1. Scope and Sovereign Governance
This Privacy Policy applies to the web services, APIs, and client-side applications delivered under the domain oxidizedgraph.dev, operated by OxidizedGraph Inc. as a subsidiary operating unit of the Lornu AI Foundation.
We are architecturally committed to sovereign data stewardship, radical telemetry minimization, and transparent compliance with the European Union General Data Protection Regulation (GDPR / Regulation (EU) 2016/679), the UK Data Protection Act 2018, and the California Consumer Privacy Act as amended by the CPRA.
2. Data Collection Architecture & Zero Third-Party CDNs
Strict Local Asset Caching (Zero-Leakage): In strict accordance with European court precedent (including LG München Az. 3 O 17493/20), OxidizedGraph does not transfer your IP address to third-party CDN providers (such as Google Fonts or unauthenticated CDNs). All typographic assets, scripts, stylesheets, and icons are compiled and served directly from our sovereign infrastructure edge with immutable local cache headers.
We restrict data processing to essential technical operations:
- Edge Transport Telemetry: Ephemeral IP addresses, TLS handshake cipher suites, and request headers processed by our Cloudflare edge router strictly for DDoS mitigation, bot inspection, and routing. Edge access logs are purged within 72 hours.
- Client-Side Preferences: Local storage and cookie items (e.g.
aivcs_theme) are stored solely on your local device for user preference persistence and are never transmitted to external analytics trackers.
3. Data Subject Rights (GDPR Articles 15–22 & CCPA/CPRA)
Under applicable international privacy law, you are entitled to exercise the following sovereign data rights without discrimination:
- Right of Access & Portability (Art. 15): Request a structured, machine-readable copy of any personal data linked to your account or tenant session.
- Right to Rectification & Erasure (Art. 16 & 17): Request prompt correction of inaccurate records or permanent deletion of telemetry logs.
- Right to Restriction & Objection (Art. 18 & 21): Object at any time to the processing of session metadata under legitimate interest justifications.
- CCPA "Do Not Sell or Share My Personal Information": OxidizedGraph does not sell, rent, or share personal data with data brokers or commercial advertisers.
4. Contact Our Data Protection Officer
For inquiries, formal GDPR Article 17 deletion requests, or regulatory correspondence, contact our designated privacy team: