Privacy Policy

We collect information directly from you when you register an account, configure support channels, upload knowledge base materials, or communicate with our team. Account & Profile Data: Full name, business email address, workspace name, a hashed copy of your password, and billing contact details. Support & Channel Data: Chat conversation logs, ticket history, end-user feedback, and customer metadata transmitted through our live-chat widget or connected messaging channels. Knowledge Base Assets: Documentation, support articles, FAQ lists, and file uploads supplied to configure your workspace retrieval index. Technical & Diagnostic Logs: IP address, browser type, device information, access timestamps, and error traces necessary for platform security and debugging.

We use the collected information exclusively to fulfill our contractual commitments and operate our service: - To route customer inquiries to assigned autonomous support agents or human operators. - To generate context-aware conversational replies using your workspace knowledge base. - To maintain multi-turn conversational memory within customer sessions. - To monitor system health, detect abuse, and prevent unauthorized account access. - To process recurring subscription charges and manage billing transactions.

To write a reply, we send the customer's message, recent messages from the same conversation, and the matching passages from your knowledge base to a large language model (LLM) provider. By default this is the provider we configure for the platform: Hugging Face, or one of OpenAI, Google Gemini, DeepSeek, Qwen, Cloudflare Workers AI, OpenRouter or NVIDIA. On the Premium plan you can connect your own provider and API key instead, and that provider then receives this data under your own agreement with it. Model training: LayBuild AI does not use your conversations, support tickets or knowledge-base files to train or fine-tune models. Each LLM provider handles the data it receives under its own API terms, so check the data-use policy of any provider you choose.

LayBuild AI includes these data protection controls: - PII redaction in AI replies: When this setting is on (it is on by default), card numbers, US Social Security numbers, email addresses and phone numbers in AI-generated replies are replaced with [REDACTED] before the reply is sent. Redaction does not apply to customer messages: what a customer types is sent to the LLM provider as written. - Prompt-injection checks: Incoming messages are checked against known prompt-injection patterns, and matching messages can be blocked. When the optional scoring check is turned on, each message also gets a prompt-injection risk score. - Workspace separation: Every document, embedding and conversation is stored with your workspace ID, and the application filters its database queries by that ID.

We use these security controls: - Encryption in transit: Our website and API are served over HTTPS. - Encryption of saved secrets and files: LLM API keys and SMTP passwords you save in LayBuild AI are encrypted with AES-256-GCM. The stored copy of each knowledge file you upload is also encrypted with AES-256-GCM, using a key derived for your workspace. Your conversations, the text we extract from uploaded files, search embeddings and our database backup are not covered by this application-level encryption. - Passwords: Account passwords are stored as hashes, not in readable form. - Account security: Two-factor authentication is available for user accounts, and actions such as account deletion requests are recorded in an audit log. - Bot mitigation & human verification: We protect authentication, invitation, and public submission endpoints against credential stuffing and automated abuse using Cloudflare Turnstile. When invisible verification mode is enabled, client signals are evaluated in the background without interactive challenge puzzles, in accordance with Cloudflare's Turnstile Privacy Addendum. - Hosting: Our application servers and database run on Amazon Web Services (AWS). AWS publishes its own security certifications. Those certifications cover AWS, not LayBuild AI.

These third-party providers process data so we can run the Service: - Hosting: Amazon Web Services (AWS) runs our application servers and database. - File and backup storage: Cloudflare R2 stores the encrypted copies of uploaded knowledge files and our weekly database backup. - Bot detection & abuse prevention: Cloudflare Turnstile protects sign-in, account registration, password resets, invitation acceptance, and public contact forms from automated bots, credential abuse, and malicious traffic. Turnstile evaluates non-interactive client telemetry and browser signals (including IP address, HTTP request headers, and device characteristics) to distinguish human users from automated threats without interactive puzzle challenges. As a condition of enabling invisible mode, telemetry is collected in the background in accordance with Cloudflare's Turnstile Privacy Addendum. - Language model inference: The LLM provider configured for the platform (Hugging Face by default, or OpenAI, Google Gemini, DeepSeek, Qwen, Cloudflare Workers AI, OpenRouter or NVIDIA). If you connect your own provider on the Premium plan, that provider processes your data under your agreement with it. - Payments: PayU processes subscription payments from customers in India, and Stripe processes them for customers outside India. You enter card details on the processor's checkout, and we do not store card numbers. - Email: Our email delivery provider (SMTP) sends account, invitation and notification emails. - Messaging: Meta's WhatsApp Cloud API, only if you connect a WhatsApp channel. - Product analytics and error tracking: PostHog receives usage events, error reports and metadata about AI requests (model, timing and token counts). The text of customer messages and AI replies is not sent to PostHog. In the browser, PostHog loads only if the visitor accepts analytics cookies. - Website analytics: Google Analytics and Microsoft Clarity measure how our website is used, and load only if the visitor accepts analytics cookies. See our Cookie Policy.

