Privacy policy

Last updated: 14 October 2026

Draft, pending legal review. This privacy policy describes how AI Support Chat works today, but it hasn't been reviewed by a lawyer yet and may change before launch.

This policy explains what personal data AI Support Chat ("we", "us") handles, why, and what you can do about it. It covers our website, the free demo, the dashboard our customers use, and the chat widget our customers add to their own websites.

Who is responsible

AI Support Chat is operated by [legal entity name, address and company number]. You can reach us about privacy at [email protected].

We are the controller for our customers' account data, our own website and the free demo. For the conversations and leads collected by a customer's chat widget, the customer (the website owner) is the controller and we are their processor; see our data processing note.

What we collect

Customers (website owners)

• Google sign-in: your Google account id, email address, name and whether Google has verified the email. We don't receive or store a password.
• Billing: Polar is our merchant of record and handles payment. We receive your plan, billing period, subscription status and Polar's customer and subscription ids. We never see your card details.
• Your bots' knowledge: the website addresses you give us, the text of the public pages we read from them (respecting robots.txt), and the text, files and question-and-answer pairs you add.
• Usage: how many messages your bots answered, and the AI cost of each answer.

Visitors of our customers' websites (the chat widget)

• Chat logs: the questions you ask and the answers given, the address of the page where you opened the chat, any thumbs up or down, and a random visitor id. The widget keeps your conversation in your browser's local storage for 24 hours so it survives a page change.
• Leads: if you fill in the contact form, your email address and, if you give them, your name and question. These go to the website owner.
• We don't use tracking or advertising cookies in the widget, and we don't build profiles of visitors.

The free demo

• The website address you enter, the pages we read from it, and your questions and the answers.
• A one-way hash of your IP address and a cookie with your demo's id, so we can limit demos to one per address a day and one at a time per visitor. We don't store the IP address itself.
• The demo bot and its data are deleted 24 hours after you start it, unless you sign up in the same browser and keep it as your first bot.

Our website and technical data

• Our servers log requests (IP address, browser, time, page) to keep the service running and secure.
• Cookies: a session cookie when you're signed in, short-lived cookies that protect forms and Google sign-in, and the demo cookie. All are needed for the features you use; we don't use analytics or advertising cookies.

Why we use it

• To provide the service you signed up for: reading your website, answering your visitors, sending you leads and usage alerts, and billing (contract).
• To keep the service safe and affordable: rate limits, demo limits, spending caps, preventing abuse and fixing problems (legitimate interests).
• To keep records the law requires, such as billing records (legal obligation).

We don't sell personal data, and we don't use it for advertising.

Who processes it for us

• Anthropic (Claude): writes the answers. It receives the visitor's question, the last few messages of the conversation, and excerpts of the bot's knowledge.
• OpenAI (embeddings): turns website content and questions into vectors so we can find relevant passages. It receives that text.
• Polar: our merchant of record. It sells you the subscription and handles payment, invoices and sales tax, as its own controller for that data.
• Resend: delivers our emails, such as new-lead notifications and usage alerts.
• Google: sign-in.
• Railway (hosting and database) and Cloudflare (DNS and content delivery).

Several of these companies are in the United States. [Describe the transfer safeguards relied on, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, once confirmed with each provider.]

How long we keep it

• Conversations: 12 months by default. Website owners can delete conversations and leads sooner, at any time.
• Website content, files and Q&A: until the owner removes them or deletes the bot. Deleting a bot deletes all its data.
• Account data: while your account exists. [Retention period after account closure to be confirmed.]
• Demo data: 24 hours.
• Server logs: [number] days.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and complain to a data protection authority. Write to [email protected].

If you chatted with a bot on someone else's website, that website's owner is responsible for your data. Contact them first; we'll help them answer your request.

Security

Connections are encrypted with HTTPS. Access to the database is limited to the service itself, secrets are kept out of the code, and each customer's data is kept apart from every other customer's.

Children

AI Support Chat is a service for businesses and isn't meant for children under 16.

Changes

If we change this policy in a way that matters, we'll update the date above and tell customers by email.