Privacy policy

Last updated: [DATE - to be set at launch]

This policy explains how SiteAgent ("we", "us") handles personal data in SiteAgent (the "Service"). It covers two groups of people: our Clients (businesses with an account) and the visitors who chat with an assistant on a Client's website.

1. Who is responsible

For Client accounts, we decide how data is used. For visitor chats, the Client whose website shows the assistant decides what it is used for, and we process the data on the Client's behalf. [Controller/processor roles and any data processing agreement - to be confirmed by a lawyer.]

2. Data we collect

• Client accounts: name, email, company name, phone (optional), password (stored hashed), plan and usage.
• Visitor chats: the messages a visitor types and the assistant's replies, the page the chat started on, the browser type, and a one-way hash of the IP address. We never store raw IP addresses.
• Leads: the name, phone, email and message a visitor enters in the contact form.
• Order lookups: when a Client connects their store, the order number and email a visitor gives are sent to the Client's store to check the order. We keep only a short note that a lookup happened, not the order details.

3. AI processing

Visitor messages, the Client's instructions and knowledge, and recent chat history are sent to an AI provider to generate each reply. The Service currently uses: Google Gemini. If a Client adds their own AI provider key, that Client's chats are processed by the provider they chose instead. Knowledge text is also sent to the AI provider to build a search index.

[Provider data-use terms, paid tier confirmation and international transfer safeguards - to be completed before launch.]

4. Why we use the data

• To run the assistant, show conversations and leads to the Client, and send lead and usage emails.
• To enforce plan limits and protect the Service from abuse (for example rate limits based on the hashed IP address).

5. How long we keep it

Conversations, messages and leads are deleted automatically after 12 months. Monthly usage totals (message and token counts, without message content) are kept for billing. Client account data is kept while the account is open. [Retention after account closure - to be completed.]

6. Cookies and browser storage

The dashboard uses a session cookie to keep Clients logged in. The chat widget does not set cookies; it stores a random chat ID and the visible chat history in the visitor's browser storage so the conversation continues across pages.

7. Who we share data with

• The AI provider(s) named above.
• Our hosting and email providers. [Names - to be completed.]
• The Client's own store or webhook, only when the Client connects one.

We do not sell personal data.

8. Security

Passwords are hashed. API keys and store credentials are encrypted. Access to Client data is limited to the Client and our administrators.

9. Your rights

You can ask to see, correct or delete your personal data. Visitors should contact the business whose website they chatted on; we will help that business answer. [Applicable law and complaint authority - to be completed.]

Contact

[Contact email - set SITEAGENT_CONTACT_EMAIL.]