Privacy Policy

Introduction

AI Smarty is an AI agent builder for sales, customer support, and user engagement.

We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes AI Smarty’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognise that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.

Contacting us about data protection

AI Smarty is headquartered in the UK. For any inquiries or concerns regarding our personal data policies, practices, or if you wish to exercise your privacy rights, please feel free to reach out directly to our Privacy Team. Our team is equipped and committed to assisting you with any questions you might have and ensuring your data is handled with the utmost care and respect.

How we collect and use (process) your personal information

AI Smarty collects personal information about its website visitors and customers. With a few exceptions, this information is generally limited to:

• name
• job title
• employer name
• work address
• work email
• work phone number

We use this information to provide prospects and customers with services.

We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.

From time to time, AI Smarty receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. We may also collect your personal data from a third party website (e.g. LinkedIn).

AI assistants you connect to your account

You can connect an AI assistant, such as ChatGPT or Claude, to your AI Smarty account. You start the connection from the assistant, sign in to AI Smarty, choose one workspace, and choose either read only access or read and change access. The assistant can only reach that one workspace, and only while you remain a member of it with a role that allows the action.

What a connected assistant can read. Your AI agents and their settings (setup progress, knowledge sources, widget appearance, allowed domains, install code and booking settings); your account status (plan, credits, limits and whether your email address is verified); summaries of activity (counts of conversations, new leads, unanswered questions, handoffs and bookings); the questions visitors asked that your AI agents could not answer; and your leads. Lead lists show each lead’s name, company and status, with the email address and phone number partly hidden, and the names (not the contents) of the form fields captured. When you ask for one lead’s contact details, the assistant receives that lead’s name, email address, phone number and company. Assistants do not receive conversation transcripts, form answers, notes, or technical visitor data. A read only connection can also hold test conversations with your AI agents. These use your monthly test allowance and end any test conversation you have open in the dashboard for that AI agent.

What a connected assistant can change. Only with read and change access, and only the things you ask it to do: create an AI agent from your website, add knowledge, change instructions and appearance, save lead forms and booking settings, answer unanswered questions, and publish an AI agent or take it back to draft. Each of these is marked as a change so that the assistant can ask you to confirm it, with the details, before it runs. Whether it asks depends on the assistant and your settings in it. If you chose read only access, our servers refuse every change, whatever the assistant asks. An assistant cannot buy, change or cancel a plan, move money, or see or enter payment details or passwords.

Text written by your visitors. Names, company names and unanswered questions come from visitors to your website. Before we pass them to an assistant we reduce them to plain text, remove links, images and formatting, and shorten them to a fixed length.

How long access lasts. Each access token the assistant receives lasts 15 minutes. The assistant can renew it with a refresh token. A refresh token lapses after 30 days without use, so a connection you keep using stays connected until you remove it. You can see and remove connected assistants at any time in the account settings of each workspace. Removing one ends its access straight away.

Records we keep. Each time an assistant uses your account we record which action ran, when, which assistant connection made it, and whether it succeeded. We never record what was sent or returned. Where your plan includes the activity log, you can see the action name and the outcome there.

The assistant provider. What an assistant receives from AI Smarty is then processed by the company that provides the assistant (for example OpenAI for ChatGPT, or Anthropic for Claude) under its own terms and privacy policy, not ours. Please read them before you connect.

Contacting a business through WhatsApp

If you contact a business through WhatsApp, the AI agent records your number with your enquiry so the business can reply to you.

Use of the AI Smarty website

As is true of most other websites, AI Smarty’s website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of AI Smarty’s website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyse trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

AI Smarty has a legitimate interest in understanding how members, customers and potential customers use its website. This assists AI Smarty with providing more relevant products and services, and with communicating value to our customers, and with providing appropriate staffing to meet customer needs.

Cookies and tracking technologies

AI Smarty makes available a comprehensive Cookie Notice that describes the cookies and tracking technologies used on the AI Smarty website and provides information on how users can accept or reject them. To view the notice, see our Cookie Policy.

Sharing information with third parties

The personal information AI Smarty collects from you is stored in one or more databases hosted by trusted service providers. These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval. On occasion, AI Smarty engages third parties to send information to you, including information about our products, services, and events.

A list of our third party sub-processors can be found in our DPA, Exhibit B.

We do not otherwise reveal your personal data to non-AI Smarty individuals or businesses for their independent use unless: (1) you request or authorise it; (2) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (3) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (4) to address emergencies or acts of God; or (5) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.

The AI Smarty website connects with third party services such as Facebook, LinkedIn, X (formerly Twitter) and other similar platforms. If you choose to share information from the AI Smarty website through these services, you should review the privacy policy of that service. If you are a member of a third party service, the aforementioned connections may allow that service to connect your visit to our site to your personal data.

International data transfers

AI Smarty is a company established in the United Kingdom. Our core infrastructure, including servers and file storage, is hosted within the United Kingdom and the European Economic Area (EEA).

