Privacy

[Company legal name], [Street and number], [Postcode and city], [Country], is the controller for the personal data described here: data about visitors to minaya.ai and about our customers' accounts. You can reach us at hello@minaya.ai.

For the conversations your visitors have with your widget, you (the business using Minaya) are the controller and we process that data on your behalf as your processor.

Your account details (email and, if you signed up with a password, a hashed version of it), your business profile, and the knowledge sources you add (the text, files, and crawled pages you choose to give Minaya), along with the embeddings generated from them.

We also store chat transcripts between Minaya and your visitors, plus aggregate analytics: session counts, message counts, the domain the widget was loaded from, and coarse visitor country.

If you supply your own OpenAI or Claude key it is encrypted at rest and used only to make requests on behalf of your business. It is never shown back to you in full, never shared with other accounts, and you can rotate or remove it at any time from your dashboard.

The widget runs on the domains you allowlist. It does not set advertising cookies or track visitors across other sites. It stores a session identifier so a conversation survives a page refresh.

You are responsible for telling your own visitors that a chat widget is present, in whatever way your jurisdiction requires.

minaya.ai sets strictly necessary cookies only: one remembers your language (NEXT_LOCALE), one tells the page whether you are signed in to the dashboard so it can show the right link (minaya_session), and one stores your cookie choice (minaya_consent) for six months.

Analytics and marketing cookies are off until you allow them. You can change or withdraw your choice at any time using "Cookie settings" in the footer.

Message content is sent to the AI provider that answers it (OpenAI or Anthropic when you supply a key, or our configured provider on the free tier) solely to generate a reply. Payments, where applicable, are handled by our payment processor; we never see or store full card details.

To provide the service you signed up for: your account, knowledge sources, widget and billing (performance of a contract, Art. 6(1)(b) GDPR).

To keep the service secure, prevent abuse and understand how it is used in aggregate (our legitimate interests, Art. 6(1)(f) GDPR).

To use optional analytics or marketing cookies on this site, only if you allow them (consent, Art. 6(1)(a) GDPR). You can withdraw consent at any time.

To keep invoices and payment records as tax and accounting law requires (legal obligation, Art. 6(1)(c) GDPR).

Account data, knowledge sources and chat transcripts are kept while your account is open, or until you delete them. After you close your account they are removed from live systems straight away and from backups within 30 days.

Invoices and payment records are kept for as long as tax law requires, which can be up to ten years. Security logs are kept for up to 30 days.

Some of our providers process data outside your country, including in the United States: Cloudflare (hosting and content delivery), OpenAI and Anthropic (generating replies), our payment processor and our email delivery provider. Where personal data leaves the EEA or the UK, we rely on an adequacy decision such as the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses.

The current list of subprocessors, with their locations, is available on request at hello@minaya.ai.

Removing a knowledge source deletes its stored content and embeddings. Closing your account removes your business profile, knowledge sources, and transcripts. Write to hello@minaya.ai and we will confirm once it is done.

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. Write to hello@minaya.ai and we will answer within one month.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work.

If you chatted with a Minaya widget on another company's website, that company is responsible for your conversation. Contact them first; we will help them answer your request.

When you add Minaya to your website, we process your visitors' data on your behalf. A data processing agreement under Art. 28 GDPR is part of our service; request a copy at hello@minaya.ai.

Questions about any of this go to hello@minaya.ai.