Privacy Policy

1. Introduction

Welcome to GPT Wrapped ("Service", "Website", "Application", "we", "us", or "our"), operated by Webcracy SNC, a company registered and operating under the laws of Switzerland. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at mygptwrap.com and use our services.

We are committed to protecting your personal data and respecting your privacy in accordance with the Swiss Federal Act on Data Protection (FADP/DSG), the revised Swiss Data Protection Act (revDSG) effective from September 1, 2023, and where applicable, the European Union General Data Protection Regulation (EU GDPR) and the United Kingdom General Data Protection Regulation (UK GDPR).

Please read this Privacy Policy carefully. By accessing or using our Service, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes in any revised Privacy Policy by your continued use of the Service after the date such revised Privacy Policy is posted.

2. Data Controller Information

The data controller responsible for the processing of your personal data is:

As the data controller, Webcracy SNC determines the purposes and means of processing personal data collected through the Service. We are responsible for ensuring that any processing of personal data complies with applicable data protection laws, including the Swiss Federal Act on Data Protection (FADP), the revised Swiss Data Protection Act (revDSG), and where applicable, the General Data Protection Regulation (GDPR).

If you have any questions about this Privacy Policy, the practices of this Service, or your dealings with us, please contact us using the contact information provided above. We are committed to addressing any concerns you may have regarding our data processing practices.

3. Data We Collect

We collect information from and about users of our Service in several ways:

3.1 Information You Provide Directly

When you use our Service, you may provide us with the following types of information:

• ChatGPT Export Data: When you upload your ChatGPT data export file (in JSON or ZIP format), we receive and process the contents of that file. This may include your conversation history, messages you have sent to ChatGPT, responses received from ChatGPT, conversation titles, timestamps, and other metadata associated with your ChatGPT usage.
• Uploaded Files: The ZIP or JSON files you upload to our Service for analysis are transmitted to and temporarily stored on our servers for processing purposes.

3.2 Information Collected Automatically

When you access our Service, we may automatically collect certain information about your device and your use of the Service, including:

• Device Information: We may collect information about your device, including your device type, operating system, unique device identifiers, browser type and version, and device settings.
• Log Data: Our servers automatically record information ("Log Data") created by your use of the Service. Log Data may include information such as your IP address, browser type, the referring domain, pages visited, search terms, and other actions on the Service.
• Usage Information: We collect information about how you interact with our Service, including the features you use, the actions you take, the time, frequency, and duration of your activities, and other information about your use of and actions on the Service.
• Location Information: We may derive your approximate location from your IP address.

3.3 Information from Third Parties

We may receive information about you from third parties, including:

• OpenAI/ChatGPT: The data you upload to our Service originates from your ChatGPT account with OpenAI. We process this data solely based on your instructions when you upload it to our Service.
• Analytics Providers: We may receive information about your use of our Service from third-party analytics providers.

3.4 Sensitive Personal Data

We do not intentionally collect sensitive personal data (also known as special categories of personal data under the GDPR). However, the ChatGPT conversation data you upload may contain sensitive information that you have previously shared with ChatGPT. You are solely responsible for ensuring that any data you upload to our Service does not contain information you do not wish to share with us or that may violate any applicable laws or regulations.

We strongly recommend that you review your ChatGPT export data before uploading it to our Service and remove any sensitive personal information, including but not limited to: health information, financial account details, government identification numbers, passwords, or any other information you consider confidential or sensitive.

4. How We Use Your Data

We use the information we collect or receive for the following purposes:

4.1 To Provide and Maintain Our Service

• To analyze your ChatGPT usage data and generate your personalized "Wrapped" statistics and insights;
• To create visualizations, charts, and summaries of your ChatGPT usage patterns;
• To determine your ChatGPT "persona" based on your usage patterns;
• To calculate and award achievement badges based on your usage statistics;
• To enable you to share your results with others;
• To store and retrieve your shared statistics when you or others access shared links;

4.2 To Improve Our Service

• To understand how users interact with our Service;
• To identify and fix bugs, errors, and technical issues;
• To develop new features, products, and services;
• To conduct research and analysis to improve user experience;
• To monitor the usage and performance of our Service;

4.3 To Ensure Security and Prevent Fraud

• To detect, prevent, and address security incidents, fraud, and other illegal activities;
• To scan uploaded files for potentially sensitive information (such as API keys, passwords, or personal identifiers) to protect users from inadvertent data exposure;
• To enforce our terms of service and other policies;
• To protect our rights, privacy, safety, or property, and that of our users or others;

4.4 To Communicate With You

• To respond to your inquiries and provide customer support;
• To send you technical notices, updates, security alerts, and administrative messages;
• To provide you with news and information about our Service that we think may interest you;

4.5 For Legal and Compliance Purposes

• To comply with applicable laws, regulations, and legal processes;
• To respond to lawful requests from public authorities, including to meet national security or law enforcement requirements;
• To establish, exercise, or defend legal claims;

4.6 Aggregated and Anonymized Data

We may aggregate and anonymize information collected through the Service so that the information can no longer be linked to you or your device. We may use such aggregated and anonymized information for any purpose, including for research, marketing, analytics, and improving our Service, and we may share such information with third parties without restriction.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds under Swiss data protection law and, where applicable, the GDPR:

5.1 Consent (Art. 6(1)(a) GDPR / Art. 31 revDSG)

By uploading your ChatGPT data to our Service, you provide your explicit consent to the processing of that data for the purposes described in this Privacy Policy. You may withdraw your consent at any time by ceasing to use our Service and contacting us to request deletion of your data.

