Last updated 2026-10-26
Who this covers
Two sets of people: the business owners who sign up, and the visitors who chat with an assistant on a business's website.
For owners, we are the data controller. For their website visitors, the business is the controller and we process on their behalf.
What we collect from business owners
Your email address, your name if you give one, and your password in hashed form.
Your business website address, and the content we read from your public pages to build your assistant.
The phone number and email addresses you choose for lead alerts, a Slack, Microsoft Teams or Google Chat address if you add one, the notification address of any phone or computer you turn alerts on for, your opening hours, and your settings.
Billing details are handled by our payment providers, PayPal, Razorpay and Stripe; we never see or store your card number, UPI details or PayPal login.
What we collect from website visitors
The messages they send to an assistant and the replies it gives.
Contact details they choose to give in the conversation, such as a name, phone number, email address or address, so the business can reply.
If they report an answer as wrong: that they did, and the name and the email address or phone number they give with the report, so the business can ask what it should have said. A rating of the chat, if they give one, is kept with the conversation.
Their answers to any questions the business has asked its assistant to put to them, and whether the place they gave is on the business's own list of places it serves.
If they give an email address, the assistant may email them on the business's behalf: a copy of what they asked when they leave their details, a booking confirmation and reminder, and the business's own answer to a question the assistant could not answer, if the business chooses to send it. Each email says why it was sent, a reply goes to the business, and none carries a tracking pixel. We keep when each was sent, and the text of an answer the business sent.
When they book on a business's own booking platform inside the chat: that a booking was made and, where the platform's page says, its time, so the business can be told. What they type into the booking page goes to that platform, not to us.
A random visitor id kept in their browser, so a returning visitor is not asked the same questions twice.
When they send a message: the page of the business's website they asked from, the first page of their visit, the name of the site that sent them, and any campaign tags on the link that brought them (the utm tags, and whether it was a Google ad or a link from Facebook or Instagram), so the business can see which pages and ads bring inquiries. None of this is sent for visiting a page, only with a message. Page addresses are kept without anything after a question mark, and ad click ids themselves are never kept.
An IP address is used briefly to limit abuse of the chat endpoint.
What we collect when you ask about Enterprise
The name, email, company, number of locations and message you send with the Enterprise form, so we can reply.
An IP address is used briefly to limit abuse of the form.
The sample assistants on our website
Each industry page on our website has a sample assistant for a made-up business. What you type into one is sent to Anthropic's API to produce the reply, as in any chat, and we don't store it: no conversation is saved, and no business receives it.
An IP address is used briefly to limit how many questions the samples can be asked in a day.
The assistant on our own website
The chat bubble on our own website is one of our assistants, working for us. It is not a sample: what you type into it is kept as a conversation, exactly as it is for any business that uses AI Chat Bot, and we read it to answer you and to improve our website.
It is sent to the provider whose AI model we have chosen for that assistant, Google or Anthropic, to produce the reply, under the terms described below for each.
If you leave your name and a phone number or email there, we keep them with what you asked, so that we can get back to you.
Cookies and browser storage
Our own website uses Google Tag Manager to load tools that measure how the website is used, and those tools may set cookies. It is never loaded in the dashboard, and never in the chat on a business's website, so a business's visitors are not tracked by us.
If your browser reports a European time zone, our website asks before Tag Manager loads, and nothing loads unless you accept. Everyone else gets Tag Manager by default.
Anyone can change their choice at any time with "Cookie settings" at the foot of every page, which asks again. Your choice is kept in your own browser's storage, under the name acb-cookie-consent.
Our pricing page can show prices in US dollars or in a local currency. Which it shows first is worked out in your own browser, from its time zone and language, and that is not sent to us or kept. If you choose a currency yourself, your choice is kept in your own browser's storage, under the name acb-currency.
As a backstop, Google Consent Mode starts Google's tags with storage denied for visitors in the European Economic Area, the UK and Switzerland until they accept.
Owners signing in get a session cookie. Connecting a calendar sets one short-lived cookie to keep that connection safe.
The widget keeps a random visitor id in the browser's own storage, and, if the business is measuring results, which group that visitor is in.
