Privacy policy

For this website, for sales inquiries and for the accounts of the businesses that use the product, aiyourbusiness is the data controller.

For the conversations that the customers of a business have with that business through the product (we call them "end customers"), the business is the data controller and aiyourbusiness processes the data on its behalf and on its instructions, as a processor.

You can reach us about anything in this policy at support@aiyourbusiness.online.

This policy applies to three groups of people: visitors of this website (aiyourbusiness.online), people who sign in to the product on behalf of a business ("workspace users"), and end customers who message a business through a channel connected to the product.

If you send us a demo or quote request, we collect what you type in the form: your name, business name, phone number, email address, country, the channels you want to connect, your team size, the plan you are interested in and your message.

For every request we also record technical data: a one-way hash of your IP address (used only to limit abuse of the form), your browser's user-agent string, the page you sent the form from, the language you were browsing in and, if present, the campaign parameters in the link you arrived from.

Browsing the site without sending a form does not create a profile of you. If we enable product analytics on this site, it is described in the Cookies section below.

Accounts are created by our team. For each workspace user we hold a name, email address, the sign-in method (password or Google sign-in) and, where enabled, two-factor authentication details.

For each workspace we hold the business details and settings, the assistant's instructions and knowledge (text, files, links to external sources), connected channel credentials (Meta access tokens, Google OAuth tokens and similar, stored encrypted), team roles and invitations, billing records (plan, implementation fee, subscription term, payments recorded by our team and invoices), usage counters, audit logs of changes made in the dashboard and our support correspondence with you.

When someone messages a business through a connected channel, the product receives the content of the conversation: text, images, documents, voice notes and their transcripts, reply-button taps and the profile details the platform shares with the business (such as a display name, profile picture, phone number or platform identifier).

The assistant may extract details from the conversation into the business's contact list (for example a name, a phone number, an interest, an appointment or a lead status), including custom fields the business has defined. The business decides which details the assistant asks for and what it does with them.

On the website widget, a visitor identifier is kept in the visitor's browser so a conversation can continue across page loads, and the embedding website may pass details it already knows (such as a name or email) to the widget. Comments on the business's posts and the replies to them are processed in the same way as messages.

• Messages, media, voice notes and transcripts
• Platform profile details such as name, picture, phone number or identifier
• Details the assistant extracts: name, phone, interests, status, custom fields
• Appointments and bookings made through connected calendars
• Widget visitor identifier and details passed by the embedding site

We use personal data only to run the product and this website, and we never sell it or use it for advertising.

• To generate the assistant's replies, follow-ups and comment answers on behalf of the business
• To keep the shared inbox, contact list, analytics and exports working
• To send transactional emails such as invitations, renewal reminders and channel notices
• To answer demo and quote requests and to keep in touch about them
• To protect the service: rate limiting, abuse prevention, security monitoring and audit logs
• To meet legal obligations and to enforce our terms
• To improve the product using aggregated, non-identifying usage statistics

The assistant's replies are generated by Claude, a large language model provided by Anthropic. To produce a reply, the relevant conversation, the business's instructions and knowledge, and any images or documents the customer sent are transmitted to Anthropic's API. Anthropic acts as our processor under its commercial terms and, under those terms, does not use this data to train its models.

Voice notes are transcribed by a speech-to-text provider (Deepgram, with OpenAI as a fallback) before the assistant reads them. The assistant never pretends to be a person, and the business can switch it off for any conversation.

We run the product on established cloud providers. Each of them processes data only to provide its service to us and is bound by data-processing terms.

• Supabase: database, authentication and file storage
• Vercel: hosting of this website and of the product's web application
• Railway (or an equivalent host): the background worker that processes messages, media and scheduled jobs
• Anthropic: AI replies (Claude)
• Deepgram and OpenAI: voice-note transcription
• Meta Platforms: WhatsApp Business, Instagram and Messenger APIs
• Google: Google sign-in, Google Calendar and Google Sheets when a business connects them
• Resend: transactional email
• Product analytics (such as PostHog) only if we enable it, as described in the Cookies section

Besides the sub-processors above, the data of an end customer is visible to the business they wrote to: its team sees the whole conversation and the contact record, exactly as they would if the message had arrived in the business's own WhatsApp or Instagram account.

We disclose data when the law requires it, to protect the rights and safety of our users, or as part of a merger or acquisition under the same protections. We do not sell personal data.

Our providers may store or process data outside the country you live in. Where that happens we rely on the providers' contractual safeguards for international transfers. Ask us if you need details for a specific provider.

Backups are rotated on a fixed schedule and deleted data leaves the backups when they expire.

• Demo and quote requests: for as long as we are in touch about them, and no longer than 24 months after the last contact unless you become a customer
• Workspace data (conversations, contacts, knowledge, settings): for as long as the workspace is active; after a workspace is closed, the business has 30 days to export it, after which it is deleted
• Billing records: for as long as the law requires us to keep accounting records
• Security and audit logs: up to 12 months
• Meta data-deletion requests: the confirmation code and status are kept so the status page keeps working; the deleted data itself is not kept

Data travels over encrypted connections (TLS). Channel credentials and other secrets are encrypted at rest with AES-256-GCM under a rotating key ring. Every workspace's data is isolated at the database level with row-level security, so one business can never read another's data. Access to our operations console requires two-factor authentication, and every operator action is logged.

No system is perfectly secure. If we learn of a breach that affects you, we will notify you and, where required, the competent authority without undue delay.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive a copy in a portable format and to withdraw a consent you gave.

Workspace users and website visitors can write to support@aiyourbusiness.online; we answer within 30 days. If you are an end customer, please contact the business you wrote to first, because it controls that data; we help every business honour such requests, and you can also write to us directly.

This website (aiyourbusiness.online) sets no cookies of its own; your language is part of the page address. If we enable product analytics, it will use a cookie-free or first-party configuration and this section will say so.

The product (app.aiyourbusiness.online) sets only strictly necessary cookies: your sign-in session, your language, your selected workspace and the state of the sidebar. The chat widget keeps a visitor identifier in the browser's local storage of the page it is embedded on so your conversation can continue; the website that embeds it may set cookies of its own under its own policy.

Businesses: to delete your workspace and everything in it, write to support@aiyourbusiness.online from the owner's email address. Export your data first if you want to keep it; deletion is permanent and completed within 30 days.

End customers: ask the business you wrote to, or write to us at support@aiyourbusiness.online with the channel and the number or account you used. We will delete the messages, contact record and media linked to you unless the business must keep them for a legal reason, in which case we will tell you.

Facebook and Instagram users: you can also remove aiyourbusiness from your Facebook or Instagram settings ("Apps and websites") and choose to delete your data. Meta then sends us a deletion request; we delete the data linked to your profile automatically and give you a confirmation code. You can check the status of your request at any time at https://app.aiyourbusiness.online/privacy/deletion/<code>, where <code> is the confirmation code Meta shows you.

Requests sent by email are confirmed by email once the deletion is complete.

The website and the product are intended for businesses and their adult representatives. We do not knowingly collect data from children; if you believe a child has given us personal data, write to us and we will delete it.

We update this policy when the product or the law changes. The date at the top tells you when it last changed; material changes are also announced to workspace owners by email.

aiyourbusiness · support@aiyourbusiness.online