your email address (and the basic profile information, such as your name, that Microsoft includes with it) through its OAuth sign-in flow — used only for authentication and to associate your Microsoft account with your DataSense AI account. DataSense AI does not request access to your Outlook mail, OneDrive files, Teams, calendar, or any other Microsoft 365 data.

4.4 How This Data Is Used, Stored, and Shared

Google, GitHub, and Microsoft account data received through OAuth is used only to: - Create and authenticate your DataSense AI account; - Identify your account when you sign in; - Maintain your user profile and authentication session.

This information is stored in the same Supabase-backed account record used for email/password accounts (Section 3). DataSense AI never receives or stores your Google, GitHub, or Microsoft password. We do not sell this data or use it for advertising, and it is not shared with third parties except Supabase, which processes it on our behalf as our authentication infrastructure provider (Section 7).

4.5 Revoking Access

You can revoke DataSense AI's access to your Google, GitHub, or Microsoft account at any time from that provider's own account/security settings. Revoking OAuth access does not by itself delete your DataSense AI account or data; to request deletion, contact us as described in Section 15.

DataSense AI's handling of information received from Google's APIs is intended to comply with the Google API Services User Data Policy, including its Limited Use requirements. Use of information received from Google, GitHub, and Microsoft is also subject to each provider's own developer/API terms and privacy policies.

5. Uploaded Files, Datasets, and the Knowledge Base

5.1 CSV/Excel Datasets

Uploaded spreadsheet data is processed in the application's memory to power analysis, charts, and insights. If you are signed in and DataSense AI's optional database persistence is configured for the deployment you are using: - Dataset metadata (a display name, a fingerprint/hash of the file's contents, row and column counts, and file size) is saved to a datasets table in Supabase, scoped to your account. - The uploaded file itself may be stored in a private, per-user folder in Supabase Storage (bucket user-datasets), so a saved dashboard can reopen the same file later. Database-level access rules (Row Level Security) restrict this folder to your own account; no other user's client can read, overwrite, or delete it.

If persistence is not configured for a given deployment, or you are not signed in, uploaded files are processed only in memory for that session and are not written to any database or storage bucket.

5.2 Knowledge Base Documents

Documents you add to the Knowledge Base (PDF, TXT, Markdown, CSV) are indexed only within your current session, using either a local TF-IDF index or, where a local Ollama instance is configured, local embeddings. They are not saved to Supabase or any other persistent store, and are cleared when your session ends or when you click "Clear."

5.3 Demo Database

DataSense AI also offers an optional, shared, read-only demo dataset stored in our Supabase Postgres database. It contains sample business data only — it is not user-specific and contains no data you uploaded.

6. AI/LLM Processing

DataSense AI uses Ollama to run the AI model that interprets your questions and plans calculations. Depending on how a given deployment is configured, this model runs either: - Locally — on the machine or server running DataSense AI, with no data leaving that environment; or - Via Ollama Cloud — a hosted model run by Ollama, if the deployment is configured with an Ollama Cloud host and API key.

What is sent to the model: your typed question/chat text, your uploaded dataset's column names and data types (not the underlying row data), and, where relevant, context about your previous question in the same conversation. Raw spreadsheet row data is not included in these prompts.

We do not use any other third-party AI provider (for example, OpenAI or Anthropic) in this application. We do not use your data to train our own AI models, and we do not control or operate Ollama Cloud's infrastructure — if a deployment uses Ollama Cloud, that processing is also subject to Ollama's own terms and privacy policy.

6.1 Correction Feedback

If you tell DataSense AI that an analysis result was wrong (e.g., "use column X instead"), that correction is saved to a local database file on the server, keyed to the structure (schema) of the dataset involved, not to your personal account. This means a correction may be reused on a future analysis of a differently-named but same-structure dataset, including one uploaded by a different user of the same deployment. This feedback store does not contain your name, email, or account ID, and is retained indefinitely to improve future analyses unless manually cleared by an administrator.

7. Data Storage and Third-Party Processors

7.1 Supabase

Supabase is our authentication, database, and file-storage provider. It stores: account/profile records, OAuth-derived profile data, dataset metadata and (optionally) uploaded files, saved dashboards, chat conversations and messages, usage events, and contact-form enquiries. Supabase operates under its own privacy policy (https://supabase.com/privacy) and processes this data on our behalf. Database access is restricted by Row Level Security so that, in normal operation, a signed-in user's application requests can only reach that user's own rows and storage folder.