We keep account data, knowledge-base documents and conversation logs while your workspace subscription is active. End-customer data: Each workspace can set a retention period in its organization settings. When one is set, conversations (with their messages and ratings) whose last activity is older than that period, and AI memories older than it, are deleted every day. If no period is set, this data is kept until the workspace deletes it. Workspace admins can also erase one customer's data at any time from Data requests, and a customer who withdraws consent has their data erased. Records of these actions are kept in the audit log for at least one year. Account deletion: When you request deletion of your own account in account settings, it is scheduled for deletion and you have 30 days to cancel. After that, your name, email, phone number and password are removed from the account, sign-in is blocked, and AI memories about you are deleted. Conversations you handled as a team member stay with the workspace. Workspace data is deleted when the workspace itself is deleted. We keep one database backup, replaced each week, so deleted data can remain in that backup for up to 7 days after it is deleted. Aggregated data that does not identify anyone may be kept to monitor system reliability.

Your data may be processed in countries other than your own, including the countries where our hosting, storage and LLM providers operate. If you need a data transfer agreement for your organization, contact us at [email protected].

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and where they apply the EU GDPR and California CCPA/CPRA, you have these rights over your personal data: - Access: A summary of the personal data we hold about you and how we process it, and the other data fiduciaries and processors we have shared it with. - Correction and completion: Fix inaccurate or incomplete details. - Erasure: Have your personal data deleted when it is no longer needed or you withdraw consent, unless the law requires us to keep it. - Withdraw consent: You can withdraw consent as easily as you gave it. Withdrawal does not affect processing done before it. - Grievance redressal: Raise a complaint with us. We respond within 90 days. If you are not satisfied, you can complain to the Data Protection Board of India. - Nominate: Name another person to exercise these rights for you if you die or become unable to. Who to contact depends on your relationship with us: - Workspace users and website visitors: LayBuild AI is the data fiduciary. Contact [email protected]. - Customers of a business that uses LayBuild AI (for example, if you chatted with a company through its website widget or WhatsApp): that business is the data fiduciary and LayBuild AI processes the data on its behalf. Before you chat, the business shows you a notice saying what it collects and why, and asks for your consent. You can withdraw consent from the chat itself ("Withdraw consent" in the chat widget, or by sending "DELETE MY DATA" on WhatsApp), which erases your data in that business's workspace. For other requests, contact the business. Its admins can export, correct or erase your data from LayBuild AI. If you cannot reach the business, contact us and we will pass the request on. We do not sell personal information or share it for cross-context behavioural advertising.

We use a sign-in cookie and browser storage to keep you signed in, keep chat widget conversations going and remember settings. These are always on because the Service needs them. Google Analytics, Microsoft Clarity and PostHog are optional. They load only after you choose "Allow analytics" in the cookie banner, and never inside the chat widget on another company's website. A Global Privacy Control signal from your browser counts as a refusal. You can change your choice at any time from "Cookie settings" in our website footer. We do not use advertising cookies. See our Cookie Policy for the full list.

In the event of a confirmed security incident resulting in unlawful access to, disclosure of, or alteration of personal data, LayBuild AI will notify affected workspace administrators without undue delay, and within 72 hours of becoming aware of the incident, providing details regarding the nature of the event, affected data scope, and remediation measures.

The Service is intended for organizations and for individuals aged 18 and older. We do not knowingly collect personal data from children (under 18 under the DPDP Act) for our own purposes without verifiable consent from a parent or lawful guardian, and the same applies to persons with disabilities who act through a lawful guardian. If we learn that we have done so, we delete that data. Businesses that use LayBuild AI to support children are responsible for getting that consent from their customers.

We may modify this Privacy Policy to reflect updates in our technical architecture, legal obligations, or product features. For material changes, we will provide advance notice via email or a prominent notification within the workspace console. Continued use of the Service following published updates constitutes acknowledgment of the revised terms.

If you have questions, feedback, or concerns regarding this Privacy Policy or our data handling practices, please contact us: Email: [email protected] Security & Vulnerability Reports: [email protected] Address: LayBuild AI Platform, Data Protection Office