AI Platform

Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("we", "us", "our") collects, uses, and shares personal data when you use AI Platform (the "Service"), in accordance with the EU General Data Protection Regulation (GDPR).

1. What we collect

  • Account data — name, email, and password (stored hashed, never in plain text).
  • Billing data — handled by Stripe; we store billing account, subscription, and credit-transaction records, never your raw card details.
  • Usage data — the assistants/agents you configure, conversations, runs, and tool calls.
  • Content you provide — instructions, knowledge-base documents, and anything you choose to send through an assistant or agent.
  • BYOK credentials — your own third-party provider API keys, if you connect one. These are encrypted at rest and never exposed to the underlying AI model or shown back to you in plain text after entry.
  • Visitor/lead data — if you deploy an embedded widget, a visitor's conversation and any contact details they choose to share (name, email, phone) are stored as a lead for the workspace that deployed it. For that data, we act as a processor on the workspace owner's behalf, not as the data controller.

2. How we use it

To provide, secure, and bill for the Service; to respond to support requests; to send operational and billing emails (renewal, payment, plan-limit notices).

3. Who we share it with

We share personal data only with the sub-processors needed to run the Service:

  • Stripe — payment processing and subscription billing.
  • OpenRouter and DeepSeek — the AI model providers that process the content of your assistant/agent requests in order to generate a response. If you connect your own key for a provider (BYOK), that provider processes your requests directly, under your own agreement with them, not ours.
  • Brevo — transactional email: billing notifications, and any email an assistant or agent you've configured sends on your behalf through its email tool.
  • Our object storage provider — stores files you upload, including knowledge-base documents.

We don't sell personal data, and we don't share it beyond what's listed above.

4. International transfers

Some of the providers above may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses, to protect your data.

5. Retention

We retain personal data for as long as your account is active and as needed to meet legal, tax, and accounting obligations. You can request deletion of your account and its associated data at any time — see "Your rights" below.

6. Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or receive a portable copy of your personal data, and to object to certain processing. To exercise any of these rights, contact us at [CONTACT EMAIL]. You also have the right to lodge a complaint with your local data protection authority.

7. Cookies

We use only the essential session cookie needed to keep you signed in — no advertising or analytics-tracking cookies.

8. Children

The Service isn't directed at children, and we don't knowingly collect personal data from anyone under 16.

9. Changes to this policy

We may update this policy from time to time; the date above reflects the latest revision.

10. Contact

Questions about this policy, or to exercise a data-subject right: [CONTACT EMAIL].