So a chat carries on from one page to the next, the chat also keeps the id of the conversation in the browser's storage, never the messages, and stops using it three hours after the last message. For the current tab only, the widget notes whether the chat is open, whether the visitor closed the line of text above the chat bubble, and the page and campaign tags the visit began with. It also remembers that the chat has been opened, so that line of text isn't shown again.
Who else sees it
Oracle Cloud Infrastructure, which hosts the app and its database and stores the data for us.
Anthropic, whose Claude models generate the answers unless a business has chosen a Gemini model: the conversation text and the facts the assistant answers from are sent to Anthropic's API to produce the reply, the text of a business's website pages and documents to pull out those facts, and conversation text to translate set messages and summarise conversations for the business. Under Anthropic's commercial terms, Anthropic may not train its models on that content.
Google, as a backup: when Anthropic can't take a request, the same job and the same text go to the Gemini API instead, and it produces the reply for a business that has chosen a Gemini model. We use the paid Gemini API, and under Google's terms for paid services Google doesn't use those prompts or responses to improve its products.
Resend, which delivers our emails, including lead alerts to the business and the emails a visitor is sent on a business's behalf.
Twilio or Plivo, which would deliver lead alerts by text message once text alerts are switched on. They aren't switched on yet, so neither receives any data today.
PayPal, Razorpay (payments in rupees, in India) and Stripe, which take payment for subscriptions. We never see or store your card number, UPI details or PayPal login.
Google, through Google Tag Manager on our own website, for the measurement tools it loads there.
A business's own connected tools, if they choose to connect them: their calendar, a webhook they point at their own systems, or a Slack, Microsoft Teams or Google Chat channel they send their lead alerts to.
A business's own booking platform (Calendly, Cal.com, Acuity, Setmore or YouCanBookMe), if the business uses one and a visitor asks to book. Its booking page is then shown inside the chat, loaded by the visitor's browser straight from that platform, which may set its own cookies and applies its own privacy terms. If the visitor has already given the chat a name or email, those are passed to the booking page so its form starts filled in.
The notification service built into a business owner's own browser (run by Google, Apple, Mozilla or Microsoft), if they turn on alerts on a phone or computer. It carries each alert to that device encrypted; the alert names the customer and holds none of their contact details.
We do not sell anyone's data, and we do not share it for advertising.
Where it's stored, and transfers outside the EU and UK
The app and its database run on Oracle Cloud Infrastructure in India (Mumbai).
Some providers also process data in the United States: Google, Anthropic (only for a business that has chosen one of its models), Resend, PayPal, Stripe, and Twilio or Plivo once text alerts are switched on, which they aren't yet.
When personal data from the European Economic Area, the UK or Switzerland goes to a country without an adequacy decision, it's protected by the European Commission's Standard Contractual Clauses (with the UK Addendum) or equivalent safeguards in each provider's data processing terms, or by the EU-U.S. Data Privacy Framework where a provider is certified under it.
For example, Resend's data processing terms include the Standard Contractual Clauses and the UK Addendum, and Resend is certified under the EU-U.S. Data Privacy Framework. Oracle's transfers are covered by its Binding Corporate Rules for Processors or the Standard Contractual Clauses.
Anyone can ask us for a copy of the safeguards that apply, using the address on our contact page.
How long it is kept
Conversations and leads are kept for the business, so they can act on them, until the account is deleted, or for a shorter time the business chooses in its settings: 3, 6, 12 or 24 months.
A demo that is never claimed is deleted after 30 days.
Enterprise inquiries are kept until you ask us to delete them.
Abuse-prevention records are deleted within a day.
Deleting an account erases its businesses, conversations, leads and connected credentials.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it.
Owners can delete their whole account themselves, from the page listing their assistants.
A website visitor should ask the business they were chatting with; we will help that business answer.
Who we are
- Registered business name
- AI Chat Bot
- Registered address
- Ward No.1, Nehuta, P.O - Kusha, P.S - Dobhi, Gaya, Bihar, India, 824220
- info@ai-chat-bot.co
- Phone
- +91 97164 36697