Your content and your customers' chats stay yours
A plain account of what we protect and how, without the buzzwords.
Encrypted in transit and at rest
All traffic uses HTTPS (TLS). Data is stored in an encrypted managed Postgres database.
Each account is isolated
Database row-level security means an account can only read its own bots, content, chats and leads.
Your content is used for your bot only
Content you add is used to answer questions for your own bot. We do not sell it or use it to train public AI models.
You control deletion
Delete a source, a lead or a whole bot from your dashboard and its data is removed. Ask us to delete your account and we will.
Payments handled by Stripe
Card details go straight to Stripe. We never see or store full card numbers.
Limited access
Server keys are kept in the hosting platform's secret store and are never sent to browsers.
Questions
Which providers process data?
Hosting (Vercel), database and login (Supabase), AI model provider (OpenAI) for generating answers, email delivery, and Stripe for payments.
Is my content sent to an AI provider?
Yes. The passages needed to answer a question are sent to the AI model provider to write the reply. That is how the answer is produced.
Do you have SOC 2 or ISO 27001 certification?
Not at this time. If your company requires a specific certification, contact us before you subscribe.
Where can visitors' personal data appear?
In chat messages and in leads they submit. Both are visible only to the bot's owner.
How do I report a security issue?
Email sitetobot@gmail.com. We read every report.