Privacy Policy
Last updated: 2 August 2026
This policy explains what Du7 Technology Services (KVK 91476003,
the Netherlands) does with personal data in two places: this website
(du7.dev) and the Du7 AI Assistant, a private WhatsApp
bot. We are the data controller for both. Contact:
info@du7.dev.
In short. The assistant is a private, self-hosted tool for its owner and a small number of explicitly authorised people. It runs on our own hardware, and the AI model that reads your messages runs locally — message content is not sent to any third-party AI provider. We do not sell data, do not use it for advertising, and do not use it to train AI models.
1. The website
du7.dev is a static site hosted on GitHub Pages. It sets
no cookies, contains no analytics, no trackers and
no third-party embeds. As with any web host, GitHub records standard technical
request logs (including IP address) to serve the site and protect it from abuse;
see the GitHub
Privacy Statement. We have no access to individually identifiable analytics
about visitors.
2. The Du7 AI Assistant (WhatsApp bot)
Who can use it
The assistant is not a public service. It replies only to phone numbers on an explicit allow-list. Messages from any other number are discarded without being processed or answered.
What we process
| Data | Why | Kept for |
|---|---|---|
| Your WhatsApp phone number | To check you are authorised and to send the reply back to you | Held in configuration; not stored in a database |
| The content of messages you send the bot | To understand the request and produce an answer | In memory only, for the duration of the conversation; discarded when the service restarts |
| Technical logs (timestamps, errors, which tool ran) | To keep the service working and diagnose faults | Rotating container logs on our own hardware |
There is no analytics database, no message archive and no profiling. We do not build advertising profiles and there is no automated decision-making with legal or similarly significant effects.
Where your message goes
- Meta / WhatsApp transports the message. Meta processes it under its own terms — see the WhatsApp Privacy Policy. We cannot control or shorten Meta's own retention.
- The message then reaches our own server, and the language model that interprets it runs on our own hardware. Message content is not sent to OpenAI, Anthropic, Google or any other AI cloud.
Third parties, only when a request needs them
Some requests require reaching an outside service. Only the part needed to fulfil the request is sent — for example a search term or a city name, not your phone number or your conversation:
- Weather — a place name is sent to Open-Meteo.
- Web search — a query is sent through our own SearXNG instance to upstream search engines.
- Music — a search term is sent to Spotify.
- Media library — titles are looked up via a self-hosted Overseerr instance (which uses TMDB).
- Email and calendar accounts (Google, Microsoft) and LinkedIn — accessed only where the operator has explicitly connected their own account, using OAuth tokens stored on our own hardware. These are never used to read anyone else's mailbox.
- Home automation — stays on the local network.
Actions that change something
Anything that sends a message, publishes content, changes a home-automation setting or requests media requires an explicit confirmation from the operator before it runs. The assistant does not take such actions on its own initiative.
3. Legal basis (GDPR)
- Legitimate interest (Art. 6(1)(f)) — operating a private assistant for authorised users, and keeping it secure and functional.
- Consent (Art. 6(1)(a)) — where you choose to message the bot or connect an account. You can withdraw it at any time by asking to be removed from the allow-list.
4. Security
Incoming webhooks are cryptographically verified (HMAC signature) so that only genuine WhatsApp traffic is accepted. Access tokens are stored on our own hardware with restricted file permissions and are never committed to source control. Transport to and from Meta uses TLS.
5. International transfers
Our own infrastructure is located in the Netherlands. Meta and the third-party services listed above may process data outside the EEA under their own safeguards (such as Standard Contractual Clauses).
6. Your rights
Under the GDPR you may request access to, correction of, or erasure of your personal data, object to processing, or request restriction or portability. Because the assistant keeps conversation content only in memory, erasure is usually immediate — a restart clears it, and your number can be removed from the allow-list on request.
Email info@du7.dev and we will respond within 30 days. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
7. Children
The assistant is not directed at children and is not offered as a public service.
8. Open source
The assistant's source code is published at github.com/eduelias/famulus, so the behaviour described here can be independently verified. Anyone self-hosting their own copy is the controller of their own installation; this policy covers the instance operated by Du7 Technology Services.
9. Changes
If this policy changes materially we will update the date at the top of this page.