Privacy Policy

This Privacy Policy explains how Vuntiq("we", "us", "our") collects, uses, shares, and protects information in connection with the AI Smart Chat platform and embeddable chat widgets (the "Service"). It applies to workspace owners and members ("Customers") and to people who interact with a Customer's chat widget ("End Users").

1. Who we are

Vuntiq is the data controller for Customer account data and acts as a data processor for the content Customers upload and the conversations their End Users have with their chatbots. For privacy questions, contact hello@vuntiq.com.

2. Information we collect

• Account & workspace data: name, email, password (stored only as a salted hash), workspace name, role, and language preference.
• Customer content: documents, FAQs, knowledge sources, chatbot configuration, custom tools, and connected data-source metadata you provide.
• Conversations: messages exchanged with chatbots, including messages from your End Users.
• Billing data: plan, subscription status, invoices, and payment records. Card details (when card payments are enabled) are handled by our payment processor, not stored by us.
• Technical & usage data: IP address, browser/user-agent, timestamps, request logs, and aggregate usage counters used for security, rate limiting, and billing.

3. How we use information

• To provide, operate, secure, and improve the Service.
• To generate AI responses and embeddings from your content (see §5).
• To authenticate users, prevent abuse, and enforce plan limits.
• To send transactional email (verification, password reset, billing, security notices).
• To comply with legal obligations and maintain audit records.

4. Legal bases (GDPR)

Where the GDPR or equivalent law applies, we process personal data on the bases of: performance of our contract with you; our legitimate interests in operating and securing the Service; your consent (where requested); and compliance with legal obligations.

5. AI processing & sub-processors

To answer questions and index content, we send relevant content to our AI provider (OpenAI) via its API. Per the provider's API terms, content submitted through the API is not used to train its models. We also rely on the following sub-processors:

• OpenAI — AI model inference and embeddings.
• Resend — transactional email delivery.
• DigitalOcean — cloud hosting and storage.
• Payment processor — payment handling (when card payments are enabled).

6. Sharing & disclosure

We do not sell personal data. We share data only with the sub-processors above, where required by law or valid legal process, to protect our rights and users, or in connection with a merger, acquisition, or asset sale (in which case we will notify you and any successor will honor this Policy).

7. Cookies

We use only strictly-necessary cookies: authentication cookies (aichat.access, aichat.refresh), CSRF-protection cookies, and a language-preference cookie (NEXT_LOCALE). We do not use advertising or third-party tracking cookies.

8. Data retention & deletion

When you delete your account or workspace, the data is soft-deleted immediately and permanently purged after 30 days. Audit logs are retained beyond this period as a security and compliance record. You can export your data at any time from your account settings.

9. Your rights

Depending on your location, you may have rights to access, correct, export, restrict, object to, or delete your personal data. You can exercise access, export, and deletion directly from your account, or by contacting us. Where the GDPR applies, you also have the right to lodge a complaint with your local data-protection supervisory authority. We will respond within the timeframe required by applicable law.

10. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. AI features generate content in response to your requests; they do not make eligibility or similar determinations about individuals on our behalf.

11. Communications

We send service and transactional emails necessary to operate your account. Any non-essential or promotional emails include an unsubscribe option, and opting out does not affect transactional messages.

12. Security

We protect data with encryption in transit, per-tenant database isolation (row-level security), hashed credentials, optional two-factor authentication, rate limiting, and least-privilege access controls. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures.

13. International transfers

Your data may be processed in countries other than your own, including by the sub-processors listed above. Where required, we rely on appropriate safeguards for such transfers.

14. Children

The Service is not directed to children and is not intended for use by anyone under 16.

15. Changes

We may update this Policy from time to time. Material changes will be notified through the Service or by email, and the "Last updated" date above will change.

16. Contact

For privacy questions or to exercise your rights, contact us at hello@vuntiq.com.