5.2 Performance of a Contract (Art. 6(1)(b) GDPR)

Processing of your data is necessary for the performance of the service you have requested, namely the analysis and visualization of your ChatGPT usage data.

5.3 Legitimate Interests (Art. 6(1)(f) GDPR / Art. 31 revDSG)

We may process your data based on our legitimate interests, provided that such interests are not overridden by your rights and interests. Our legitimate interests include:

• Improving and developing our Service;
• Ensuring the security and integrity of our Service;
• Preventing fraud and abuse;
• Understanding how our Service is used;
• Marketing and promoting our Service;

5.4 Legal Obligation (Art. 6(1)(c) GDPR)

We may process your data when necessary to comply with our legal obligations under Swiss law, EU law, or other applicable jurisdictions.

6. Data Storage and Security

6.1 Where We Store Your Data

Your personal data is stored on secure servers located in Switzerland and the European Economic Area (EEA). We use industry-standard security measures to protect your data during transmission and storage.

By using our Service and providing us with your data, you consent to the storage and processing of your data in Switzerland and, where applicable, other jurisdictions as described in this Privacy Policy.

6.2 Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption of data in transit using TLS/SSL protocols;
• Secure server infrastructure with access controls;
• Regular security assessments and updates;
• Access restrictions to personal data on a need-to-know basis;
• Monitoring of our systems for potential vulnerabilities and attacks;
• Automatic scanning of uploaded files for sensitive information;
• Rate limiting and abuse prevention mechanisms;

Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. You acknowledge that you provide your personal data at your own risk.

6.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with applicable data protection laws, including the Swiss FADP/revDSG and, where applicable, the GDPR. We will also notify the relevant supervisory authorities as required by law.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

7.1 Uploaded Files

The ChatGPT export files (ZIP or JSON) you upload to our Service are stored on our servers for processing purposes. These files may be retained for security scanning and analysis purposes. Files may be automatically deleted after processing or retained for a limited period for quality assurance and abuse prevention purposes.

7.2 Shared Statistics

If you choose to create a shareable link for your Wrapped statistics, the shared data will be stored in our database and retained until you request its deletion or we determine it is no longer necessary for the purposes for which it was collected.

7.3 Log Data

Server logs and access logs are typically retained for a period of 90 days for security and troubleshooting purposes, after which they are automatically deleted or anonymized.

7.4 Anonymized Data

Anonymized and aggregated data that can no longer be linked to you may be retained indefinitely for research, statistical analysis, and service improvement purposes.

8. Your Rights

Under Swiss data protection law (FADP/revDSG) and, where applicable, the GDPR, you have certain rights regarding your personal data. These rights include:

8.1 Right of Access

You have the right to request confirmation of whether we process your personal data and, if so, to request access to that data. You also have the right to receive information about the purposes of processing, the categories of data processed, the recipients or categories of recipients to whom the data has been disclosed, the envisaged retention period, and the source of the data if not collected directly from you.

8.2 Right to Rectification

You have the right to request the correction of inaccurate personal data concerning you and to have incomplete data completed.

8.3 Right to Erasure ("Right to be Forgotten")

You have the right to request the deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, when you withdraw your consent (if processing is based on consent), when you object to processing and there are no overriding legitimate grounds, or when the data has been unlawfully processed.

8.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, including when you contest the accuracy of the data, when the processing is unlawful and you oppose erasure, when we no longer need the data but you need it for legal claims, or when you have objected to processing pending verification of legitimate grounds.

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance from us, where processing is based on consent or a contract and is carried out by automated means.

8.6 Right to Object

You have the right to object to the processing of your personal data based on our legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

8.7 Right to Withdraw Consent

Where we rely on your consent for processing, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates applicable data protection laws. In Switzerland, the competent supervisory authority is:

If you are located in the European Union, you may also lodge a complaint with the supervisory authority in your country of residence or place of work.

8.9 Exercising Your Rights

To exercise any of these rights, please contact us using the contact information provided in Section 2 of this Privacy Policy. We will respond to your request within the timeframes required by applicable law, typically within 30 days. We may request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files that are stored on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to the owners of the site. Cookies can be "persistent" or "session" cookies. Persistent cookies remain on your device for a set period or until you delete them, while session cookies are deleted when you close your web browser.

9.2 Cookies We Use

Our Service may use the following types of cookies:

• Essential Cookies: These cookies are necessary for the Service to function properly. They enable basic functions like page navigation and access to secure areas of the website. The Service cannot function properly without these cookies.
• Functional Cookies: These cookies enable the Service to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages.
• Analytics Cookies: These cookies help us understand how visitors interact with our Service by collecting and reporting information anonymously. This helps us improve our Service.
• Performance Cookies: These cookies collect information about how you use our Service, such as which pages you visit most often. This data may be used to optimize our Service and make it easier to navigate.

9.3 Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies to help us analyze how users use our Service. The information generated by the cookie about your use of the Service (including your IP address) will be transmitted to and stored by Google on servers in the United States and other countries.

Google will use this information for the purpose of evaluating your use of the Service, compiling reports on website activity for website operators, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.

We use Google Analytics with the following features:

• Traffic and usage analysis to understand how visitors interact with our Service;
• Demographic and interest reporting to better understand our audience;
• User behavior tracking across pages to improve user experience;

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout

For more information on how Google uses data when you use our Service, please visit: https://policies.google.com/privacy

9.4 Third-Party Cookies

In addition to our own cookies, we may also use various third-party cookies to report usage statistics of the Service, deliver advertisements on and through the Service, and so on. These third-party cookies are subject to the respective privacy policies of these external services.

9.5 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all or some cookies or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Service may become inaccessible or not function properly.

For more information about cookies and how to manage them, visit www.allaboutcookies.org or www.aboutcookies.org.

9.6 Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want to have your online activity tracked. We currently do not respond to DNT signals. If a standard for responding to DNT signals is adopted, we will revisit this policy and update our practices accordingly.

10. Third-Party Services

Our Service may contain links to third-party websites, services, or applications that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the privacy policy of every site you visit.

10.1 Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services, or to assist us in analyzing how our Service is used. These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

10.2 Categories of Service Providers

The categories of Service Providers we may use include:

• Hosting Providers: Companies that provide server infrastructure and hosting services for our Service;
• Analytics Providers: Services that help us understand how users interact with our Service;
• Security Services: Companies that help us protect our Service against security threats;
• Content Delivery Networks: Services that help deliver our Service content efficiently;

10.3 Data Sharing

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your data with third parties only in the following circumstances:

• With Service Providers who assist us in operating our Service;
• If required by law or in response to valid legal process;
• To protect our rights, privacy, safety, or property;
• In connection with a merger, acquisition, or sale of assets;
• With your consent or at your direction;

11. International Data Transfers

Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country.

Specifically, our servers are located in Switzerland and the European Economic Area. This means that when we collect your personal data, we may process it in these locations.

Switzerland has been recognized by the European Commission as providing an adequate level of data protection. However, if we transfer your personal data to countries that have not been deemed to provide an adequate level of protection, we will implement appropriate safeguards to protect your personal data, such as:

• Standard Contractual Clauses approved by the European Commission;
• Binding Corporate Rules;
• Other legally approved mechanisms providing adequate protection;

By using our Service and providing us with your data, you consent to the transfer of your data to Switzerland and other jurisdictions as described in this Privacy Policy.

12. Children's Privacy

Our Service is not intended for children under the age of 16 (or such other age as may be required under applicable law in your jurisdiction). We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

If you are under 16 years of age, you must have permission from a parent or guardian to use this Service. By using our Service, you represent that you are at least 16 years of age, or that you are the parent or guardian of such a minor and consent to such minor's use of the Service.

13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this Privacy Policy.

For significant changes, we may also provide notice through the Service interface, via email (if you have provided us with your email address), or by other means consistent with applicable law.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of such changes.

14. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, or if you wish to exercise any of your rights as described in this Privacy Policy, please contact us at:

We will endeavor to respond to your inquiry within a reasonable timeframe and in accordance with applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority as described in Section 8.8 of this Privacy Policy.

15. Governing Law and Jurisdiction

This Privacy Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of Switzerland, without regard to its conflict of law provisions.

Any legal action or proceeding arising out of or relating to this Privacy Policy shall be brought exclusively in the courts located in the Canton of Ticino, Switzerland, and you hereby consent to the personal jurisdiction and venue of such courts.

Notwithstanding the foregoing, if you are a consumer residing in the European Union, you may also be entitled to bring proceedings in the courts of your country of residence in accordance with applicable consumer protection laws.

16. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• "Data Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• "Data Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller.
• "Service" refers to the GPT Wrapped website and application operated by Webcracy SNC.
• "You" means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

17. Acknowledgment

By using our Service, you acknowledge that you have read this Privacy Policy and agree to its terms. You acknowledge that:

• You are voluntarily uploading your ChatGPT data export to our Service for analysis;
• The data you upload may contain personal information from your conversations with ChatGPT;
• We will process this data on our servers in accordance with this Privacy Policy;
• You have the right to review your data before uploading and remove any information you do not wish to share;
• You can contact us at any time to request information about or deletion of your data;

If you do not agree with this Privacy Policy, please do not use our Service.