Privacy, cookies and your data

Who is responsible

Dzmitry Arlou, based in Varna, Bulgaria, is the controller for the processing described here. Matreya is a new independent initiative with a nonprofit purpose; it is not currently a separate registered legal entity. This notice covers the institute website and its connection with the Simsara project. Use the privacy request form below to contact the controller directly about data protection.

What the forms collect

For an enquiry, a name or alias is optional; a real name is not required. We collect your reply contact, role or skills category, purpose and message, with a random reference, language, submission time and notice version. Contact and message are needed for a useful reply; give only details necessary for your request.

The privacy request form collects your reply contact, request, language, random reference and time. Please do not send passwords, identity documents, religious beliefs, health information or other sensitive personal details. We do not ask you to prove a religious affiliation.

Why we use this information

We use ordinary enquiry data to answer questions and coordinate the voluntary collaboration you request. The legal basis is our legitimate interest in communicating with people who approach the initiative (GDPR Article 6(1)(f)). We limit the information and recipients to what is proportionate to that conversation; you can object on grounds relating to your situation. Privacy requests are handled to meet our legal duties under the GDPR (Article 6(1)(c)).

We do not sell form data, use it for marketing, or make solely automated decisions producing legal or similarly significant effects about applicants. Sending a message does not enrol you in research, grant permission for model training, or subscribe you to a mailing list.

Who receives data and international processing

Cloudflare provides hosting, request delivery and the D1 application database. The coordinator accesses submissions through an authenticated administration tool. Telegram receives only a fixed service message saying that a new enquiry is waiting; it contains no submission reference, time, language, role, contact or message supplied by the applicant. Telegram can still see service/account and transmission metadata; this is not a promise of complete anonymity.

Providers operate internationally and processing may occur outside the European Economic Area. We do not promise EU-only processing or that a provider's published terms alone prove a particular transfer arrangement. You can ask through the form below which recipients and safeguards apply to your data. Official information: Cloudflare privacy https://www.cloudflare.com/privacypolicy/ and data processing terms https://www.cloudflare.com/cloudflare-customer-dpa/; Telegram https://telegram.org/privacy.

Storage, security and deletion

Our target retention period for new form records in the active database is 90 days from submission. Expired records are removed when the form API processes requests. A daily cleanup Worker has been prepared but is not yet active, so records may remain beyond the target when there is no form activity; we do not currently guarantee a daily or 24-hour deletion window. Ongoing collaboration needs a separately explained arrangement. Cloudflare-managed backups and technical records have separate retention or recovery cycles. You can request erasure or ask about relevant copies through the rights form; the available rights and legal exceptions below still apply.

To limit abuse, the application creates a salted hash derived from the connection IP address. A rate-limit record expires after 24 hours; expired records are removed during subsequent form-API processing. The prepared daily cleanup Worker is not yet active, so physical deletion is not guaranteed within 24 hours of expiry. Our basis is the legitimate interest in keeping forms available and secure; the enquiry record does not need the raw IP address. Cloudflare also processes connection and security metadata under its service arrangements, outside this application's complete control. Access and application logs are minimised, but internet services cannot promise zero security risk.

Earlier form versions may have sent fuller submission copies to Telegram. That history has not been fully reviewed; we do not claim that those copies have already been deleted. Where relevant to your request, we will check available records and address applicable access or deletion rights.

Cookies, preferences and optional media

The basic pages do not require advertising or behavioural analytics cookies. Simsara can remember explicitly chosen language and display preferences on your device only if you enable that option, for up to 30 days. You can clear saved preferences through its privacy controls or your browser. Necessary security or choice records are described separately from optional media.

YouTube music is not loaded until you make a separate informed choice. Loading it connects your browser to Google/YouTube, sharing your IP address and device/request information; Google may use cookies or similar storage under its own policy, https://policies.google.com/privacy. You can keep watching the simulation without music. Stop or close the player to withdraw the loading choice and remove the embed; this cannot undo data already received by Google.

What the AI receives

Simsara is a fictional AI-agent simulation. Model requests use fictional NPC state, a curated knowledge catalogue and, only when a visitor separately permits it, an optional fictional whisper. Institute contact-form submissions and privacy requests are never sent to the simulation models. Generated thoughts and conversations can be inaccurate and are not evidence of consciousness, scientific findings or statements by real people. An enquiry is not permission for model training.

You can watch without sending a whisper. Before submitting your own fictional text of up to 140 characters, you must make a separate affirmative choice permitting its publication in the shared world and processing by OpenRouter and its model providers to influence NPC thoughts and conversations. Do not include personal or sensitive data about identifiable real people, such as their real names, contact details, religious beliefs or health information. Fictional NPC names and discussion of Buddhist or other philosophical ideas are allowed. This optional processing relies on your consent (GDPR Article 6(1)(a)) where personal data is involved; it does not permit unrelated marketing or model training. Provider processing may occur outside the EEA. OpenRouter's privacy information is https://openrouter.ai/privacy; you can ask us about the providers and safeguards through the rights form.

The raw whisper and identifiable linked copies under the simulation's control are retained for no more than 30 days and may be pruned earlier. The game provides a withdraw/delete control after submission. Its private receipt is kept only in the current open tab's memory, survives a connection reconnect, and is not a public identifier or saved browser preference. Use that control while the tab and receipt remain available, or use the privacy form below to request help if they are lost.

Withdrawal stops further use of the controlled source and linked copies and removes them from the active simulation. It cannot recall information already received by providers, copies made by viewers, or every AI-generated paraphrase or consequence in the world. We do not promise that withdrawal reverses all past effects or deletes provider records outside our control. Watching the simulation, saving preferences, loading YouTube and sending a whisper remain separate choices.

Your choices and rights

You may ask for access, correction, erasure, restriction, and portability where it applies. You can object to legitimate-interest processing. Where a separate activity genuinely relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Some rights have legal limits; we will explain any refusal.

We normally answer within one month. If a lawful extension is needed, we explain it within that month. We use proportionate verification when necessary and do not routinely require a scanned identity document. You may complain to Bulgaria's Commission for Personal Data Protection, https://cpdp.bg/en/, or another competent supervisory authority. The website is not designed to collect children's sensitive information; minors should not send such information through these forms.