Privacy Policy

This Privacy Policy applies to information processed through Asiyst services, including:

• The Asiyst website.
• Asiyst user accounts.
• Projects and workspaces.
• AI assistants and avatars.
• Conversations and AI interactions.
• Knowledge sources.
• Uploaded files.
• API services.
• SDKs.
• CLI tools.
• Developer integrations.
• Website integrations.
• Analytics and product functionality.
• Customer support.
• Communications and notifications.
• Payments and credit purchases.
• Security and abuse-prevention systems.

This Privacy Policy does not necessarily apply to third-party websites, applications, services, AI providers, payment providers, or other external services that have their own privacy policies.

We may collect information that you provide directly, information generated through your use of the Services, and information received from connected services.

The categories of information may include:

• Account information.
• Contact information.
• Authentication information.
• Project information.
• Workspace information.
• Developer information.
• API and integration information.
• AI interaction information.
• Knowledge-source information.
• Uploaded content.
• Usage information.
• Device and technical information.
• Security information.
• Payment and transaction information.
• Support communications.
• Information obtained through connected third-party services.

The specific information collected depends on which Services and features you use.

When you create an Asiyst account, we may collect information such as:

• Name.
• Email address.
• Account credentials.
• Organization information.
• Profile information.
• Account preferences.
• Authentication-related information.
• Project and workspace associations.

Some information may be optional while other information may be required to create or maintain an account.

We process information necessary to authenticate users and protect accounts.

This may include:

• Authentication identifiers.
• Session information.
• Login events.
• Authentication timestamps.
• Account security information.
• Password-related information processed through authentication systems.

Asiyst does not need to receive or store a user's plaintext password where authentication is handled by a third-party authentication provider or managed authentication system.

If you create projects or workspaces, we may process information associated with them, including:

• Project names.
• Project configuration.
• Workspace configuration.
• Project identifiers.
• Membership information.
• Permissions.
• Assistant configuration.
• Avatar configuration.
• Integration settings.
• Developer settings.
• Usage configuration.

This information is used to provide and manage the Services.

When you use an Asiyst AI assistant or related AI functionality, we may process information associated with your interaction.

Depending on the feature, this may include:

• Prompts.
• Questions.
• Instructions.
• AI-generated responses.
• Conversation history.
• Tool requests.
• Context provided to the AI system.
• User feedback.
• Interaction metadata.
• Information required to provide the requested AI functionality.

The specific information processed depends on the configuration of the AI feature.

Prompts and AI outputs may be processed to provide the requested AI functionality.

For example, a user may submit a question through an Asiyst assistant and receive an AI-generated response.

Depending on the configuration, prompt and output information may pass through third-party AI providers required to process the request.

You should not submit information to an AI feature unless you are authorized to provide that information and its processing is appropriate for the intended use.

Asiyst does not treat customer prompts, conversations, uploaded knowledge, or customer content as automatically authorized for training general-purpose Asiyst models.

Where Asiyst uses customer information for model training or model improvement, the applicable processing should be governed by the relevant product terms, agreement, consent, or other documented authorization.

Third-party AI providers may have their own data-use and training policies. Their treatment of information may differ depending on the provider, service, account configuration, and applicable terms.

Additional information is provided in the AI Data Processing & Training Policy.

Asiyst may allow users to connect or provide knowledge sources for use by AI assistants.

Knowledge sources may include:

• Websites.
• Web pages.
• Documents.
• Uploaded files.
• Product information.
• Business information.
• Structured data.
• Connected services.
• Customer-provided content.

We process these sources to provide functionality such as retrieval, contextual responses, search, and AI-assisted interactions.

If you connect a website, application, service, or other external source to Asiyst, we may process information necessary to establish and maintain that connection.

Depending on the integration, this may include:

• Connection identifiers.
• Access permissions.
• Content retrieved from the connected source.
• Metadata.
• Synchronization information.
• Configuration information.
• Integration status.

You are responsible for ensuring that you have the necessary rights and permissions to connect and process the information provided through a third-party source.

If the Services allow you to upload files, we may process:

• File contents.
• File names.
• File types.
• File metadata.
• Upload information.
• Processing status.
• Associated project or workspace information.

Uploaded files may be processed to provide features such as knowledge retrieval, document processing, search, AI assistance, or other functionality selected by the user.