7.2 Resend

When you submit the "Contact TopN Analytics" form, we use Resend, an email-delivery service, to send a best-effort notification email to our team. Only the four form fields (name, email, company, message) plus the page you submitted from and, if you were signed in, your account email are included — never your dataset contents, chat history, or other uploaded data. The enquiry is saved to Supabase regardless of whether this email succeeds.

7.3 Ollama / Ollama Cloud

See Section 6. Depending on deployment configuration, your question text and dataset schema (not row data) may be sent to a locally-run or Ollama-hosted model.

We do not sell, rent, or trade your personal data, and we do not use it for advertising.

8. How We Use Information

• Service delivery: operating DataSense AI's features for you.
• Authentication: verifying your identity and maintaining your account, including processing basic profile information received via Google or GitHub OAuth.
• Data analysis: processing the data you upload to generate calculations, charts, and AI-assisted insights, as described in Sections 5–6.
• Saving your work: persisting dashboards, datasets, and chat history to your account when persistence is configured and you are signed in.
• Product usage analytics: recording which features you use and when, visible to allow-listed administrators via an in-app Admin Dashboard.
• Communication: responding to enquiries you submit through the contact form.
• Security: detecting and preventing unauthorized access.
• Compliance: meeting legal and regulatory obligations.

9. Cookies and Session Data (Detail)

DataSense AI's own code does not set tracking, advertising, or analytics cookies, and does not use browser localStorage. The application relies on: - Streamlit's session/connection mechanism, which keeps your browser connected to your running application session. - Supabase Auth session tokens, used to keep you signed in and to scope your data access.

Clearing your browser's cookies/site data, or closing the browser tab on some deployments, may end your session and require you to sign in again. Signing out (see Section 11) clears all in-memory session data immediately.

10. Data Retention

• Account/profile data: retained while your account exists.
• Dataset metadata and uploaded files (where persistence is configured): retained until you delete the underlying dashboard that references them (see below) or until your account is deleted. There is currently no in-app control to delete an individual dataset or its stored file on its own.
• Dashboards: you can delete a saved dashboard yourself from within the application at any time.
• Conversations and chat messages: retained indefinitely once saved; there is currently no in-app control to delete a saved conversation. (The "Recent" sidebar only displays conversations updated in the last 15 days — older conversations are not deleted, only hidden from that list.)
• Usage events: retained indefinitely; we do not currently apply an automatic expiry period to this data.
• Correction feedback: retained indefinitely, as described in Section 6.1.
• Knowledge Base documents and in-session analysis state: cleared when your session ends or when you explicitly clear them.
• Contact enquiries: retained in Supabase; there is currently no self-service way to view, edit, or delete a submitted enquiry.

11. Signing Out and Account/Data Deletion

Signing out immediately clears all in-memory session data (uploaded files, chat state, Knowledge Base index) from that session. It does not delete anything already saved to your account in Supabase (dashboards, datasets, chat history).

Deleting individual data: at present, the only data you can delete yourself from within the application is a saved dashboard. Deleting datasets, chat history, or your account is not currently self-service.

Account deletion: to request deletion of your account and the associated data described in this policy, contact us at the email in Section 15. We will act on verified deletion requests as described there. Please note this is a manual process handled by our team, not an automated in-app flow.

12. Data Security

• Data in transit is protected with HTTPS/TLS.
• Supabase stores account, dataset, dashboard, and chat data with encryption at rest.
• Passwords are hashed and verified by Supabase Auth; DataSense AI never sees or stores plain-text passwords.
• Database access is scoped by Row Level Security to the authenticated user.
• Server-side-only credentials (such as the Supabase secret key used for usage analytics and admin tooling) are never exposed to your browser.

No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for signing out on shared devices.

13. User Rights

Depending on your location, you may have rights to access, correct, or request deletion of your personal data, request a copy of it, or withdraw consent where we rely on it. To exercise any of these rights, contact us at info@topnanalytics.com. Because some data described in this policy (e.g., schema-keyed correction feedback) is not linked to your account identity, we may not be able to locate or isolate it as "yours" on request.

14. Children's Privacy

DataSense AI is not intended for users under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have done so, we will delete it. If you believe a child's data has been collected, contact us at info@topnanalytics.com.

15. Contact Information and Deletion Requests

For privacy questions, data-rights requests, or to request deletion of your account and associated data, contact:

Email: info@topnanalytics.com

Company: TopN Analytics

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will update the "Effective Date" above and post the revised policy in the application. Continuing to use DataSense AI after a change constitutes acceptance of the updated policy.

Thank you for trusting DataSense AI with your data.