Privacy Policy

Sefid never sells your data or your customers' data to third parties, and never shares it for third-party advertising. Data is used only to provide and improve the service you purchased.

We operate under the GDPR: minimal collection, transparency, and your control over your own data. Each business's data is logically isolated from every other business — one customer can never access another customer's data.

Account information (email address and name) to create your account and communicate with you — legal basis: performance of a contract (GDPR Art. 6(1)(b)). Your website content and the knowledge you add, to train your chatbot — contract. Conversation text, to generate replies and show history in your panel — contract and our legitimate interest in service quality and abuse prevention (Art. 6(1)(f)).

We do not collect more than what is needed to provide the service (data minimisation, Art. 5(1)(c)), and we do not intentionally collect special categories of data (Art. 9).

End-user IP addresses are not stored in raw form; they are hashed (HMAC) before storage and used only for abuse detection, smart rate limiting and aggregate statistics.

To prevent abuse of free message limits (for example by repeatedly clearing browser storage), the chat widget also sends a short technical signature derived from general browser characteristics (such as time zone, language and screen size). This is a coarse, salted hash: it cannot identify you personally, is never shared with third parties, and the related counters are automatically deleted within 24 hours — legal basis: our legitimate interest in security and abuse prevention (Art. 6(1)(f)).

Device type and operating system are kept at a general level (such as mobile or desktop), not as a unique personal identifier.

Data is kept only as long as needed to provide the service (storage limitation, Art. 5(1)(e)). Technical logs and raw analytics events are kept for a short period (up to about 30 days) and then deleted or aggregated. Conversation data is subject to a retention window (by default 12 months) after which it is deleted or anonymised.

When you delete your account, your personal data is deleted or anonymised in line with this retention policy.

You have the right to access your data (Art. 15), to rectify it (Art. 16), to have it erased (the “right to be forgotten”, Art. 17), to restrict or object to processing (Arts. 18 and 21), and to receive a portable copy of your data (Art. 20).

To exercise any of these rights, contact us through the panel or support; we respond within one month (Art. 12(3)). You also have the right to lodge a complaint with your local data protection authority.

To provide the service we use a small number of processors: AI model providers (to generate replies) and an email delivery service (for sign-in codes and notifications). Each receives only the minimum data needed for its task, under a data processing agreement (Art. 28), and may not use the data for anything else.

We use only essential cookies and local storage for sign-in sessions and widget settings. We do not use third-party advertising or tracking cookies.

Data is protected with encryption in transit and access controls, and each business's data is isolated. If any processing requires a transfer outside the EU/EEA (for example an AI model provider), only the minimum necessary data is transferred under the GDPR Chapter V safeguards (adequacy decisions or Standard Contractual Clauses), and we prefer EU-hosted providers where possible.

The chat assistant on your website is an AI system. In line with Article 50 of the EU AI Act, it clearly identifies itself as an AI assistant and never pretends to be a human. Conversations can be escalated to a human when needed.

For any privacy question or to exercise your rights, contact us through the panel support. This notice is read together with the Terms of service and may be updated; changes are published on this page.