Privacy Policy

1. Overview

Obdal provides tools to build and operate AI-powered chatbots. We collect information to create accounts, run your chatbots, process files, and manage subscriptions.

2. Information We Collect

We collect information in the following categories:

• Account data: Name, email address, password (stored as a hash), and account role.
• Service configuration and content: App names and descriptions, prompts, templates, design settings, FAQs, chatbox configuration, and uploaded files. Uploaded files are stored and chunked to support search and retrieval features.
• Conversation and usage data: Chat messages and responses associated with a session ID, token usage, usage limits, and related metadata used for analytics and billing.
• Billing and subscription data: Plan details, invoices, Stripe customer IDs, and limited payment method details such as card type and last four digits.
• Newsletter and contact data: Email addresses for newsletter subscriptions and contact form details such as name, company, phone, and message content.
• Technical data: IP address, user agent, session data, cookies, and log data used to operate and secure the Service.

3. How We Use Information

• Provide, maintain, and improve the Service.
• Generate AI responses and retrieve knowledge base content.
• Process file uploads, chunk content, and create vector embeddings.
• Manage subscriptions, billing, and usage limits.
• Send service and account communications.
• Detect abuse, prevent fraud, and secure the platform.

4. How We Share Information

We share information only as needed to run the Service:

• AI providers: Messages, prompts, and relevant context are sent to AI model providers — primarily OpenAI — to generate responses and create embeddings. We do not allow providers to use your content to train their models.
• Vector storage: File chunks and embeddings are stored with Upstash, our vector database provider, to enable semantic search.
• Payment processing: Billing data is handled by Stripe. We do not store full payment card numbers.
• Infrastructure and email: We use service providers for hosting, storage, and email delivery.
• Analytics: With your consent we use Google Analytics 4 on our website. See the Cookie Policy for details. Analytics never runs inside the embedded chat widget.
• Legal and safety: We may share information if required by law or to protect the Service and users.

Legal Bases for Processing

Where the GDPR applies, we process personal data on the following legal bases:

• Performance of a contract: account data, service configuration, conversation processing, and billing (Art. 6(1)(b)).
• Legitimate interests: service security, abuse prevention, and product improvement using aggregated usage data (Art. 6(1)(f)).
• Consent: analytics cookies and the newsletter (Art. 6(1)(a)). You can withdraw consent at any time.
• Legal obligations: retaining billing records where tax and accounting law requires it (Art. 6(1)(c)).

5. Data Retention

We retain personal data only as long as needed. Concretely: account data is kept until you delete your account; chat conversations are deleted 12 months after their last activity; contact form messages and sales leads are deleted after 24 months; usage records are deleted after 24 months; server logs rotate after 14 days. Deleted apps are permanently purged 30 days after deletion. When you delete your account, your apps, uploaded files, vector embeddings, conversations, and Stripe customer record are deleted as well.

6. Security

We use reasonable safeguards to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your Choices

• Access and update your account information in the app.
• Delete files, apps, or your account to remove associated data.
• Unsubscribe from marketing emails using the unsubscribe link.

Your Rights Under the GDPR

If you are in the EU or EEA, you have the right to:

• Access — request a copy of the personal data we hold about you. You can download your data anytime from Settings.
• Rectification — correct inaccurate data, for example your name or email in Settings.
• Erasure — delete your account and all associated data from Settings, or ask us to delete specific data.
• Portability — receive your data in a structured, machine-readable format (the Settings export is JSON).
• Restriction and objection — ask us to limit or stop certain processing.
• Withdraw consent — change your cookie choice via the footer, or unsubscribe from the newsletter with one click.
• Complain — lodge a complaint with your local data protection supervisory authority.

8. International Transfers

Our service providers may process information in countries outside the EU/EEA, including the United States. Where they do, we rely on safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

Our Role for Chatbot Visitors

When you chat with an Obdal-powered chatbot on a customer's website, that customer is the data controller of the conversation and Obdal acts as their data processor. Visitors should direct privacy requests to the website operator; we support our customers in fulfilling them, including deleting individual conversations.

9. Changes to This Policy

We may update this policy periodically. Material changes will be announced through the Service.

10. Contact

If you have questions about this policy, contact us through the support channels available in the Service or the contact options on our website.