Privacy Policy

Effective date: July 3, 2026

1. Introduction

This Privacy Policy explains how aqoon ("we", "us", "our") collects, uses, and protects your personal data when you use our platform. We are committed to protecting your privacy and handling your data responsibly.

aqoon is a platform that organizations ("operators") use to build AI assistants and chatbots. Where an operator deploys an assistant to the public (for example a citizen-facing bot on our website, Telegram, or WhatsApp), the operator is the controller of the data collected from those end users, and we process it on their behalf to run the service. This policy describes what we collect and process across the platform.

2. Data We Collect

2.1 Account Information

When you register, we collect:

• Email address
• First and last name
• Organization name (optional)
• Password (stored as a secure hash, never in plain text)

2.2 Documents and Content

When you upload documents, we store:

• The document file (in Azure Blob Storage)
• Extracted text content and metadata
• Document chunks and vector embeddings (in Azure AI Search)

2.3 Usage Data

When you use the API, we log:

• API requests (query text, results count, response time)
• IP addresses
• Timestamps

Usage logs are automatically deleted after 90 days. Aggregated daily summaries (without query text) are retained longer for billing purposes.

2.4 Billing Data

Payment processing is handled by Stripe. We store your Stripe customer ID and invoice history but never store your credit card details directly.

2.5 Chatbot Conversations

When you interact with an assistant or chatbot (on our web widget, Telegram, or WhatsApp), we may store:

• The messages you send and the assistant's replies (conversation transcript)
• Session metadata: a session identifier, timestamps, language, and — on the web — IP address and browser user-agent
• Any contact details you choose to provide (name, email, or phone number) so the operator can follow up
• Ratings and feedback you submit about a conversation

Voice notes: if the operator enables voice input, an audio message you send is transcribed to text using Microsoft Azure OpenAI (Whisper). We process the transcript as part of the conversation.

How long conversations are kept is set by the operator; unless configured otherwise, messages are kept for up to 30 days, and session details that identify a visitor (IP, name, email, phone) are removed after 7 days. Operators may also choose not to store messages at all.

2.6 Form and Workflow Submissions

When you complete a form or guided workflow inside an assistant (for example to request an appointment or submit a report), we collect the information you enter — which may include your name, phone number, and the details of your request — and deliver it to the operator. This information is kept for a period set by the operator and then deleted.

3. How We Use Your Data

We use your data to:

• Provide and maintain the Service (storing, indexing, and searching your documents)
• Operate assistants and chatbots — generating replies, transcribing voice notes, and running guided workflows
• Deliver form and workflow submissions to the relevant operator
• Authenticate your identity and secure your account
• Process billing and enforce rate limits
• Send transactional emails (account activation, password reset)
• Monitor and improve Service performance

4. What We Do NOT Do

• We do not sell your personal data to third parties
• We do not use your documents to train AI models
• We do not share your data with advertisers
• We do not profile you for marketing purposes

5. Data Sharing

We share data only with the following service providers (sub-processors), strictly to operate the platform:

• Microsoft Azure — document storage (Blob) and AI Search indexing
• Microsoft Azure OpenAI — large-language-model responses, text embeddings, and speech-to-text (Whisper) transcription
• DigitalOcean Spaces — storage of uploaded media (e.g. logos, avatars) and static assets
• Twilio — WhatsApp and SMS message delivery for chatbot channels
• Telegram — message delivery for chatbot channels
• Stripe — payment processing
• Mailtrap — transactional email delivery

We do not use your conversations, documents, or submissions to train these providers' AI models. We may also disclose data if required by law or to protect the rights and safety of our users.

6. Public Collections

If an administrator makes a collection public, its name, description, and document titles become visible to other registered users. Document content is accessible only through search by subscribed users.

7. Data Security

We implement industry-standard security measures including:

• Passwords hashed with PBKDF2-SHA256
• API keys stored as SHA-256 hashes (originals never stored)
• HTTPS enforced for all connections
• Content Security Policy (CSP) headers
• CSRF protection on all forms
• SSRF protection on URL-based document imports

8. Data Retention

• Account data: retained while your account is active
• Documents: retained until you delete them or your account
• Chatbot messages: kept for the period set by the operator (up to 30 days by default; operators may store none)
• Visitor session details (IP, name, email, phone): anonymized after 7 days
• Form and workflow submissions: kept for the period set by the operator, then deleted
• API usage logs: automatically deleted after 90 days
• Deleted accounts: permanently purged 7 days after deletion request

9. Your Rights

You have the right to:

• Access your personal data (via your settings page)
• Correct inaccurate data (via your settings page)
• Delete your account and all associated data
• Export your data upon request

To exercise these rights, contact us at the address below or use the relevant features in your account settings.

10. Cookies

aqoon uses the following cookies:

• Session cookie (csrftoken, sessionid) — required for security and authentication
• Language preference cookie (django_language) — stores your language choice

We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

11. Children's Privacy

aqoon is not intended for use by individuals under the age of 16. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The effective date at the top of this page indicates the latest revision.

13. Contact

For privacy-related questions or requests, contact us at: support@aqoon.ai