What the chatbot collects
- Messages visitors type in the chat
- Contact details only if the visitor chooses to share them (name, email, phone)
- Technical data needed to run the service and prevent abuse, such as the page URL and a hashed, rate-limiting identifier
It doesn’t use tracking cookies or build advertising profiles. The conversation history is kept in the visitor’s browser session so they can continue chatting across pages.
Where data is processed
- AI provider: messages are sent to the AI provider (Anthropic by default on Managed and Pro; your chosen provider on Starter) to generate replies. Commercial API data isn’t used to train their models by default.
- Your notifications: leads are delivered to the email address and tools you choose.
- Encryption: all traffic uses HTTPS/TLS.
Retention and deletion
We keep conversation logs and leads only as long as needed to deliver the service, send reports and improve your chatbot, and we delete them on request or when you cancel. You own your leads.
Guardrails
- Answers are grounded in your content; the chatbot says when it doesn’t know
- It identifies itself as an AI assistant
- It resists prompt-injection attempts (visitors trying to change its instructions)
- No medical, legal or financial advice; sensitive topics go to your team
- It never asks for passwords or payment card details
Abuse and cost protection
- Per-visitor rate limits and daily usage caps
- The chatbot only runs on your approved website domains
- Spam and bot traffic filtering
Compliance help
We help you stay compliant with GDPR, CCPA/CPRA and similar laws: we provide wording for your privacy policy, can sign a data processing agreement, and support deletion and access requests. For healthcare clients, our standard setup avoids collecting protected health information; talk to us before collecting PHI.
This page describes how our chatbot service is designed. It isn’t legal advice. Ask your own counsel how privacy laws apply to your business.