When you use Asiyst APIs, we may process information associated with API requests, including:

• API keys or key identifiers.
• Project identifiers.
• Request metadata.
• Endpoint information.
• Request timestamps.
• Response metadata.
• Usage information.
• Error information.
• Rate-limit information.
• Security and abuse-prevention information.

We may use API-related information to authenticate requests, provide services, measure usage, troubleshoot problems, enforce limits, and protect the platform.

Asiyst may issue API keys or allow users to configure credentials for third-party services.

API credentials may be treated as sensitive information.

We may process such credentials where necessary to provide the requested functionality, authentication, integration, or API access.

Users are responsible for protecting credentials issued to them and for ensuring that credentials are not unnecessarily exposed in client-side applications, public repositories, websites, or other insecure environments.

Certain Asiyst features may allow customers to connect their own accounts or credentials for AI providers.

Depending on the integration, these providers may include services such as:

• OpenAI.
• Anthropic.
• Google.
• Other supported AI or infrastructure providers.

When you connect a provider account, Asiyst may process the information necessary to authenticate and use that provider on your behalf.

The third-party provider remains responsible for its own processing activities under its applicable terms and privacy policy.

We may collect information about how the Services are used.

This may include:

• Features used.
• API requests.
• Request counts.
• Token or usage measurements where applicable.
• Project activity.
• Assistant activity.
• SDK activity.
• CLI activity.
• Integration activity.
• Error events.
• Performance information.
• Service interaction events.

Usage information may be used for service operation, billing, analytics, security, abuse prevention, troubleshooting, and product improvement.

When you access the Services, we may automatically receive technical information such as:

• IP address.
• Browser type.
• Operating system.
• Device information.
• Language settings.
• Time zone.
• Referrer information.
• Pages or features accessed.
• Network information.
• Diagnostic information.
• General interaction information.

The exact information collected may vary depending on the device, browser, application, and feature being used.

Our systems may generate logs containing information about activity within the Services.

Logs may include:

• Login events.
• API requests.
• Authentication events.
• Errors.
• Security events.
• Administrative actions.
• Configuration changes.
• Integration events.
• System events.

Logs may be used for security, troubleshooting, reliability, auditing, abuse prevention, and service operation.

Asiyst may use cookies, local storage, pixels, SDKs, and similar technologies.

These technologies may be used for:

• Authentication.
• Session management.
• Security.
• Preferences.
• Analytics.
• Performance measurement.
• Service functionality.
• Abuse prevention.

Additional information is provided in the Cookie Policy.

We may use analytics and measurement technologies to understand how users interact with the Services.

Analytics information may be used to:

• Understand feature usage.
• Identify technical problems.
• Measure performance.
• Improve user experience.
• Monitor service reliability.
• Understand product adoption.

Where third-party analytics providers are used, those providers may process information under their own terms and privacy policies.

We may collect and process information necessary to communicate with users.

Communications may include:

• Account notifications.
• Security notifications.
• Product notifications.
• API-related notifications.
• Project notifications.
• Integration notifications.
• Support communications.
• Service announcements.
• Transactional emails.

Marketing communications, where applicable, may be subject to separate consent or applicable legal requirements.

When you contact Asiyst support, we may process information contained in your communication.

This may include:

• Name.
• Email address.
• Account information.
• Support messages.
• Attachments.
• Technical information.
• Troubleshooting information.
• Information you voluntarily provide.

Support information may be used to investigate and resolve your request and improve support operations.

If you purchase credits, subscriptions, or other paid Services, payment processing may involve third-party payment providers.

Asiyst may receive information such as:

• Transaction identifiers.
• Payment status.
• Amount paid.
• Currency.
• Product or credit information.
• Refund information.
• Payment method type.
• Billing information provided for the transaction.

Payment card information may be processed directly by the applicable payment provider rather than being stored directly by Asiyst.

Depending on the Services used, we may process:

• Billing name.
• Billing address.
• Tax information.
• Transaction records.
• Invoices.
• Receipts.
• Credit purchases.
• Subscription information.
• Refund information.

Billing information may be retained as necessary for accounting, legal, tax, fraud-prevention, and transaction-management purposes.

We may receive information from third parties when necessary to provide or protect the Services.

