Privacy Policy

This Privacy Policy explains how Bool9 (“Bool9”, “we”, “us”) collects, uses, shares, and protects personal information in connection with Chat9, our embeddable AI chat widget service. It applies to two groups of people:

• Customers — people who sign up for a Chat9 account to deploy the widget on their own websites.
• Visitors — end users who interact with a Chat9 widget on a Customer’s website.

If you are a Visitor, the Customer who deployed the widget is the controller of your data with respect to the questions you submit. Their own privacy notice governs that relationship. Bool9 processes Visitor data on their behalf as a processor.

1. Information We Collect

From Customers

• Account information: email address, password (stored as a hash), and any profile details you provide.
• Website information: the URLs you register with the Service and the content we crawl from those websites.
• Billing information: processed by Lemon Squeezy (our Merchant of Record); we receive limited metadata (subscription status, plan, order IDs) but do not store full payment card details.
• Usage data: log records about how you use the dashboard and the Service, including IP address, browser, timestamps, and feature interactions.

From Visitors

• Chat content: the questions you type into the widget and the answers generated in response.
• Session identifier: a random session ID stored in your browser’s sessionStorage so a single conversation can be grouped together. It is not a persistent tracking cookie and is discarded when you close the tab.
• Technical metadata: standard request information such as IP address, user agent, and timestamps, used to operate the Service and prevent abuse.

2. How We Use Information

We use personal information to:

• Provide, maintain, and improve the Service.
• Crawl Customer websites, generate embeddings, and produce AI answers for Visitor questions.
• Authenticate accounts, process subscriptions, and prevent fraud or abuse.
• Communicate with Customers about their account, billing, and product updates.
• Comply with legal obligations and enforce our Terms.
• Generate aggregated, de-identified analytics about Service usage.

We do not sell personal information, and we do not use Customer or Visitor chat content to train our own foundation models.

3. Legal Bases for Processing

Where the GDPR applies, we rely on the following legal bases:

• Contract: to provide the Service to Customers who have agreed to our Terms.
• Legitimate interests: to secure the Service, prevent fraud, and improve the product.
• Consent: where required, for marketing communications or specific cookies.
• Legal obligation: to comply with applicable laws, court orders, and tax requirements.

4. Third-Party Service Providers

We share personal information with carefully selected third parties that help us operate the Service. Each of them processes data under their own privacy policies and contractual data-protection terms.

• Supabase — managed Postgres database, authentication, and storage of account, site, and message data.
• Vercel — application hosting, edge network, and request logging.
• Groq — large language model inference used to generate widget answers from indexed content.
• Google Generative AI — embedding model used to convert text into vector representations for retrieval.
• Lemon Squeezy — Merchant of Record that processes payments and stores billing information.
• Email providers — used to send transactional and account-related emails.

Customer-submitted content and Visitor questions are transmitted to our AI providers solely to generate answers. We do not authorize them to use that content to train their models, where their terms permit such an opt-out.

5. AI Processing

When a Visitor submits a question, Chat9retrieves relevant text chunks from the Customer’s indexed site content and sends both the question and the retrieved context to our AI provider to generate an answer. The full question and answer are logged on our servers so the Customer can review chat history in their dashboard. AI providers may briefly retain prompts and responses for safety and abuse-prevention purposes in accordance with their policies.

6. Cookies & Local Storage

We use a minimal set of browser storage mechanisms:

• Authentication cookies: required for Customers to stay signed in to the dashboard.
• Session storage (widget): a random per-tab session ID that lets multiple messages in one conversation be linked together. Cleared automatically when the tab is closed.

We do not use third-party advertising or cross-site tracking cookies. Customers are responsible for any additional tracking that they configure on their own websites.

7. Data Retention

We retain account information for as long as your account is active. If you cancel your account, we may retain limited records to comply with legal, tax, and accounting obligations, typically for up to seven years. Indexed website content and chat history are deleted within a reasonable period after account deletion. Aggregated, de-identified statistics may be retained indefinitely.

8. Data Security

We use industry-standard technical and organizational measures to protect personal information, including encryption in transit (TLS), encrypted storage at our database provider, role-scoped access controls (row-level security), and limited employee access. No system is perfectly secure, and we cannot guarantee the absolute security of your data.

9. Your Rights

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, restrict processing, or port your data, and to object to certain uses. Customers can manage most account data directly from the dashboard. For any other request, contact us at contact.bool9@gmail.com. Visitors should direct most data requests to the Customer who deployed the widget, since that Customer is the controller of the conversation data; we will support Customers in responding to such requests.

If you are in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection authority. In India, you may have rights under the Digital Personal Data Protection Act (DPDP).

10. International Data Transfers

Bool9 is based in India, and our service providers operate data centers in multiple regions including the United States and the European Union. By using the Service, you understand that your information may be transferred to and processed in countries other than your own. We rely on appropriate safeguards, such as standard contractual clauses, where required.

11. Children

Chat9 is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided personal information to us, contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email or an in-product notice. The “Last updated” date at the top of this page indicates when the policy was last revised.

13. Contact

Questions about this Privacy Policy or our data practices? Contact us at contact.bool9@gmail.com.