Privacy Policy

For data about our website visitors and our Customers (account, billing, support), ARQEMUS LIMITED is the data controller: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong — contact@airbot.app — https://arqemus.com/.

For data about Visitors processed through the assistant installed on a Customer’s website, the Customer that operates that website is the data controller. ARQEMUS acts as its processor (service provider) and processes that data only on the Customer’s documented instructions and to provide the service. If you are a Visitor, please read the privacy policy of the website you are using and address your requests to that business first; we will help it answer you.

ARQEMUS acts as an independent controller for a limited number of operations relating to Visitors: securing the service and preventing abuse (for example rate limiting and blocking unauthorised use of the widget), measuring usage for billing, and complying with our legal obligations.

Customers and website visitors:

• Account data: name, email address, password (stored only in hashed form by our authentication provider), company, phone number and website, and, if you sign in with Google, the name, email address and profile picture provided by Google.
• Site and configuration data: the websites you connect, the content of your pages that the service reads to answer Visitors, your settings, your notification addresses and your product catalogue.
• Billing data: plan, subscription status, invoices and billing address. Payment card details are collected and stored by our payment provider Stripe; we never receive the full card number.
• Support and communications: messages you send us and our replies.
• Technical and security data: logs of access to the service, IP address, browser type and, for administrators of the service, an audit trail of sensitive actions.

Visitors of a Customer’s website (processed on behalf of the Customer):

• Conversation data: the messages you write or dictate to the assistant, its answers, and the actions it performs at your request (for example searching, opening a product, adding it to the cart or filling in a form).
• Information you choose to give: for example your name, email address, phone number, company, needs, budget, sizes or preferences. The assistant may keep a short summary of these elements so that it can pick up the conversation when you come back to the same website.
• Page context: the address, title and visible content of the page you are on (product, price, options, forms), so that the answer matches what you see.
• Usage and device data: a random visitor identifier, the number of visits, approximate interaction signals (time on page, scrolling, inactivity, clicks), browser type, language and general device characteristics.
• Approximate location: the city and country derived from your IP address, and the local weather, used to adapt suggestions. Your IP address itself is not stored in our databases.
• Voice: if you use dictation, your browser converts speech to text with its own speech service. If you use live voice conversation, where the Customer has enabled it, your microphone audio is streamed directly from your browser to Google’s AI service to produce the spoken conversation; we do not record or store the audio.

Please do not share sensitive information (health, religious beliefs, payment card numbers, passwords, identity documents) with the assistant. The assistant never asks for your password or card number and never completes a payment for you.

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

We do not sell personal data and we do not use it for third-party advertising. We do not use Customer or Visitor data to train general-purpose AI models. The assistant does not take decisions that produce legal or similarly significant effects on you; every purchase remains your decision.

To produce an answer, the service sends the relevant part of the conversation, the page context and the Customer’s instructions to an AI model provider, which returns a reply. These providers act as our sub-processors under contractual terms that restrict their use of the data to providing the service to us.

AI answers can be incomplete or inaccurate. Before ordering, check the price, availability and characteristics displayed by the merchant. On checkout pages, the assistant shows a summary and asks for your explicit confirmation before going further; payment is always made by you.

We share personal data only with the following recipients, and only to the extent necessary:

• The Customer whose website you use, for Visitor data: it can see the conversations, summaries and contact requests in its dashboard and receives the requests you ask the assistant to pass on.
• Our service providers (sub-processors), listed below, bound by confidentiality and data protection obligations.
• Competent authorities, when the law requires it or to protect our rights, our users or the public.
• A buyer or successor, in the event of a merger, acquisition or sale of all or part of our business, subject to the same protections.

We may update this list as our service evolves. Material changes concerning sub-processors are notified to Customers in advance.

ARQEMUS is established in Hong Kong and some of our providers process data in the United States, the European Union or other countries. When personal data subject to the GDPR is transferred to a country that does not offer an adequate level of protection, we rely on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses (and their UK equivalent), together with additional measures where needed. You can ask us for information about these safeguards.

• Account and configuration data: for as long as the account is active, then deleted or anonymised within 90 days of closure, unless a longer period is required by law.
• Billing records and invoices: for the period required by accounting and tax law (generally up to 7 years).
• Visitor data (summaries, contact details, conversation history, contact requests): for as long as the Customer keeps its account, unless the Customer deletes them earlier or asks us to; deleted within 90 days of the end of the Customer’s subscription.
• Current conversation thread kept to resume a chat across pages: 48 hours. Conversation cookie on the Visitor’s browser: 2 hours.
• Security logs and audit trails: up to 12 months, unless they are needed longer to investigate an incident.
• Backups follow a rolling cycle and are overwritten in the ordinary course.

On airbot.app and in the dashboard, we only use technologies that are necessary for the service: the authentication session, your language preference and your display preferences, stored in your browser. We do not use advertising or third-party analytics cookies. Pages may load fonts and visual resources from third-party providers (for example Google Fonts), which receive your IP address when they are loaded.

On a Customer’s website, the assistant uses a conversation cookie (2 hours) and browser storage (local storage and session storage) to keep a random visitor identifier, the conversation, the products viewed and the context of the visit. This storage allows the conversation to continue from page to page and to be resumed when you return. The Customer that operates the website is responsible for informing you and, where the law requires it, for collecting your consent; you can also clear this storage at any time in your browser settings.

We implement technical and organisational measures appropriate to the risks: encryption of traffic between browsers and our services (HTTPS), hashed passwords, access to production data restricted to authorised staff with strong authentication and logging of sensitive actions, isolation of each Customer’s data, restriction of the widget to the Customer’s own domains, rate limiting and abuse detection. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authorities as required by law.

Depending on the law that applies to you, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw your consent at any time where processing is based on consent. In Hong Kong, the Personal Data (Privacy) Ordinance gives you in particular the right to access and correct your data.

Customers can update their account information in the dashboard and request the deletion of their account by writing to support@airbot.app. Visitors should first contact the business operating the website concerned; you can also write to us at contact@airbot.app and we will forward your request to that business and assist it. We answer within one month, which may be extended where the law allows. We may ask you for information to verify your identity.

You also have the right to lodge a complaint with a supervisory authority, for example the authority of the country where you live (in France, the CNIL — www.cnil.fr) or, in Hong Kong, the Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk).

Airbot accounts are reserved for adults acting for professional purposes. The service is not directed at children under 16, and Customers undertake not to deploy the assistant on websites directed primarily at children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy to reflect changes in our service or in the law. The date at the top of the page shows the latest version. If the changes are significant, we will inform Customers by email or in the dashboard before they take effect.

For any question about this policy or your data: contact@airbot.app — ARQEMUS LIMITED, Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong. Airbot is a product of ARQEMUS LIMITED (https://arqemus.com/).