What happens to the conversations.

What is stored

Conversations are stored as text: the messages, a short summary and any contact details a visitor chose to give. We also keep which pages the visit included, so you can follow the whole visit in your inbox.

• Voice calls are not recorded. No audio is stored, by us or by our voice provider.
• Visitor IP addresses are not stored as such, only as a keyed hash used for rate limits.
• Files you upload as knowledge are passed to our AI provider for search and are not kept on our servers.

How long it is kept

You decide how long conversations, visits and leads are kept: from 3 to 36 months, 12 by default. Older data is deleted automatically. A lead counts from its last change, so an open deal isn’t lost.

• If a visitor asks you to delete their data, you find it by email address or phone number and delete it in one step, including the copies at our AI provider.
• You can delete a single conversation or lead at any time.
• Closing your account deletes your assistant, its knowledge sources and all conversations and leads.

Who processes it

The assistant runs on ElevenLabs, which provides the speech, the language model and the search over your knowledge sources. ElevenLabs processes conversations in the United States and keeps transcripts for 90 days; it is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement includes the EU standard contractual clauses. Lead alerts go out through our email provider, and payments are handled by Polar.

• Each business gets its own assistant and its own knowledge folder.
• Your knowledge sources are used only by your assistant.

What visitors see

Every chat window says that answers are generated by AI, and the assistant says it is an AI assistant when asked. Add a link to your privacy notice and it appears under the chat and next to the contact form, whose consent box must be ticked before anything is sent. The consent is recorded with the lead: when it was given, the text the visitor saw, your privacy link and the page.

What the assistant won’t do

It won’t guess prices, dates or guarantees. It asks for contact details only after it has helped, one at a time, and doesn’t insist. It opens only pages from your own site, and it treats the text on your pages as information, never as instructions.

How the chat window is protected

The chat window loads only on your website’s domain and its subdomains. Each text chat opens through a single-use signed link and each call through its own token, so the keys to the assistant never reach the browser. Webhooks are signed in both directions, stored secrets such as Slack addresses are encrypted, and every public endpoint is rate-limited per visitor and per IP address.

Your panel account

Sign-in uses a secure cookie that scripts on the page can’t read, and sign-in sessions are stored only in hashed form. After five failed attempts, sign-in pauses for 15 minutes.

In the visitor’s browser

The chat window sets no cookies. It keeps a random visitor ID in the browser’s local storage, created only when the visitor first writes, calls or sends the form, and keeps the open conversation in session storage so it carries on across your pages.