Privacy Policy — Labto AI

1. Information We Collect

To deliver AI chatbot services for your website, Labto AI collects the following categories of information:

• Account Details: Name, business/personal email address, and authentication credentials, managed via encrypted session cookies.
• Payment Information: When you subscribe to a paid plan (one-time purchase or recurring subscription), our payment processor, Polar.sh, collects and processes your billing details. Labto AI does not store full payment card numbers on its own servers (see Section 5).
• Publicly Available Website Data: We only access information that a Site Owner has already made publicly visible on their own website - such as page content, product listings, blog posts, FAQs, and policy pages - ingested manually or crawled automatically via Puppeteer. We do not access private databases, admin panels, or any non-public systems belonging to a Site Owner.
• Knowledge Base Documents: Files or text that a Site Owner voluntarily uploads to train their AI assistant (e.g., PDFs, docs, custom Q&A content). This content is used only to power that Site Owner's own chatbot.
• Visitor Interactions: Natural language chat queries submitted by website visitors, AI-generated responses, and transient conversation session IDs.
• Technical & Geolocation Metrics: Anonymized visitor IP addresses processed via IP geolocation services, used solely for aggregate country- and city-level analytics inside the Site Owner's console.
• Website Usage Analytics: We use Google Analytics (GA4) on our own marketing website (labtoai.com) to understand where visitors come from and how they interact with our site. This is separate from the AI chat widget and does not track individual visitors interacting with the widget on a Site Owner's website.

2. How We Use Your Information

We process collected data exclusively to operate, maintain, and optimize the chatbot service:

• Generate relevant, context-aware AI responses using vector embeddings built from publicly crawled content and uploaded knowledge base documents.
• Ground AI answers in the Site Owner's own published content and knowledge base to reduce inaccurate or fabricated answers.
• Support optional e-commerce features, such as product recommendations and cart-assist actions, for Site Owners who run online stores.
• Track subscription plan tiers, usage quotas, and billing.
• Process payments for one-time and recurring purchases via Polar.sh.
• Analyze aggregate traffic and performance on our own marketing website via Google Analytics.
• Communicate with account holders about their account, service updates, or support requests.

3. AI Model Training & Tenant Isolation

Your site data is protected by strict, tenant-isolated storage:

• All crawled content, uploaded knowledge base documents, and vector embeddings are segregated using tenant-isolated database keys, so one Site Owner's data is never visible to another.
• Zero Public LLM Training: Your website content, uploaded documents, and visitor chat logs are never shared across accounts, and are never used to train public third-party foundation AI models.

4. Cookies & Local Storage

Labto AI uses the following storage mechanisms:

• Account Session Cookies: Encrypted, HttpOnly cookies used to secure account/dashboard logins.
• Widget LocalStorage: Client-side browser localStorage, used by the embedded chat widget to preserve conversation continuity for a visitor during a single browsing session. This is not used to track visitors across third-party domains.
• Analytics Cookies (GA4): Google Analytics sets cookies on our marketing website to measure traffic sources and site usage. You can opt out using your browser settings or the Google Analytics Opt-out Browser Add-on.

5. Third-Party Data Processors & Infrastructure

We partner with the following infrastructure and service providers:

• AI Providers (OpenAI compatible & Google and fallback LLMs): Real-time natural language query processing, under enterprise API zero-data-retention terms.
• Cloud Storage & Database (PostgreSQL): SOC 2–compliant PostgreSQL hosting for crawled content, uploaded documents, and vector embeddings, with AES-256 encryption at rest. We do not have access to any Site Owner's own internal or private databases — only to the data described in Section 1.
• Payment Processing (Polar.sh): PCI-DSS Level 1–compliant payment gateway, supporting both one-time and recurring (subscription) payments. Labto AI never stores full credit card numbers on its own servers; Polar.sh's own privacy policy governs how they handle your payment data.
• Website Analytics (Google Analytics, GA4): Google LLC processes aggregated, pseudonymized website usage data on our behalf for our own marketing site, subject to Google's privacy policy and data processing terms.

6. Data Retention

• Chat & session data: Visitor conversation session IDs and related chat logs are retained for [X days/months], after which they are deleted or anonymized.
• Crawled content & knowledge base documents: Retained for as long as your account remains active, or until you request deletion.
• Billing records: Retained as required by applicable tax and accounting laws, typically [X years].
• Analytics data: Google Analytics data is retained according to our configured GA4 retention settings (Google's default is 14 months).

7. International Data Transfers

Your information may be processed and stored on servers located outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect data transferred internationally.

8. Your Data Rights (GDPR / CCPA)

Under applicable data protection laws (GDPR, CCPA, and similar), account holders maintain full ownership of their site data:

• Right to Access: View and export crawled content, uploaded documents, and conversation history at any time.
• Right to Delete: Remove crawled pages, delete uploaded knowledge base documents, delete indexed vectors, or close your account directly from your account settings.
• Right to Correct: Update inaccurate account or knowledge base information at any time.
• Right to Object/Restrict: Contact us to object to or restrict certain processing of your data, subject to legal limitations.

To exercise any of these rights, contact us at contact@labtoai.com.

9. Children's Privacy

Labto AI's services are intended for use by businesses, creators, and individuals aged 18 and older who own or manage a website. We do not knowingly collect personal information from individuals under the age of 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

10. Data Security

We implement industry-standard technical and organizational measures — including encryption at rest (AES-256) and in transit, tenant-isolated data storage, and encrypted HttpOnly session cookies — to protect your information. No system is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our dashboard/website. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at: