Privacy Policy
Airrand Bots ("the Service", "we", "us") is operated by Airrand LLC. The Service lets a business put an AI chatbot on its website. This policy explains what data the Service collects, how we use it, and your rights.
1. Who this policy covers
Two different groups of people use the Service, and what applies to you depends on which you are.
The difference matters because the responsibilities differ. For account holders, Airrand decides how their data is used and is the controller of it. For visitors, the business whose website the bot is on is the controller of the conversation, and Airrand is its processor: we handle the conversation on that business's behalf.
Part A. If you have an Airrand Bots account
This part is about the people who sign up to build and run bots.
2. What we collect
- Account data: your email address, name (if you provide one), and password (stored only as a salted hash). If you sign in with Google, we receive your name, email address, and Google account identifier from Google instead of a password.
- Bot content: the description of your business, the text you paste, the files you upload, the web pages you add, and your bot's settings. These are stored so your bot can answer from them and so you can return to them.
- Payment data: payments are processed by Stripe. We never see or store your full card number. We store a reference to your saved payment method, your billing status, and a card fingerprint (an identifier Stripe derives from the card) used only to detect fraud and abuse.
- Usage data: credit balance and consumption, bot activity, and AI interaction logs, used to operate, bill, and improve the Service.
- Technical data: IP address, browser type, and timestamps, for security, rate limiting, preventing abuse, and debugging.
- How you found us: if you arrive through the "Powered by Airrand" link in a customer's chat window, that link carries the public key of the bot it was on. We keep it in your browser's local storage and, if you sign up, record it on your account so we know which bot referred you.
3. How we use it
- To provide the Service: building your bots, answering your visitors from your content, and showing you their conversations.
- To bill you and to prevent fraud and abuse (including attempts to collect the one-time welcome credit more than once).
- To troubleshoot errors and improve reliability.
We do not sell your data.
4. AI processing
The content you give your bot, and the messages your visitors send it, are processed by third-party AI model providers so that your bot can find the relevant parts of your content and write its replies. Content is sent to a model provider only as needed to do that. AI outputs may be inaccurate; see our Terms of Service.
5. Payments (Stripe)
Card entry, storage, and charging happen on Stripe's systems, governed by Stripe's privacy policy. We receive from Stripe only what we need to run your account: the payment method reference, card brand and last four digits, billing status, and the card fingerprint described above.
6. Retention and deletion
Your bots and their content are kept while your account exists, including while no subscription is active, so you can return to them. You can delete the content you added to a bot, and remove a bot, in the app at any time. To delete your account and its data, email [email protected]; we delete account data within 30 days, except records we must keep for legal, billing, or fraud-prevention purposes (such as the ledger of past transactions). Your visitors' conversations are kept for a shorter, fixed period, described in Section 12.
7. Cookies, analytics & advertising
This section is about this website and the app you sign in to. The chat widget on a customer's site is different: it sets no cookies at all (see Section 10).
- Essential cookies: a session cookie (af_sid) keeps you signed in. Required for the Service to function.
- Local storage: the app uses your browser's local storage for preferences such as theme, and for the referral key described in Section 2, and its session storage for the ad click identifier described below, for the length of your visit. Preferences stay on your device and are not used for tracking; the referral key and the click identifier are sent to us only if you sign up.
- Analytics cookies: Google Analytics 4 (measurement ID G-9QW4XBREPB, Airrand Bots' own property), to measure aggregate traffic and see which pages people find useful. It sets cookies such as _ga and _ga_* to tell one visitor from another.
- Advertising cookies: where we run paid advertising, the Google Ads tag (AW-18423317335) records that an ad we paid for led to a signup or a subscription, and sets cookies such as _gcl_* to hold the click identifier. This is measurement of our own campaigns. We do not sell your data, we do not use it to build a profile of you, and we do not use it to target you on other sites. If you arrived from an ad, the click identifier on that link is also stored against your account so we can match a later subscription back to the campaign that paid for it.
- Your choice: analytics and advertising are separate categories, and the banner lets you accept or reject each one independently. In the European Economic Area, the United Kingdom, and Switzerland, neither is set until you accept; elsewhere they start on arrival and the banner lets you reject either, in which case we stop collecting and delete what is on your device. You can change your choice at any time via the Cookie settings link, and we honor the Global Privacy Control (GPC) browser signal as a standing rejection of both, everywhere. We determine your region from the country your network connection resolves to (supplied by our CDN, Cloudflare); if we cannot determine it, we load nothing until you accept.
8. Sharing
We share data only with the processors needed to run the Service: our hosting and storage providers, Stripe (payments), the AI model providers described in Section 4, our CDN (Cloudflare), and Google, for the analytics and advertising described in Section 7 where you have not rejected them. We do not sell your data, and we do not share it with data brokers. We may disclose data if required by law.
9. Your rights
You may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing, by emailing [email protected]. If you are in a jurisdiction with statutory privacy rights (such as the EEA, UK, or California), we honor those rights as the law provides. We do not discriminate against you for exercising them.
Part B. If you chatted with a bot on a website
This part is about visitors: people who use a chat window that one of our customers has placed on its own website.
10. Who is responsible for your conversation
The business whose website you were on chose to offer the bot, decided what it knows, and can read the conversations people have with it. That business is the controller of your conversation, and its own privacy notice explains what it does with it. Airrand provides the chat service to that business and handles your conversation on its behalf, as its processor.
The chat window's options menu tells you that you are talking to an AI assistant and that what you write is saved by the website and by Airrand. It links to the website's own privacy policy where the business has given one, and to this part of ours otherwise.
The chat widget sets no cookies, and stores nothing in your browser until you open or use it (see Section 11). It loads only on the websites its owner has listed for it.
11. What is collected when you chat
- Your messages and the bot's replies.
- The address of the page the chat started on.
- A hashed form of your IP address, stored with the conversation to limit abuse. The hash is different for every business's bot, so it cannot be used to match you across websites. Your IP address itself is used, without being stored, to apply short-lived rate limits, and appears in our web server's logs, as it does for a request to any website.
- Your browser's user agent (the browser and device type it reports).
- A few values in your browser's local storage for that website (and one in its session storage), not cookies, and only once you open or use the chat: a random visitor ID that groups your chats with that business, kept until you go 30 days without chatting or delete your chat; your conversation's ID and access key, so you can carry on as you move between pages, kept until you go 25 hours without a message; the time you last chatted; and, until you close the tab, whether the chat window is open. These values are pseudonymous: they do not say who you are, and they are not used to recognise you on other websites or for advertising.
The chat window does not ask for your name or contact details. Anything you choose to type into it is stored as part of the conversation, so please do not share sensitive information there.
12. How it is used, and for how long
- To answer you: your messages are processed by a third-party AI model provider to generate the bot's replies.
- So the business can see what was asked: the business whose site you were on can read the conversations its bot has had.
- To keep the service working: preventing abuse, fixing errors, and billing the business for its usage.
We do not sell your conversation, and we do not use it for advertising.
Retention. Conversations are deleted automatically after a fixed period that depends on the plan the business is on: 90 days or 365 days from the conversation. The business can delete a conversation sooner.
13. How to have your conversation deleted
- Yourself: you can delete your own conversation from the chat window (open the menu at the top of the chat and choose Delete this chat). Deleting it also removes the visitor ID from your browser.
- Through the business: ask the business whose website you were on. It can delete your conversations when you ask.
- Through us: if you cannot reach the business, email [email protected] and tell us which website you were on. We will pass your request to the business and help it respond.
14. Your rights as a visitor
Because the business whose website you were on is the controller of your conversation, requests to access, correct, or delete it, or to object to its use, should go to that business first. We assist the business in responding, as the law requires of a processor. If you are in a jurisdiction with statutory privacy rights (such as the EEA, UK, or California), those rights apply as the law provides.
For everyone
15. Changes
We may update this policy from time to time. Material changes will be announced in the app or by email to account holders before they take effect.
16. Contact
Questions? Email [email protected].