Sources may include:

• Authentication providers.
• Payment providers.
• AI providers.
• Cloud infrastructure providers.
• Analytics providers.
• Connected integrations.
• Security providers.
• Business partners.
• Service providers.

The information received depends on the applicable integration and the permissions granted.

We may use information to:

• Provide the Services.
• Create and manage accounts.
• Authenticate users.
• Operate projects and workspaces.
• Provide AI functionality.
• Process AI requests.
• Maintain knowledge sources.
• Operate APIs, SDKs, and CLI tools.
• Process payments.
• Measure usage.
• Provide customer support.
• Send service communications.
• Detect and prevent fraud.
• Detect abuse.
• Protect accounts and systems.
• Investigate security incidents.
• Troubleshoot technical problems.
• Maintain service reliability.
• Improve functionality.
• Develop and evaluate product features.
• Comply with legal obligations.
• Enforce agreements and policies.
• Protect the rights, safety, and property of Asiyst, users, and others.

Where applicable law requires a legal basis for processing personal information, the applicable basis may include:

• Performance of a contract.
• Compliance with legal obligations.
• Legitimate interests.
• Consent.
• Protection of vital interests.
• Other lawful bases permitted by applicable law.

The appropriate legal basis depends on the specific processing activity and applicable jurisdiction.

Where permitted by law, Asiyst may process information based on legitimate interests such as:

• Providing and improving the Services.
• Securing accounts and infrastructure.
• Preventing fraud and abuse.
• Understanding service performance.
• Supporting customers.
• Protecting legal rights.
• Maintaining business operations.

Where required, Asiyst will consider applicable legal requirements and individual rights when relying on legitimate interests.

We may share information with third parties where necessary to provide, maintain, secure, or improve the Services.

Categories of recipients may include:

• Cloud infrastructure providers.
• AI model providers.
• Payment processors.
• Authentication providers.
• Analytics providers.
• Email providers.
• Customer support providers.
• Security providers.
• Hosting providers.
• Integration providers.
• Professional advisers.
• Legal authorities where legally required.

We do not authorize third parties to use information beyond the purposes permitted by the applicable relationship, agreement, or law.

When an AI feature uses a third-party AI provider, information required to process the AI request may be transmitted to that provider.

The provider may process information under its own contractual terms and privacy documentation.

The applicable provider may depend on:

• Asiyst configuration.
• Customer configuration.
• AI model selected.
• API configuration.
• Geographic availability.
• Product functionality.

Users should review applicable third-party provider policies where relevant.

Payment transactions may be processed through third-party payment providers.

Payment providers may collect and process payment and transaction information according to their own privacy policies and terms.

Asiyst may receive transaction information necessary to confirm and manage the transaction.

Asiyst may use subprocessors and service providers to process information on behalf of Asiyst or customers.

Subprocessors may provide services such as:

• Hosting.
• Infrastructure.
• Storage.
• AI processing.
• Authentication.
• Email delivery.
• Payments.
• Analytics.
• Security.
• Monitoring.
• Customer support.

Additional information may be available in the Subprocessors Policy.

If Asiyst undergoes a merger, acquisition, financing, restructuring, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction.

Any transfer will remain subject to applicable legal requirements and relevant confidentiality or privacy obligations.

We may disclose information when reasonably necessary to:

• Comply with applicable law.
• Respond to valid legal process.
• Respond to lawful governmental requests.
• Protect rights or property.
• Investigate fraud or abuse.
• Protect users or the public.
• Enforce agreements.
• Prevent or address security incidents.

Where legally permitted, we may provide notice of certain legal requests.

Asiyst uses technical and organizational measures intended to protect information against unauthorized access, alteration, disclosure, destruction, or loss.

Security measures may include:

• Access controls.
• Authentication controls.
• Encryption where appropriate.
• Credential protections.
• Monitoring.
• Logging.
• Security testing.
• Infrastructure protections.
• Incident-response procedures.

No method of electronic storage or transmission can be guaranteed to be completely secure.

You are responsible for taking reasonable measures to protect your account and information.

This includes:

• Protecting passwords.
• Protecting API keys.
• Protecting third-party credentials.
• Using appropriate access controls.
• Avoiding unnecessary disclosure of confidential information.
• Monitoring connected applications.
• Reporting suspected unauthorized access.

You should not place sensitive credentials in publicly accessible client-side code or repositories.

