Privacy Policy

1  Introduction

GCAP Labs, Inc. ("GCAP Labs", "we", "us", or "our") develops Headmaster, a free, open-source AI agent desktop application, and operates this website at gcaplabs.com. This Privacy Policy describes how we handle information when you use the website or contact us.

Headmaster is designed to run locally on your device by default. Your prompts, agent outputs, uploaded files, memory, and run history are stored on your machine and are not sent to GCAP Labs unless you explicitly choose to share them with us (for example, by sending a support message).

2  Data we collect

2.1  Information you provide

• Contact details: name, email address, and organisation name when you submit the contact form or sign up for updates.
• Voluntary communications: support tickets, feedback, and survey responses.

2.2  Information collected automatically

• Website logs: IP address, browser type, page visits, and request metadata for security and diagnostics. We do not use this data for advertising.
• Error reports: crash or error information you choose to send us.

2.3  What we do not collect by default

Headmaster does not send your prompts, completions, uploaded files, memory entries, or run history to GCAP Labs by default. Your API keys for model providers and messaging integrations are stored in your local Headmaster instance and are not accessible to us.

3  How we use your data

We use the information we collect to respond to you, maintain the website, provide support, and improve Headmaster. We do not sell your personal data to third parties, and we do not use your local Headmaster data to train AI models.

4  Model providers and your own API keys

Headmaster connects to model providers you choose (for example, OpenAI, Anthropic, Google, or a custom endpoint) using your own API keys. Those providers process your prompts according to their own privacy policies. We recommend reviewing each provider's policy before enabling it in Headmaster.

5  Data retention

We retain contact and support data for as long as necessary to respond to you and comply with legal obligations. Local Headmaster data is under your control on your device; you can delete it at any time from the application settings.

6  Your rights

Depending on your location, you may have the right to access, correct, delete, or restrict processing of the personal data we hold. To exercise these rights, email us at privacy@gcaplabs.com.

7  Security

We use reasonable technical and organisational measures to protect data sent to us through the website. Because Headmaster runs locally by default, your local workspace data is protected by your own operating system and disk encryption. For more details, see our Security page.

8  Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page when we do.

9  Contact us

For questions about this Privacy Policy or our data practices, please contact us at privacy@gcaplabs.com.