Privacy Policy (DRAFT)

⚠ Placeholder draft. This text must be reviewed by legal counsel before any public launch (PRD §6.4).

1. Two planes of data

We process (a) data of our customers (account holders) as a controller, and (b) data of visitors of our customers' websites as a processor / service provider (GDPR Art. 28, CCPA).

2. Visitor chat data

Chat conversations are processed by an AI assistant to respond to the visitor. Conversations may be recorded and stored. We do not sell chat data and do not use it for advertising or for training general-purpose AI models.

3. Retention

Conversation data is retained for 12 months by default (configurable per project), then automatically deleted. Data subjects may request deletion at any time via the business they interacted with.

4. Subprocessors

LLM API provider (zero-data-retention terms), hosting provider, email provider, Stripe (billing). Full list available on request.

5. Widget storage

The chat widget uses functional localStorage only (visitor id, session state). No tracking cookies.