Privacy policy

Cite by AI Toolkit Plus lets a business add a chat assistant to its website that answers from its own documents. This page describes what personal data the service handles. Two groups of people are involved: customers (the businesses that build assistants) and visitors (the people who chat with those assistants). For visitor data, the customer decides what is collected and why, and we process it on the customer's behalf.

What we collect

Account data (customers). Email address, authentication data, organization name, plan and billing status, and Stripe customer and subscription identifiers. Payment details are entered with Stripe and are not stored in our database.

Content customers provide. Files uploaded, web pages crawled and content read from sources the customer connects, plus the text chunks and embeddings derived from them, and the customer's agent settings and action configurations.

Chat conversations and visitor data. Messages exchanged with an assistant and the answers given. For each conversation we also store the visitor's IP address and the website origin the chat ran on. The IP address is also used for per-minute rate limiting and per-day usage limits, and is kept with those daily usage counters. When a customer enables lead capture, the fields the customer defined are stored with the visitor's consent text, the page origin, the referrer and UTM campaign parameters, and may be forwarded to a webhook or CRM the customer configures. When a visitor asks for a human, the name and email they give, a summary and up to the last 20 messages (each cut to 1,000 characters) can be sent to a webhook the customer configures. Before that handoff is sent, secrets, card numbers, bank account numbers and national ID numbers are redacted; other text, including names and email addresses, is sent as written.

Marketing site measurement. Page views and button clicks on the landing page, and signup steps, tagged with the anonymous rc_vid identifier, the theme shown, the page path, the referrer website (origin only) and UTM parameters. We do not store IP addresses or user agents with these events. If you sign up, the identifier is also saved on your new organization so we can tell which theme led to the signup.

Cookies

We set the following first-party cookies.

• rc_vid: a random anonymous visitor identifier, kept for 1 year, used to measure visits and compare marketing page themes.
• rc_variant: the marketing page theme you were shown, kept for 90 days, so the page looks the same when you return.
• Authentication session cookies (set by Supabase, names beginning sb-): keep customers signed in to the dashboard. They are set when you log in.

The two rc_ cookies are not set, and no measurement event is recorded, when your browser sends a Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1) signal.

Who processes data on our behalf

We use the following providers. Each receives only what its function needs.

• Supabase: database, authentication and file storage.
• Vercel: application hosting, and an isolated temporary sandbox used to convert some document formats.
• Upstash: Redis service used for per-minute rate limiting.
• Anthropic: language models that write answers (when an agent is set to use them).
• OpenAI: language models, and text embeddings (when an agent is set to use them).
• Voyage AI: text embeddings (when an agent is set to use them).
• Stripe: subscription billing and payments.

Customers can also connect their own sources (Google Drive, Microsoft 365, Notion). When you connect one, we read the content you authorize through that provider's API and store an encrypted access credential so we can keep it in sync.

A visitor's question and the passages retrieved from the customer's documents are sent to the language model provider the customer chose for that agent to produce an answer. Document text is sent to the embeddings provider chosen for that agent to make it searchable. Before indexing, customers can review sensitive passages and choose to include, redact or exclude them.

Retention

• Account data, documents, agents and conversations are kept until they are deleted by the customer or on request.
• Leads are kept for the retention period the customer configures (default 365 days, between 1 and 3,650). Expired leads for an agent are removed when a new lead is captured for it, and customers can delete a lead at any time.
• Marketing measurement events are kept for experiment analysis.

Where data is processed

Data is stored with Supabase and processed by the providers listed above, which host it on their own infrastructure.

Your choices and deletion requests

Customers can delete leads in the dashboard and disconnect connected sources. To ask for access to, correction of or deletion of personal data, including as a visitor who chatted with a customer's assistant, contact us at [contact email to be added before publication]. For visitor data we may need to refer you to the business whose site you used, because that business controls the data.

Security

Data is scoped to the customer's organization and transmitted over HTTPS. Outbound webhooks are signed when the customer sets a signing secret, and requests to customer systems are restricted to public https endpoints. No system is perfectly secure and we cannot guarantee against unauthorized access.

Changes and contact

We will update this page when practices change. Questions: [contact email to be added before publication].