How InsertChat handles assistant data

• No Sale of Personal Data: We do not sell or rent customer or visitor personal data.
• Transparent Processing: We disclose the service providers and third-party AI systems used to deliver requested features.
• Robust Security Measures: We use encryption, access controls, monitoring, and contractual protections for service providers.

We collect data to provide, improve, and personalize our services when you:

• Visit our website at https://insertchat.com or associated sites.
• Engage with us through sales, marketing, or events.
• Participate in activities on our Services.

Personal Data Provided by You:

• Voluntary Information: Includes email addresses, passwords, and payment data (processed by Stripe, see Stripe Privacy Policy).
• Account and Authentication Data: Necessary for account creation, access, and maintenance.

Automatically Collected Data:

• Technical and Usage Information: Includes IP addresses, browser details, operating systems, usage data, and interaction logs. This data is collected primarily for security, analytics, and service improvement.

We process your data under the following legal bases, compliant with the GDPR and UK GDPR:

• Consent: Where you have provided explicit consent.
• Contractual Necessity: To fulfill our contractual obligations or pre-contractual requests.
• Legal Obligations: To comply with legal requirements.
• Legitimate Interests: To support our business interests in a manner that is not overridden by your rights.

• Account Creation and Management: To facilitate account creation, login, and maintain your account in working order.
• Service Delivery: To provide and improve the services you request, such as responding to your inquiries and providing support.
• Administrative Communications: To send you important updates and information about our products, services, terms, and policies.
• Security and Fraud Prevention: To maintain the security and integrity of our Services and protect against unauthorized access.
• Legal Compliance: To comply with applicable legal obligations and regulatory requirements.

We retain data only as long as necessary to fulfill the purposes outlined in this notice, or as required by law. Specific retention periods are determined based on criteria such as legal obligations, business needs, and data minimization principles. For example:

• Account Data: Retained as long as you have an account with us.
• Payment Data: Retained in accordance with accounting and tax compliance requirements.

When data is no longer needed, it will be securely deleted or anonymized.

We share data only as needed to operate the service or as required by law:

• Third-party AI providers: When you enable and use AI features, prompts, conversations, uploaded files, knowledge sources, and related account or visitor data may be transmitted through Vercel AI Gateway to the model provider you select. Available providers may include OpenAI, Anthropic, Google, Meta, DeepSeek, xAI, Alibaba, Moonshot AI, Z.ai, MiniMax, Xiaomi, and Mistral AI. Specialist processing such as reranking, transcription, document extraction, image, audio, or video generation may use Cohere, Groq, Mistral AI, OpenAI, Google, or fal.ai.
• Other service providers: We use vetted providers for cloud hosting and delivery, security, email, analytics and diagnostics, payments through Stripe, and telephony through Telnyx. They process data on our behalf under contractual confidentiality and data-protection obligations.
• Business Transfers: In the event of a merger, acquisition, financing, reorganization, or asset sale, data may be transferred subject to appropriate confidentiality and protection obligations.

InsertChat does not sell personal data or permit third-party foundation-model providers to train their models using customer content submitted through our service.

We implement comprehensive technical and organizational measures to secure your data, including:

• Industry-leading encryption for data in transit and at rest.
• Regular security audits and continuous monitoring.
• Stringent access controls to ensure only authorized personnel have access to data.

Despite our best efforts, no method of electronic transmission or storage is completely secure. Therefore, while we strive to protect your data, we cannot guarantee its absolute security.

Depending on your location, you have various rights regarding your personal data, including:

• Right to Access: To request access to your personal data.
• Right to Rectification and Erasure: To correct or delete your data.
• Right to Restrict Processing and Object: To restrict or object to the processing of your data.
• Right to Data Portability: To request a copy of your data in a portable format.

15.1 California Residents

California Civil Code Section 1798.83 (Shine The Light law) allows California residents to request information about personal data disclosures for direct marketing purposes. California residents can also request the removal of unwanted data posted publicly. Please visit our contact page to exercise these rights.

15.2 Virginia Residents

Under the Virginia Consumer Data Protection Act (CDPA), Virginia residents have specific rights related to accessing, correcting, deleting, and opting out of the processing of their personal data. To exercise these rights, please use our contact page.