Working Hours: Sunday – Thursday, 10am – 6pm (BST)
This distinction decides everything else on this page, so it comes first.
Your data as our customer. When you sign up, we decide what to collect and why — your name, work email, company, billing records, and how you use the dashboard. For that data we are the controller.
Your visitors' data. When someone chats with the agent on your website, that conversation and any details they give belong to your relationship with them. You decide what the agent asks, what it stores and how long you keep it. For that data you are the controller and we act as your processor, handling it on your instructions only.
Account: name, email address, password hash, company name, the role you are assigned, and the team you belong to.
Billing: plan, billing interval, invoices, payment status and subscription dates. Card details are handled by our payment provider and never reach our servers.
Technical: IP address, browser and device information, and timestamps, recorded in server logs when you use the dashboard or API.
Support: the content of any message you send us.
Knowledge you upload to train an agent — text you paste, pages we fetch from URLs you nominate, and structured data you push. We store it, split it into passages and generate embeddings so relevant passages can be retrieved.
Conversations between your visitors and the agent, stored as tickets with their messages, timestamps and status.
Contact details a visitor gives in a conversation — name, email address and phone number — which become a lead in your dashboard with the transcript attached.
Files a visitor uploads, including payment receipts for a booking, stored on the storage backend configured for your account.
Booking details where you have connected an availability API or a webhook: the room or item, the dates, and the amount.
To provide the service you signed up for: answering visitors from your knowledge base, routing conversations to your staff, capturing leads and running the campaigns you create.
To bill you and to keep accounting records.
To keep the service secure and available — rate limiting, abuse detection, diagnosing faults.
To contact you about your account, security matters and material changes to the service. Marketing email from us is separate and you can unsubscribe at any time.
We do not sell personal data, and we do not use your knowledge base or your visitors' conversations to train any general-purpose model.
Language model provider. To generate an answer we send the visitor's question, recent conversation turns and the retrieved passages from your knowledge base to a large language model API, and we generate embeddings the same way. Only what is needed for that reply is sent.
Messaging channels. Where you enable them, we send notifications through WhatsApp and Slack — for example when a visitor asks for a human or a booking confirms. The notification carries only what the alert needs.
Real-time delivery. A websocket service delivers live messages between the widget and your dashboard.
Email delivery. A transactional email provider sends account email and the campaigns you create.
Hosting and storage. Our servers, database and file storage. Uploaded files sit on the storage backend configured for the account.
A current list of named sub-processors, with their locations, is available on request from the address at the foot of this page. We put a data-processing agreement in place with each of them.
Data is held on our hosting provider's infrastructure. Sending a question to a language model provider may involve a transfer outside your country; where that happens we rely on the safeguards in our agreement with that provider.
Account and billing records are kept while your account is active, then for as long as tax and accounting law requires.
Knowledge bases, conversations, leads and uploaded files are kept until you delete them or close your account. After cancellation you have thirty days to export, after which we delete them from live systems; backups age out on their own cycle.
Server logs are kept for a short operational period and then discarded.
Passwords are stored hashed. Access inside the dashboard is governed by roles and permissions you assign, so a team member only reaches what their role allows.
Each registered website gets its own widget key and secret key, and the widget is only served to the address you registered and its subdomains — a snippet lifted onto an unrelated domain is refused. You can rotate a website's keys at any time without affecting your other websites.
No system is perfectly secure. If a breach affects your personal data we will notify you, and any regulator we are required to notify, without undue delay.
The marketing site stores your industry choice in your browser's local storage so the page stays relevant on your next visit. Nothing about it identifies you and it never leaves your browser.
The chat widget stores a session identifier so a conversation survives a page reload. The dashboard sets a session cookie needed to keep you signed in.
We do not run advertising or cross-site tracking cookies on this site.
You may ask us for a copy of the personal data we hold about you as our customer, ask us to correct it, ask us to delete it, or object to a particular use. Write to the address below and we will respond within the period the law allows.
If your request concerns a conversation on one of our customers' websites, that customer is the controller — contact them directly. If you contact us instead, we will pass your request on and support them in answering it.
You also have the right to complain to your local data protection authority.
The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, write to us and we will remove it.
We may update this policy. The date at the top of the page shows when it last changed, and we will notify account holders by email before a material change takes effect.
Privacy questions and data requests: info@conversaai.net. Post: ConversaAI, Mirpur 12, Road 29, Block D, Dhaka, Bangladesh.
ConversaAI is an AI agent for your website — it answers customers instantly, qualifies every visitor and hands sales-ready conversations to your team, 24/7.
Copyright 2025 ConversaAI. Inc.