1. Who we are
Assistline AI is provided by [legal entity name], registered at [registered address]. For personal data we decide how to use (see below), we are the controller. Privacy questions: [privacy contact email]. [If a Data Protection Officer or EU/UK representative is appointed, name them here]
2. Our role
- Account and billing data of the people who sign up for and use Assistline AI: we are the controller.
- Customer Content — the knowledge files and pages a business uploads, and the conversations its customers have with its assistant: we process this on behalf of that business, which decides why and how it is used. If you chatted with an assistant on a business’s website, that business is responsible for your data; please contact it first. [confirm processor role and DPA availability]
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored hashed), company name, workspace role, language | You, or Google if you sign in with Google |
| Billing data | Plan, subscription status, billing country, Paddle customer and subscription identifiers. We do not receive or store full card details. | Paddle |
| Customer Content | Website pages, documents (PDF, DOCX, CSV, TXT), FAQs, business profile, files and photos shared in chat | Businesses using the Service |
| Conversation data | Messages between end users and assistants or team members; contact details an end user chooses to leave (such as name, email or phone); for messaging channels, the channel’s user identifier | End users, via the widget or connected channels |
| Technical data | Browser and operating system, time zone, screen size, referring page, IP address (used for security and rate limiting), logs of requests and errors | Your device |
| Communications | Emails and support messages you send us; delivery status of emails we send you | You, our email provider |
4. How and why we use it
| Purpose | Legal basis [confirm] |
|---|---|
| Create and run your account and workspace, provide the Service | Performance of our contract with you |
| Generate assistant answers from Customer Content and route conversations to your team | Performance of our contract with the business (we act on its instructions) |
| Process subscriptions, payments and invoices (through Paddle) | Performance of contract; legal obligations (tax, accounting) |
| Send service emails: sign-in codes, invitations, notifications, billing notices | Performance of contract |
| Keep the Service secure: authentication, rate limiting, abuse and fraud prevention, logs | Legitimate interests in protecting the Service and its users |
| Provide support and respond to requests | Performance of contract; legitimate interests |
| Comply with law and enforce our terms | Legal obligations; legitimate interests |
We do not sell personal data, and we do not use it for third-party advertising. Our website does not use advertising or analytics trackers.
5. AI processing
To answer a message, the relevant parts of the business’s knowledge base and the conversation are sent to a third-party AI model provider, which returns a generated answer. We use these providers to deliver the Service only. We do not use Customer Content to train AI models of our own. [confirm each AI provider’s data-use and retention terms for API traffic before publishing]
6. Who we share it with
- Paddle (Paddle.com Market Ltd and its affiliates) — our reseller and Merchant of Record, which processes payments, invoices and taxes. Paddle handles your payment data under its own privacy notice.
- AI model providers — such as Google (Gemini), Groq and OpenRouter, to generate answers.
- Infrastructure providers — hosting ([hosting provider and server location]), content delivery and network security (Cloudflare), and email delivery (Mailgun).
- Google — if you choose to sign in with Google.
- Channels you connect — when a business connects Telegram, WhatsApp, Messenger, Instagram, Slack, Discord, Viber, LINE, Microsoft Teams, X or email, messages pass through those platforms under their own terms.
- Webhooks you configure — data the business chooses to send to its own systems.
- Professional advisers and authorities — where needed to comply with law, protect rights or respond to lawful requests.
- A buyer or successor — if our business is sold or merged, under the same protections.
[confirm the complete subprocessor list]
7. International transfers
Our providers may process data outside your country. Where the law requires it, we rely on appropriate safeguards for such transfers, such as adequacy decisions or standard contractual clauses. [confirm server locations and the safeguards in place for each provider]
8. How long we keep it
- Conversations are kept for the chat-history period of the workspace’s plan — currently 30 days on Free, 1 year on Starter and 2 years on Pro — and then deleted automatically.
- Contacts that end users leave (such as an email or phone number) are kept as the business’s records until the business deletes them or the workspace.
- Knowledge sources and files are kept until the business deletes them or the workspace.
- Account data is kept while your account exists; when a workspace is deleted, its data is deleted [confirm: immediately / within N days, including backups after N days].
- Billing records are kept as long as required by tax and accounting law.
- Security logs are kept for [log retention period].
Workspace admins can export data, delete individual conversations, erase everything a specific visitor left, and delete the whole workspace from the dashboard.
9. Security
We protect data with encryption in transit (TLS), isolation of each workspace’s data, access limited by role, hashed passwords, rate limits on public endpoints, encrypted backups and monitoring. AI provider keys never reach browsers or the chat widget. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and authorities where the law requires.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to certain processing, to withdraw consent where processing is based on consent, and to complain to a data protection authority. To exercise these rights, contact [privacy contact email]. We will respond within the time the law requires [e.g. one month]. If your data is in a business’s workspace (for example, you chatted with its assistant), we will refer your request to that business and help it respond.
11. Cookies and local storage
- Essential cookies keep you signed in to the dashboard and protect the Google sign-in flow. They are required for the Service to work.
- Local storage remembers dashboard preferences (such as theme and language) and, in the chat widget, an anonymous visitor identifier so a conversation continues across pages.
- Paddle may set cookies during checkout to process payments securely and prevent fraud.
We do not use advertising or analytics cookies.
12. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from children under [age].
13. Changes
We may update this policy. We will post the new version here with a new “last updated” date and tell account owners about material changes.
14. Contact
Privacy questions or requests: [privacy contact email], [legal entity name], [registered address].