To generate AI responses, message content and relevant knowledge-base excerpts are transmitted to our AI model providers, some of which process data in the United States. These providers are listed in our DPA, Exhibit B, and are engaged under API terms that prohibit using your content to train or improve their models. A small number of other service providers (for example infrastructure, analytics, or error monitoring) may also process data outside the UK or EEA. Where this occurs, we ensure that:

• Only the minimum necessary data is shared.
• Appropriate safeguards are in place in accordance with the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU GDPR.
• Data is protected using recognised transfer mechanisms, such as UK International Data Transfer Agreements (IDTA), Standard Contractual Clauses (SCCs), or transfers to countries deemed to provide an adequate level of protection.

We take all reasonable steps to ensure that any such processing does not undermine the level of protection afforded to your personal data.

By using AI Smarty’s services, you acknowledge that limited international processing may occur where strictly necessary to deliver the service.

Your data protection rights

Under the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU GDPR, you have the following rights in relation to your personal data:

• The right to be informed about how your data is collected and used.
• The right of access to your personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure (“right to be forgotten”).
• The right to restrict processing.
• The right to data portability.
• The right to object to processing.
• Rights relating to automated decision-making and profiling.

This Privacy Notice explains what personal data AI Smarty collects and how it is used.

Exercising your rights

You have the right to request confirmation as to whether we process your personal data, and to request access to that data.

You may also request information about:

• The purposes of processing.
• The categories of personal data concerned.
• The recipients or categories of recipients of your data.
• The source of the data (where it was not provided directly by you).
• The period for which your data will be stored.

Where your personal data is inaccurate or incomplete, you have the right to request correction.

You may also request that we erase your personal data or restrict how it is processed, subject to certain legal obligations and exceptions. You may object to the use of your data for direct marketing at any time.

Where technically feasible, we will provide your personal data to you in a structured, commonly used, and machine-readable format.

Access requests

We will respond to requests relating to your personal data within the timeframes required by applicable law. In most cases, this will be free of charge.

If we are unable to fulfil your request, we will explain the reasons why.

Complaints

If you have concerns about how your personal data is handled, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

If you are located in the European Economic Area, you may also contact your local data protection authority.

Use of Google Workspace APIs

AI Smarty uses Google APIs in two ways, and only when you choose to use them:

• Sign in with Google. We receive your name, email address and profile picture to create and secure your account.
• Google Calendar for appointment booking. When a business owner connects their Google Calendar to an AI agent, we read only the busy and free times on that calendar, so visitors are offered appointment times that do not clash with existing commitments. We create the calendar events for appointments booked through AI Smarty, and update or delete those same events if the visitor reschedules or cancels. We do not read the titles, descriptions, attendees or any other details of other events, and we do not change or delete events we did not create.

If you connect a Microsoft Outlook calendar instead, we use it in the same way and only for the same purposes.

You can disconnect Google Calendar at any time from your booking settings, or remove AI Smarty’s access from your Google Account.

AI Smarty’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is not used to train, develop, or improve generalised artificial intelligence or machine learning models.

We process such data in accordance with this Privacy Notice and applicable data protection laws, and we only access the minimum data necessary to provide the relevant functionality.

Data protection and security

AI Smarty implements appropriate technical and organisational measures to protect your personal data, including:

• Encryption. Customer data is encrypted using industry-standard encryption both in transit and at rest.
• Access controls. Role-based access ensures that only authorised personnel can access sensitive data.
• Row-level security (RLS). Data access is restricted at the database level to ensure users and organisations can only access their own data.
• Rate limiting. Controls are in place to prevent abuse and protect system integrity.
• Domain controls. Customers can restrict where their AI agents are embedded.
• Infrastructure security. Our systems are hosted within the UK and European Economic Area (EEA) using reputable cloud providers.
• Compliance. We operate in accordance with UK GDPR and applicable data protection laws.

While we take reasonable steps to protect your data, no system can be completely secure, and we cannot guarantee absolute security.

AI data usage

AI Smarty does not use customer-provided data to train public or shared artificial intelligence models.

Customer data is processed solely to deliver the services requested. Where AI responses are generated, this is done using techniques such as hybrid Retrieval-Augmented Generation (RAG), ensuring your data remains isolated on our systems and under your control.

Children’s data

AI Smarty’s services are not intended for use by children, and we do not knowingly collect personal data from individuals under the age of 18.

If we become aware that we have collected such data, we will take steps to delete it.

Data storage and retention

Your personal data is stored on secure servers located within the UK and the European Economic Area (EEA), as well as with trusted service providers engaged to deliver the service.

We retain customer data for the duration of the business relationship and for a limited period thereafter where necessary for:

• Legal and regulatory compliance.
• Resolving disputes.
• Service improvement and internal analysis.
• Backup and archival purposes.

Prospect data is retained only for as long as it remains relevant for business purposes.

You may request deletion of your personal data at any time, subject to legal or contractual obligations. For further information, please contact [email protected].

Contact

If you have any questions, concerns, complaints, or would like to exercise your rights, please contact [email protected].