This Privacy Policy describes how Aivastark ("we," "us," or "our") collects, uses, stores, and shares information when you use our white-label AI support chatbot platform (the "Service") at www.aivastark.com. By using the Service, you agree to the practices described here.
Received a business email from us and you are not a customer? Sections 1-8 describe how we handle data for people who use the Service. The notice that applies to you is section 9, below.
1. Information we collect
Account information. When you create an Aivastark account, we collect your name, email address, company, and password (stored hashed, never in plain text).
Knowledge base content. When you add a source (a website crawl, uploaded documents such as PDFs, hand-written FAQs, or a connected Shopify or WooCommerce store), we ingest, chunk, and embed the content into a vector database scoped to your organization.
Conversation data. Customer-facing conversations through the website widget and the channels you connect (WhatsApp, Instagram, Messenger, Telegram and email), including voice notes and documents customers send, are stored so you can review, audit, and analyze them in your dashboard.
Usage and telemetry. On our website, including the dashboard, we use Google Analytics 4 for site analytics and the Meta Pixel to measure our advertising (page views and browser details), Sentry for error monitoring and Vercel Speed Insights for performance. The mobile app collects none; see The AIVAStark mobile app.
Billing information. Payment details are processed by our payment provider; we never store full card numbers on our servers.
2. How we use information
- To provide, operate, and improve the Service.
- To generate AI responses by retrieving relevant passages from your knowledge base.
- To send transactional emails (account verification, billing receipts, security alerts).
- To detect, prevent, and respond to fraud or abuse.
- To comply with legal obligations.
We do not use your knowledge base content or conversation data to train shared foundation models. Your embeddings are scoped to your organization and are never co-mingled with other customers' data.
Google API Services — Limited Use
Aivastark's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you connect a Google account (for example, Google Calendar so the agent can book meetings, or Gmail to connect a mailbox), we use the data we receive from Google APIs solely to provide and improve that feature for you. Specifically, we do not:
- sell this data, or use it for advertising;
- transfer it to others except as needed to provide or improve the feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your consent;
- use it to train generalized or shared AI/ML models; and
- allow humans to read it, unless we have your affirmative agreement for specific files, it is necessary for security purposes (such as investigating abuse), or to comply with applicable law.
The AIVAStark mobile app
The AIVAStark app for Android and iOS lets you and your team read and answer your conversations from a phone. It signs in to the same account as the dashboard, so the rest of this policy applies to it too. This section covers what is specific to the app.
Notifications. If you turn notifications on, the app sends us this device's push token, its model and operating system version, the app version, and your time zone. We use them only to deliver notifications to this device and to respect your quiet hours. Notifications are delivered through Expo's push service and Apple's or Google's notification service. When you sign out, the app removes this device's registration, and deleting your account removes all of them.
On your device. The app stores your sign-in session and any unsent reply drafts on the device, so you stay signed in and don't lose a reply you were writing. Signing out removes both.
No ads or tracking. The app shows no ads, does not use an advertising ID, and contains no third-party analytics or tracking.
3. How we share information
We share information only with sub-processors necessary to operate the Service (e.g., infrastructure providers, LLM API providers for inference, email delivery, payments). The current list, with what each one receives, is on our sub-processors page.
We do not sell your data. Our website, including the dashboard and preview pages, uses the Meta Pixel to measure our own advertising, which shares page views and browser details with Meta. We do not share your knowledge base or conversations for advertising.
4. Data retention
Account data is retained while your account is active and for up to 90 days after cancellation, after which it is permanently deleted. You can request deletion at any time by emailing support@aivastark.com. Our account deletion page explains what we delete, what we keep and for how long.
5. Your rights
Depending on your jurisdiction (e.g., GDPR in the EU/UK, CCPA in California), you may have the right to access, correct, delete, port, or restrict the processing of your personal data. Submit requests to support@aivastark.com.
6. Security
We encrypt data in transit (TLS) and at rest. Access to production systems is restricted, audited, and protected by multi-factor authentication. Report security concerns to security@aivastark.com.
7. International transfers
We may transfer data outside your country of residence. Where required, we use Standard Contractual Clauses or equivalent safeguards.
8. Changes to this policy
We will post any updates here with a revised "Last updated" date. Material changes will be communicated via email.
9. If you received a business email from us
This section is the notice required by Article 14 of the UK and EU GDPR, which applies when personal data is obtained from somewhere other than the person themselves. It is for people who received an email from Aivastark about our product and are not Aivastark customers. Nothing here changes sections 1 to 8, which cover people who use the Service.
Who is responsible. Aivastark is the controller for this processing. Write to support@aivastark.com about anything in this section and mark it for the attention of privacy.
What we hold. Business contact details only: your name, your work email address, your employer, your job title, and publicly available information about your company. We do not hold your personal email address, your home address, your phone number, or any special category data.
Where it came from. We did not collect these details from you. They come from Apollo.io, a business contact-data provider, which compiles them from publicly accessible sources such as company websites and professional networking profiles.
Why we are permitted to use it. Our legal basis is legitimate interests, Article 6(1)(f): business-to-business marketing of a product relevant to your professional role. We have weighed that interest against your rights and interests and keep a written record of that assessment. We do not send these emails to sole traders, to personal mailboxes at consumer email providers, or to recipients in countries whose national law requires prior consent for business-to-business marketing.
Your right to object is absolute. For direct marketing there is no balancing exercise and you do not have to give a reason (Article 21(2)). Reply to the message with "stop", use the unsubscribe link in it, or use the unsubscribe button your mail provider shows. Any of the three is actioned automatically and permanently, and stops every campaign rather than the one you received.
How long we keep it. If you do not engage, your contact details are deleted within twelve months. A record of what we sent is kept for twelve months, and any reply you send for ninety days.
Erasure, and the one record we keep deliberately. You may ask us to delete your data under Article 17 and we will. One record survives, in your favour: a one-way cryptographic hash of your email address on our suppression list. It cannot be reversed to recover your address, it is used for nothing else, and it exists so that a later data import cannot re-add you and start emailing you again. Deleting it would leave us unable to reliably honour your objection.
Your other rights. You may ask for a copy of what we hold, correction of anything inaccurate, or restriction of our processing. You may also complain to your data protection authority, which in the UK is the Information Commissioner's Office.
What we do not do. We do not record whether you opened the message, we do not place tracking pixels in it, we do not rewrite its links to log clicks, we do not sell or share these details with anyone, and we make no automated decision about you that produces a legal or similarly significant effect.
10. Contact
Questions about this policy? Email support@aivastark.com.