Personal data
What personal data BooleX holds, where, for how long, and how to export or erase it.
BooleX runs on the site's edge PC, and the site is the controller. In the production and offline-import profiles no personal data leaves the edge PC. In the hybrid profile only the question, the conversation and the cited excerpts go to the model endpoint the site approved, and each call is audited. 4M processes data only when the site sends it an escalation package.
| Category | What | Where | Retention |
|---|---|---|---|
| Account | User name, role, answer language, password hash (scrypt) or the directory identity | config/users.json; directory accounts are not stored | Until the account is removed or erased |
| Preferences | The user's theme | config/preferences.json | Until erased; listed in the export |
| Training attempts | The trainee's user name, the past stop, the written diagnosis, the score and time (only where training: true) | /data/training.jsonl on the assistant's data volume | Until erased; listed in the export, pseudonymised on erasure |
| Remote support window | The support engineer's name, the administrator who opened it, the reason, every request made with the support account | The append-only audit log | Kept with the audit trail; the one-off account ends with the window |
| Sign-in and change records | User name, time, event | The append-only audit log | Kept with the audit trail; not erased with the account |
| Questions and answers | Questions typed or dictated, answers, cited sources, user name | Audit records; open sessions in memory | Audit trail as above; open sessions until the service restarts (50 per user) |
| Feedback and outcomes | Ratings, comments, confirmed causes, actions, check results, knowledge gaps, with user name and time | The assistant's data volume | Until erased; pseudonymised on erasure |
| Technician journal | Records with the author's name; optional photos | The assistant's data volume | Text until erased (author pseudonymised); photos after the media retention, 30 days by default |
| Voice recordings | The spoken question | Not stored: sent once to the site's speech-to-text server | None |
| HMI photos for codes | The photo of an alarm banner | Not stored: read in memory | None |
| Backups | Copies of the above | The site's backup location | The last 7 daily backups |
Plant data (tag values, alarms, PLC code, documents, work orders) is not personal data, except that CMMS work orders may name a technician; those names are kept as the CMMS exported them.
Export and erase
curl -H "Cookie: …" https://boolex.plant.local/api/admin/users/jsmith/personal-data # everything held about jsmith curl -X POST -H "Cookie: …" https://boolex.plant.local/api/admin/users/jsmith/erase # erase jsmith
Both need an administrator's session. Erasure deletes the account and its photos, and replaces the name with a pseudonym in sessions, feedback, journal records and training attempts. The audit log keeps the name, since it is the record of who did what; the erasure itself is recorded there.
The release package includes this description for the site's data protection impact assessment.