We retain information for periods reasonably necessary for the purposes described in this Privacy Policy, including:

• Providing the Services.
• Maintaining accounts.
• Completing transactions.
• Maintaining security.
• Preventing fraud and abuse.
• Meeting legal obligations.
• Resolving disputes.
• Enforcing agreements.

Retention periods may vary depending on the type of information, purpose, contractual requirements, legal requirements, and operational needs.

Additional information is provided in the Data Retention Policy.

You may have rights to request deletion of personal information depending on applicable law and the circumstances.

Account and data deletion may also be available through applicable product functionality.

Some information may need to be retained where required or permitted by law, necessary for security, required for financial records, involved in disputes, or otherwise subject to a valid retention requirement.

Additional information is provided in the Data Deletion Policy.

Depending on the Services and applicable law, users may be able to export certain information associated with their account or projects.

Export availability may vary by:

• Data type.
• Product functionality.
• Account type.
• Technical limitations.
• Legal restrictions.
• Third-party provider restrictions.

Additional information is provided in the Export & Data Portability Policy.

Information may be processed or stored in countries other than the country where you live.

Where applicable law imposes requirements on international transfers, Asiyst may use appropriate mechanisms for such transfers.

The location of processing may depend on infrastructure, service providers, AI providers, integrations, and other operational requirements.

Depending on your location and applicable law, you may have rights concerning your personal information.

These rights may include:

• Access.
• Correction.
• Deletion.
• Restriction of processing.
• Objection to processing.
• Data portability.
• Withdrawal of consent.
• Appeal of certain decisions.
• Complaint to a relevant data protection authority.

These rights are subject to applicable legal limitations and exceptions.

To exercise an applicable privacy right, you may contact Asiyst through the available privacy or support contact method.

We may request information necessary to verify your identity and authority before completing a request.

This verification is intended to prevent unauthorized access to personal information.

The Services are not intended for children who are not legally permitted to use the applicable Services under the laws of their jurisdiction.

We do not knowingly seek to collect personal information from children in violation of applicable law.

If you believe a child has provided personal information to Asiyst in circumstances where collection was not appropriate, you may contact us.

Users should avoid submitting sensitive personal information to Asiyst unless the applicable feature is specifically designed to process it and the user has an appropriate legal basis and authorization.

Sensitive information may receive additional protections under applicable law.

Asiyst does not require users to provide sensitive personal information merely to use ordinary product functionality unless specifically necessary for the relevant service.

If you use Asiyst to process personal information belonging to your customers, employees, users, website visitors, or other individuals, you are responsible for ensuring that:

• You have the required legal authority.
• You provide appropriate notices.
• You obtain required permissions or consent.
• Your processing complies with applicable law.
• Your instructions to Asiyst are lawful.
• Your use of third-party integrations is properly authorized.

Where applicable, the Data Processing Agreement may govern processing performed by Asiyst on your behalf.

The Services may contain integrations, links, or functionality provided by third parties.

Third-party services may have their own:

• Privacy policies.
• Terms.
• Data practices.
• Security controls.
• Retention practices.

Asiyst is not responsible for privacy practices that are independently controlled by third parties.

The Services may contain links to websites or services that Asiyst does not control.

Visiting an external service is subject to that service's policies and terms.

You should review the privacy policy of each external service before providing information to it.

Some browsers and devices provide privacy preferences or signals.

The interpretation and handling of such signals may vary depending on applicable law, technology, browser behavior, and the specific service involved.

Asiyst may use automated systems to:

• Process AI requests.
• Detect abuse.
• Detect security threats.
• Monitor system performance.
• Measure usage.
• Identify technical errors.
• Enforce technical limits.

Automated processing does not necessarily result in a legal or similarly significant decision about an individual.

Where applicable law provides rights relating to automated decision-making, those rights may apply subject to legal limitations.

Asiyst AI assistants and avatars may process information provided by users or retrieved from configured knowledge sources.

An avatar may interact with website visitors or users based on its configured functionality.

Customers who deploy Asiyst assistants are responsible for determining what information their assistants collect and how that information is used.

Customers should provide appropriate privacy notices to their own users where required.

When a customer deploys an Asiyst assistant on its website, the customer may determine what information is collected through that assistant.

