Your documents are read by AI models running on hardware we own, in a location we control. They are never sent to external AI models. The server you talk to is a doorway that holds no key and stores nothing. When a question genuinely requires the outside world, what goes out has your identity stripped from it first. When a page cannot be read locally, we ask your permission before it goes anywhere — that page, that time. Everything that has ever left is written down and you can read the list.
The two halves
The doorway
The bot runs on a rented server. It receives your message, encrypts any file immediately with a key that exists only on our own machine, and holds it briefly until it is collected. It has no decryption key, no copy of your register and no history. If that machine were seized tomorrow, what it holds would be unreadable.
The house
Everything that reads, understands and remembers runs on hardware we own: the models, the database, the vault of original documents. The connection between the two is opened from our side outwards and never from the internet inwards. There is no port to knock on.
The three classes of information
Everything in the system belongs to one of three classes, and the class decides where it may go.
Public
Airports, published programme terms, opening hours, statutory rules
Anywhere. None of it is about you
Profile without identity
“Holds a World Elite card issued in Georgia”, “has travel cover valid in the EU”
Only the specific items on a permitted list
You
Name, address, telephone, e-mail, card numbers, passport, policy and membership numbers, booking references, medical information — and every original document
Never leaves
The rule is a permitted list, not a forbidden one. Anything not explicitly allowed out is removed by default, which means a new kind of information cannot escape simply because nobody thought to forbid it.
What happens before anything is asked outside
Some questions require the world: whether a lounge is open this evening, which terminal an airline uses this month, whether a programme changed its terms.
Before such a question leaves, identity is replaced with placeholders. You become USER_001. A card becomes CARD_03. A policy becomes POLICY_07. The question that goes out is of the form “a World Elite card issued in Georgia, departing from this airport at this time — what applies?”, and the real values are restored only back inside the house.
Every external request passes through a single component. No other part of the system is able to make one — not as a matter of policy, but because the capability does not exist anywhere else in the code.
When we ask you first
Local models are good but not universal. A dim photograph of a dense contract, an unusual layout, a language the model reads poorly — occasionally a page defeats it.
When that happens, you are asked:
Three things about that question. It is asked for one page at a time. Declining costs you nothing except that the document stays unread until you send a clearer copy. And agreeing once does not agree for next time — there is no setting to switch on, and nothing is remembered.
The log
/privacy in the bot returns the record of everything that has ever gone outside on your behalf, in plain language: what was sent, what was replaced with a placeholder, what was withheld, and when. It is kept indefinitely, on purpose.
We publish this because we can. A service that keeps your material in the cloud has no equivalent page to show you — the question does not arise there, because the answer is everything.
What is never stored at all
Card security codes, PINs, passwords and one-time codes are recognised the moment they arrive. They are not written to the vault, the database or any log, and you are told so:
Authentication data detected. It has not been stored.
Full card numbers are never kept. The register holds the issuer, the product, the network, the last four digits and the expiry, because that is all that is needed to reason about what a card grants.
How long things are kept, and how to end it
Original documents stay in an encrypted vault for as long as you keep the entitlements they support. Your register persists until you delete it. The log of external requests is kept indefinitely, because its whole purpose is to be checkable later.
/export returns the entire archive — every entitlement and every document — in a form you can keep.
Deleting your profile removes the documents, the register, the derived data and the embeddings, and confirms that it has been done rather than asking you to take it on trust. Backups are encrypted with a key the storage provider does not hold, and roll off on a fixed schedule.
What this website does
The site you are reading uses no advertising cookies and runs no third-party trackers. Visit statistics are collected by a self-hosted, cookieless analytics service that records the page and the referrer and does not build a profile of you or follow you elsewhere. The verification widget on the contact form is self-hosted for the same reason. Nothing here is shared with an advertising network, because there is nobody to sell it to.
Two things we would rather say ourselves
Telegram
Files sent through Telegram cross Telegram's servers before they reach us — this is true of anything sent through Telegram, and it is why our promise is worded exactly as it is: your documents are never sent to external AI models. Telegram and the doorway server also see metadata: who sent something, when, and how large it was. A private upload channel that avoids this is planned; until it exists, this is stated rather than glossed.
We are not a zero-knowledge system
Your material sits on hardware we control, encrypted, with administrative access logged. That is a much stronger position than a cloud service, and it is not the same as being mathematically unable to look. We would rather tell you that plainly than make a claim that falls apart under one technical question.
SP 8HANDS OF SUPA SPC, Cayman Islands, is the controller of the data described on this page. Registered office: 71 Fort Street, 3/F Unit 2775, Grand Cayman KY1-1111, Cayman Islands. Questions about any of it — including a request to see, export or delete what we hold — reach a person through the contact form or the bot.