Privacy

Last updated 22 October 2026

Site Assistant adds an AI assistant to websites. This policy explains what personal data we handle, why, and how we protect it. Questions or requests: hi@alfred-polycarpe.com.

Two roles

• Customers: businesses that create an account. For their account data we are the controller, as described on this page.
• Visitors: people who chat with an assistant on a customer's website. The customer is the controller of those conversations; we process them on the customer's behalf under our data processing agreement. The customer's own privacy policy explains their use.

What we process, why, and on what legal basis

• Account: email address, a bcrypt hash of your password (we never see the password), and when you accepted which version of the terms. To provide the service (contract).
• Billing: plan, usage counts, your billing details (name or company, address, country, VAT number), your invoices and your Mollie customer ID. Mollie processes your payments; we never see card or bank details. For the contract and to meet tax law (legal obligation).
• Your assistants: settings, the information you add, and the public content of your website. To provide the service (contract).
• Conversations (for customers): what visitors ask, the answers, the page and the time. No names, accounts or tracking cookies are attached.
• Referrals and partners: which account referred which, rewards given, and partner commission per invoice (kept 7 years for tax). For the referral program (contract) and bookkeeping (legal obligation). Referral links carry a code in the address; no cookies are used.
• Service emails: we email customers about their account, such as when their assistant nears its monthly limit, or about referral rewards. These are part of the service (contract); we don't send newsletters without asking.
• Security: hashed counters to limit abuse (kept for a day), and server logs with IP addresses kept by our hosting provider for a short time. To keep the service secure (legitimate interest).
• “Try it on your website”: the address you enter, a few public pages of that site and a temporary assistant, deleted after 24 hours. Conversations in a preview aren't stored. To show you the product (legitimate interest). For sites that can't be shown in a frame, Microlink makes a screenshot of the public page.

We don't sell data, show ads, build profiles or use tracking cookies. We don't make automated decisions about people.

AI

The assistant always tells visitors it's an AI (EU AI Act, article 50). Answers are written by OpenAI's models from the customer's website and notes. OpenAI doesn't use API data to train its models.

How we protect data

• Conversations are encrypted (AES-256-GCM) before they're stored, with a key kept separately from the database.
• Card numbers, bank account numbers and Dutch BSNs that visitors type are removed before anything is sent to the AI or stored.
• Conversations are deleted automatically after the period the customer chooses: 7, 30 or 90 days, or 1 year (90 days by default).
• All traffic uses HTTPS. Sign-in is protected against password guessing, and changing a password signs out every other device.
• Hosting and the database are in Frankfurt, Germany.

Who processes data for us

• Vercel Inc.: Hosting of the app. Servers in Frankfurt, Germany (EU). Company in the US: EU-US Data Privacy Framework and Standard Contractual Clauses.
• Neon Inc. (Databricks): Database. Frankfurt, Germany (EU). Company in the US: Standard Contractual Clauses.
• OpenAI: Writing answers and reading meaning from text (embeddings). US, or the EU where OpenAI's European data residency is enabled. Standard Contractual Clauses. API data isn't used for training.
• Mollie B.V.: Payments (customer data only, no visitor data). Amsterdam, the Netherlands (EU).
• Resend Inc.: Service emails to customers, such as confirming their address, password resets and usage warnings (customer email addresses only, no visitor data). Company in the US: Standard Contractual Clauses.
• Microlink: screenshots of public websites for “try it” previews. Receives only the website address.

Cookies and storage

Signed-in customers get one strictly necessary cookie that keeps them signed in. The chat on websites keeps a random conversation ID in the browser tab's session storage so a conversation continues across pages; it disappears when the tab closes. Both are strictly necessary for what you asked for, so no consent banner is needed.

How long we keep data

• Conversations: as chosen by the customer (see above).
• Account and assistants: until you delete your account, which removes them immediately. Backups are overwritten within 30 days.
• Invoices: kept for as long as tax law requires (7 years in the Netherlands), also after you delete your account.

Your rights

Under the GDPR you can ask to access, correct, export or delete your data, to restrict its use, and object to processing based on legitimate interest. Customers can export and delete conversations and delete their account themselves in the dashboard. Visitors: please contact the website you chatted on, or us at hi@alfred-polycarpe.com; we'll pass your request on. We reply within one month. You can also complain to your data protection authority; in the Netherlands that's the Autoriteit Persoonsgegevens.

Data breaches

If a breach puts personal data at risk, we report it to the Autoriteit Persoonsgegevens within 72 hours, tell affected customers without delay, and inform the people involved when the risk is high.

Children

Site Assistant is for businesses and isn't aimed at children.

Changes

We announce material changes to this policy by email to customers before they take effect.

Site Assistant · hi@alfred-polycarpe.com