Depending on the implementation, information may include:

• Visitor messages.
• AI interactions.
• Navigation or interaction events.
• Information voluntarily provided by the visitor.
• Technical information.

The customer deploying the assistant may be the party responsible for determining the applicable privacy notice and legal basis for visitor data processing.

AI-generated responses may contain personal information if such information is included in the input, retrieved from a knowledge source, or otherwise made available to the AI system.

Users are responsible for reviewing AI-generated outputs before relying on them, particularly where they contain personal, confidential, regulated, or third-party information.

Where permitted by law, Asiyst may create aggregated or de-identified information from information processed through the Services.

Such information may be used for purposes including:

• Analytics.
• Service performance.
• Security.
• Product development.
• Research.
• Business reporting.

Where information has been properly de-identified, it may no longer be treated as personal information under applicable law.

We may process information to detect, investigate, and prevent:

• Fraud.
• Unauthorized access.
• Credential abuse.
• Payment abuse.
• API abuse.
• Security attacks.
• Malicious activity.
• Automated abuse.
• Violations of applicable policies.

Fraud and abuse records may be retained as necessary to protect the Services and comply with legal requirements.

If we identify activity that presents a security, fraud, abuse, or legal risk, we may process relevant information and take measures such as:

• Requiring additional verification.
• Restricting access.
• Revoking credentials.
• Limiting API usage.
• Suspending functionality.
• Suspending an account.

Such measures may be taken in accordance with applicable agreements and policies.

If you use Asiyst APIs, SDKs, or CLI tools to build an application, your application may collect information from its users.

You are responsible for the privacy practices of your application and should provide appropriate disclosures to its users.

Using Asiyst technology does not automatically make Asiyst responsible for all information collected by a developer application.

For organizational accounts, an administrator may have authority over:

• User access.
• Projects.
• Workspaces.
• Data.
• Integrations.
• Account configuration.

Individual users of an organizational account may need to contact their organization for certain account-level requests.

If you use a shared workspace, project, or organization, information may be visible to other authorized members according to the applicable permissions.

Users should not place information into shared areas unless they are authorized to disclose it to the relevant members.

You may be able to update certain account information through your account settings.

If information cannot be updated directly through the Services, you may contact Asiyst through the applicable support or privacy channel.

You are responsible for providing accurate information when creating and maintaining an account.

Where appropriate, you may request correction of personal information that is inaccurate or incomplete.

If Asiyst processes personal information on behalf of a customer, the customer may control certain processing decisions.

In those circumstances, individuals may need to direct requests to the relevant Asiyst customer, depending on applicable law and the relationship between the parties.

Asiyst may assist customers with applicable requests where required by contract or law.

For customers requiring a contractual framework for processing personal information, Asiyst may provide a Data Processing Agreement.

The DPA may establish additional obligations concerning:

• Processing instructions.
• Security.
• Subprocessors.
• Data subject requests.
• International transfers.
• Security incidents.
• Deletion and return of data.

Where applicable, the DPA governs the processing activities covered by that agreement.

If you believe that Asiyst has processed your personal information unlawfully, you may contact Asiyst to raise the issue.

Depending on your jurisdiction, you may also have the right to submit a complaint to a competent data protection or privacy authority.

We may update this Privacy Policy when our Services, data practices, legal requirements, or operational practices change.

When changes are made, the updated version will be made available through the applicable Asiyst website or service.

Your continued use of the Services after an applicable update may be subject to the revised Privacy Policy.

This Privacy Policy should be read together with other applicable Asiyst policies and agreements, including:

• Terms of Service.
• Cookie Policy.
• Data Retention Policy.
• Data Deletion Policy.
• Export & Data Portability Policy.
• Data Processing Agreement.
• AI Transparency & Disclosure.
• AI Data Processing & Training Policy.
• Security Policy.
• Security & Trust Center.
• Subprocessors Policy.
• Third-Party Services Policy.
• Developer Terms.
• API Terms.

If a specific agreement expressly governs a particular processing activity, that agreement may control to the extent provided in that agreement.

If you have questions, concerns, or requests regarding this Privacy Policy or Asiyst's privacy practices, contact Asiyst through the privacy or support contact method provided on the Asiyst website.

When contacting us regarding a privacy request, provide enough information for us to understand and process your request while avoiding unnecessary disclosure of sensitive information.