Browse the docs
Privacy and security
Data we store
What ASDK stores about your account, your website content and your visitors' conversations, what the widget keeps in browsers, and who controls which data.
Last updated
On this page
ASDK handles three kinds of data: your account, the content your agents answer from, and what your visitors do in the widget. This page lists what is stored in each case, so you can answer your own customers' questions and write your privacy notice. The privacy policy is the binding document; this page explains it in practical terms.
Who controls what
| Data | Controller | ASDK's role |
|---|---|---|
| Your account and your team's accounts | ASDK | Controller, under our privacy policy |
| Your website content and knowledge | Your company | Processes it to run your agents |
| Your visitors' conversations and leads | Your company | Processor, under our Data processing addendum |
In short: for your visitors, your company decides what happens with their data, and ASDK processes it on your behalf. Your own privacy notice applies to them.
Your account
- Profile: your email address and, if you use Google sign-in, your name and profile picture from Google.
- Workspace data: workspace names, members and their roles, invitations, API keys (stored only as a fingerprint, never in full) and settings.
- Usage data: sign-ins, actions in the dashboard, your IP address and browser, and error reports.
- Communications: emails you send us and your email preferences.
The dashboard uses only cookies that are strictly necessary, such as the one that keeps you signed in. See the cookie policy.
Your content
- Pages ASDK read from your websites and sitemaps: their text, title, address and language.
- Files you uploaded, stored so ASDK can read them again, and the text extracted from them.
- Text snippets and Q&A pairs you wrote, with who added them and when.
- The knowledge index: your content split into short passages, with the numeric representations that make it searchable by meaning. Each site's index is kept in its own separate namespace, and agents on one site can only search that site's knowledge.
- Widget settings: texts, colors, suggested questions and lead capture options.
Your visitors' data
When a visitor uses the widget on your site, ASDK stores on your behalf:
| Data | Details |
|---|---|
| Messages | What the visitor wrote and what the agent replied, with times and the pages each answer cited |
| Page | The address and title of the page they were on, and the page they came from |
| Device | Browser, operating system and language, and an approximate location estimated from the IP address |
| Visitor ID | A random ID, so a returning visitor's conversation can continue |
| Contact details | What the visitor enters in the contact form: email and, if you ask for them, name, company and phone, plus their consent |
| Identity | If your site passes a verified identity with identify; see Identity verification |
| Feedback and events | Helpful or Not helpful ratings, page views, opening and closing the widget, and custom events you send with track |
Visitors may type anything into a chat, including personal details you didn't ask for. Mention in your privacy notice that visitors shouldn't share sensitive information, such as health details or payment card numbers, in the chat.
In your visitors' browsers
The widget sets no cookies. It keeps a few small entries in the browser's storage for your site:
| Entry | Where | Why |
|---|---|---|
| Visitor ID | Local storage | Continue the conversation on the next page and the next visit; once it exists, the widget's events on your site carry it too |
| Current conversation ID | Local storage | Reopen the conversation after a reload |
| Lead sent | Local storage | Stop offering the contact form after the visitor sent it |
| Finished offers | Local storage | Stop offering a meeting or the contact form again after a reload once the visitor opened the booking page or chose Not now on the form |
| Session token | Session storage | Authorize the visitor's requests for a short time |
| Panel open | Session storage | Keep the panel open while the visitor moves between pages |
All entries start with asdk: and your Site ID. Local storage has no automatic expiry; session storage is cleared when the tab closes. The cookie policy explains how to describe this in your own notice, and whether it needs consent where you operate.
How it is protected
- Encryption in transit and at rest.
- Separation: each site's knowledge has its own namespace, and every request from the widget is checked against the site's allowed domains.
- Access control: only members of your workspace can see its data, by role. See Members and roles.
- Our own access is limited to what running the service and support need.
The security page has more.
Who else processes it
ASDK runs on a small number of providers: hosting, content delivery, the vector database, AI model providers, email and error monitoring. They're listed with their location on the subprocessors page and summarized in Subprocessors. AI model providers process data under terms that don't allow training on it; see No training on your data.
Related: Data retention, Delete your data.