Last updated 2026-09-16
Who this covers
Two sets of people: the business owners who sign up, and the visitors who chat with an assistant on a business's website.
For owners, we are the data controller. For their website visitors, the business is the controller and we process on their behalf.
What we collect from business owners
Your email address, your name if you give one, and your password in hashed form.
Your business website address, and the content we read from your public pages to build your assistant.
The phone number and email address you choose for lead alerts, your opening hours, and your settings.
Billing details are handled by our payment provider; we never see or store your card number.
What we collect from website visitors
The messages they send to an assistant and the replies it gives.
Contact details they choose to give in the conversation, such as a name, phone number, email address or address, so the business can reply.
A random visitor id kept in their browser, so a returning visitor is not asked the same questions twice.
An IP address is used briefly to limit abuse of the chat endpoint.
What we collect when you ask about Enterprise
The name, email, company, number of locations and message you send with the Enterprise form, so we can reply.
An IP address is used briefly to limit abuse of the form.
Cookies and browser storage
We use no advertising or analytics cookies, and we do not track anyone across other websites.
Owners signing in get a session cookie. Connecting a calendar sets one short-lived cookie to keep that connection safe.
The widget keeps a random visitor id in the browser's own storage, and, if the business is measuring results, which group that visitor is in.
Who else sees it
Our database and hosting providers, who store the data for us.
Google, whose models generate the answers: the conversation text is sent to their API to produce a reply, and the text of a business's website pages is sent to it to pull out the facts the assistant answers from.
Our email and text message providers, to deliver lead alerts to the business.
Our payment provider, for subscriptions.
A business's own connected tools, if they choose to connect them: their calendar, or a webhook they point at their own systems.
We do not sell anyone's data, and we do not share it for advertising.
How long it is kept
Conversations and leads are kept for the business, so they can act on them, until the account is deleted.
A demo that is never claimed is deleted after 30 days.
Enterprise inquiries are kept until you ask us to delete them.
Abuse-prevention records are deleted within a day.
Deleting an account erases its businesses, conversations, leads and connected credentials.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it.
Owners can delete their whole account themselves, from the page listing their assistants.
A website visitor should ask the business they were chatting with; we will help that business answer.
Who we are
AI Chat Bot. hello@ai-chat-bot.co