Privacy Policy
This policy explains what information AI Business Bot (“we”, “us”) handles, why, and what you can do about it. It covers three groups of people:
- Customers — people and businesses with an account who set up an AI assistant;
- Business websites — the websites our customers ask us to read;
- Visitors — people who use the chat widget on a customer's website.
AI Business Bot is in beta. We describe our current practices plainly; we don't hold any privacy or security certifications.
1. Information about customers
- Account details: your name and email address, and your password — which we store only as a salted one-way hash, never in readable form.
- Account status: whether and when you confirmed your email, which version of our Terms you accepted and when, and when the account was created.
- Sign-in sessions: a random session identifier kept in a cookie in your browser, and a one-way hash of it on our servers with its expiry time. Sessions last up to 30 days or until you log out.
- Email links: confirmation and password-reset links contain a random one-time code. We store only a one-way hash of it; confirmation links expire after 24 hours and reset links after 30 minutes.
- Your assistants: business name, website address, extra websites you allow the widget on, and appearance settings (name, greeting, suggested questions, colour, position, logo address).
- Security records: we use IP addresses to limit repeated requests (for example repeated login attempts). Failed login attempts are written to our server logs with the IP address and a shortened one-way hash of the email address entered — never the password. When we send you an email we log the type of email and a shortened hash of the address, not its content.
- Payments: the beta is free, so we don't collect any payment information.
2. Business website content
When a customer creates or refreshes an assistant, we read publicly available pages of the website they registered (following links on the same site, up to about 60 pages each time). We store the text of those pages and a search index built from it on our servers, so the assistant can find relevant passages when a visitor asks a question. We don't read pages behind logins, and we respect a website's robots.txt instructions. This content is replaced when the customer refreshes it and deleted when they delete the assistant or their account.
3. Information about visitors using a chat widget
When a visitor uses the chat on a customer's website, we process:
- the questions they type and the answers the assistant gives;
- whether each question was answered or declined, and how long the answer took;
- a random chat identifier, which the widget keeps in the visitor's browser storage so a conversation can continue across pages, along with a small setting that remembers whether the chat window is open;
- the visitor's IP address, used only temporarily to limit repeated requests, and the address of the web page the chat is used on, used to check the widget is running on an allowed website.
We don't ask visitors for their name or contact details, and we don't use cookies, advertising or analytics trackers in the widget. Questions and answers are stored in a conversation log that the customer (the business) can see in their dashboard, and questions also appear in our server logs, which we use for troubleshooting. Visitors should not type sensitive personal information into the chat.
The business that runs the website decides to use AI Business Bot. If you are a visitor with a question about a particular conversation, you can contact that business, or contact us (section 9).
4. How we use information
- to provide the service: build assistants, answer visitors' questions, and run your account;
- to send account emails — email confirmation, password resets, and security notices such as password changes;
- to keep the service secure, prevent abuse and investigate problems;
- to understand reliability using counts and timings (for example how many questions were answered).
We don't sell personal information, we don't use it for advertising, and we don't send website content or visitors' questions to outside AI companies: the AI models that power the assistant run on servers we operate.
5. Who can see it
- The customer can see their own assistants and their visitors' questions and answers. Customers can't see other customers' data.
- Our team: the people who run AI Business Bot can technically access stored data when needed to operate the service, provide support, keep it secure or restore backups. Our internal owner dashboard shows account and billing information only; it doesn't display conversations.
- Service providers that help us run the service:
- our transactional email provider, which receives your email address and the content of account emails so it can deliver them;
- our network provider (Tailscale), which relays encrypted connections between your browser and our servers;
- cloud storage (Google Drive), where we keep backup copies of our database and assistants' knowledge.
- Legal reasons: we may disclose information if the law requires it or to protect the safety, rights or security of our users or the service.
6. How long we keep it
- Account details — until you delete your account. If an account has billing records, those records are kept for accounting purposes and the account is anonymised instead: name, email and password are removed.
- Website content and conversation logs — until the assistant or the account is deleted.
- Server logs (including visitors' questions and failed-login records) — usually deleted after 14 days.
- Backups — database backups are kept for up to 14 days and knowledge-base backups for up to 7 days, so deleted information can remain in a backup for up to 14 days.
7. Security
Connections to the service are encrypted. Passwords, session identifiers and one-time email codes are stored only as one-way hashes. Each customer's data is kept separate from other customers'. No online service can be perfectly secure, so we can't promise that information will never be accessed without permission; if we learn of a breach affecting your information, we will tell you.
8. Your choices
- Update your name in Account settings. To change your email address, contact support.
- Delete an assistant, or your whole account, yourself at any time.
- Ask us for a copy of your information, or ask us to correct or delete it, by contacting support.
Depending on where you live you may have further rights under local law. Contact us and we will respond as that law requires.
9. Cookies and browser storage
The customer dashboard uses one cookie: the sign-in session cookie, which is needed for logging in. The chat widget stores a random chat identifier and an open/closed setting in the visitor's browser storage. We don't use analytics or advertising cookies.
10. Children
The service is for businesses. Customer accounts are for adults, and we don't knowingly collect information from children.
11. Where information is stored
The service runs on servers we operate. Backups are stored with our cloud storage provider and emails are delivered by our email provider, which may process information in other countries.
12. Changes and contact
We will update this policy when our practices change and show the new date at the top. For material changes we will tell customers by email or in the dashboard. Questions or requests: see the Support page.