Security and data
I read what you let me read, remember what you let me keep, and say only what your pages say.
Before you put me in front of your customers, you want to know three things: where their words go, what I'll say in your name, and what I can and cannot see. Here is all three, plainly.
Where your visitors' conversations live.
In the EU. Everything runs in Frankfurt (AWS, eu-central-1): the database, the files you upload, the audio of spoken answers.
Who else sees a message. The answer itself is written by a language model you pick in your panel — from Anthropic, OpenAI or Google — and the question travels to that provider to be answered, the way it would from any product built on them. Spoken answers are voiced and recognised by speech services (Amazon, Microsoft Azure, ElevenLabs, Deepgram).
Each of them is named on the subprocessors page, and we add nobody quietly.
What I keep — and what I never had.
Conversations are kept for as long as your plan says — 30 days on Starter, up to 365 on Business — and then deleted outright: the row is gone, not blurred out. What stays is a daily count with no text in it and no way to tell who the visitor was.
No IP addresses kept. I look at the address only to count: no one place gets more than 20 answers a minute or 300 a day, so a script can't spend your credits. It becomes a one-way code that is gone within a day, and never reaches a conversation, a log or your analytics — the country and city there come from the edge of the network, as a label.
A visitor's contact — when they ask to be called back — is stored encrypted, and it outlives the conversation it came from so you don't lose a lead to a retention rule.
Nothing on the visitor's device but the conversation they're having, for seven days, so they can come back to it. No cookies, no tracking across sites, nothing for an ad network.
What I read on your pages — your switch, off by default.
I can fill in forms and press buttons on your pages. To do that I look at the page the visitor is on: which fields exist and whether they're filled. Whether I may read what's typed in them is your decision, in three steps:
Passwords, hidden fields and anything you mark as private I never read, whatever the switch says. And when I write into a field that already has text, I tell the visitor I replaced it.
What I'll say — and what I won't.
Only what your pages say.
Every answer is built from what you published, with a link to the place. The rule that keeps me on your content isn't a setting you could switch off by accident: it's always on, under whatever personality you write.
«I don't know» when I don't.
When your site has no answer, I say so and offer a person. I don't fill the gap with something plausible.
In the voice you wrote.
You write how I introduce myself, how I talk and what I focus on — and you can read the exact instructions I'll be given before you save them. Nothing hidden.
Who can reach your panel and your data.
Only you. Everything in the panel is scoped to the account that owns the site; another account cannot see your sites, even by guessing an address.
Your management keys are shown once and stored as a hash, so nobody can read one back; the public widget key is restricted to the websites you list. A public key can still be copied, so what one visitor can ask is capped, and the Active switch in your panel takes me off your site in one click.
Your secrets — a token for your own API — are stored encrypted and can be written, never read back, not even by you.
Your visitors' own logins, when I act inside your app, are relayed to your API as they are and never stored, logged or shown to the model.
GDPR, in two sentences.
You can export everything your account holds as a file and delete the account yourself, from the panel, without asking us.
A data processing agreement is on the legal pages, with the list of every subprocessor named above.
Ask me what I'd keep on your site.
