Privacy Policy

1. Introduction

Welcome to WizChat AI ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service that transforms documentation and content into AI-powered chatbots.

By using our service, you consent to the data practices described in this Privacy Policy.

2. Information We Collect

Personal Information

• Email address and account credentials
• Name and profile information
• Payment and billing information
• Communication preferences

Content Data

• Documents you upload (PDFs, Word files, text files, etc.)
• YouTube videos and transcripts you connect
• Website content you provide for scraping
• Custom training data and chatbot configurations

Usage Information

• Chatbot interactions and conversations
• Analytics data and performance metrics
• Log files and technical data
• Device information and IP addresses

3. How We Use Your Information

• Process and analyze your content to create AI embeddings
• Generate responses for your chatbots using AI models
• Provide customer support and technical assistance
• Improve our service performance and features
• Send service-related notifications and updates
• Process payments and manage subscriptions
• Comply with legal obligations and prevent fraud

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide our service — account management, chatbot creation, content processing, and AI responses
• Consent (Art. 6(1)(a)): Analytics cookies (Google Analytics, Vercel Analytics, Vercel Speed Insights) are only loaded after you accept cookies
• Legitimate interest (Art. 6(1)(f)): Service security, fraud prevention, and AI operation monitoring (Langfuse) to maintain service quality
• Legal obligation (Art. 6(1)(c)): Tax and billing record retention as required by law

5. AI-Generated Content Disclosure (EU AI Act Article 50)

Several features in our platform use AI to generate content. In accordance with the EU AI Act, we disclose the following:

• System Prompt Generation: Uses Google Gemini to generate chatbot system prompts based on your input. Outputs are clearly labeled as "AI-Generated"
• System Prompt Refinement: Uses Google Gemini to refine existing prompts based on your feedback
• Metric SQL Generation: Uses OpenAI to generate database queries from natural language descriptions
• Chatbot Responses: All deployed chatbots use LLMs (OpenAI) to generate responses. End-users are informed via a disclaimer modal and a persistent AI-powered indicator

All AI-generated content is marked in the UI and in API responses with metadata indicating the AI model used. You should always review AI-generated content before use.

6. Data Processing and AI Services

Your content is processed using third-party AI services including:

• OpenAI: For text embeddings and chat completions
• Google Cloud (Gemini): For document processing, YouTube integration, and AI content generation
• Pinecone: For vector storage and similarity search
• Firebase: For authentication and data storage
• Langfuse: For AI operation observability, cost tracking, and quality monitoring of LLM interactions
• Vercel: For hosting, deployment, and performance analytics (loaded only with your consent)
• Stripe: For payment processing and subscription management

These services may process your data according to their respective privacy policies. We use encryption and secure transmission methods to protect your data.

Authentication & Data Storage

Authentication Provider

We use Firebase Authentication (operated by Google LLC) to manage user accounts and secure access to our service.

Data Stored by Firebase Auth

• Email address
• Password (hashed using industry-standard encryption, never stored in plain text)
• Login timestamps and session data
• Account creation date
• User ID (randomly generated unique identifier)

Data Location

Important: Firebase Authentication currently stores authentication credentials only in the United States. This includes your email address and hashed password. Your authentication data will be transferred to and processed in the US.

Your Content Data: All other data (chatbot content, uploaded documents, conversations, and analytics) will be stored in the region you select when creating your chatbot (EU or US). If you select EU, all your content stays in the European Union.

Legal Safeguards for EU Users

We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and Google's certification under the EU-US Data Privacy Framework to protect your data when transferred to the US.

Additional Protections:

• All data encrypted in transit using TLS 1.3
• All data encrypted at rest using AES-256
• Access strictly controlled and logged
• Third-party subprocessors (Google/Firebase, Langfuse) hold SOC 2 Type II / ISO 27001 certifications

Data Processing Agreement

Firebase acts as a data processor under GDPR. You can review their data processing terms:

• Firebase Data Processing Terms
• Google Cloud Standard Contractual Clauses

Future Plans

When Firebase introduces EU-based authentication, we will migrate EU users to EU storage to provide full data residency in the European Union. We are actively monitoring Google's roadmap for this capability.

Your Rights

You can delete your account at any time from your account Settings page. Upon deletion, all authentication data is permanently removed from Firebase Authentication.

7. YouTube API Services

WizChat AI uses YouTube API Services to let you import your own YouTube videos as a knowledge source for your chatbots. This section describes that integration specifically, as required by the YouTube API Services Terms of Service.

Terms You Agree To

By using any feature of WizChat AI that accesses YouTube data, you agree to be bound by the YouTube Terms of Service. YouTube is a service provided by Google LLC. Google's handling of your information is governed by the Google Privacy Policy.

Permissions We Request

When you connect your YouTube account, we request a single OAuth scope, youtube.force-ssl. We request this scope because it is the minimum permission that allows us to read the caption and transcript tracks of your videos. We do not request permission to upload, edit, publish, or delete anything in your YouTube account, and we never post to YouTube on your behalf.

YouTube Data We Access and Store

• Your YouTube channel identifier and channel name
• Video metadata for the videos you choose to import: video ID, title, description, publication date, duration, thumbnail URL, category, and privacy status
• Caption and transcript text for the videos you choose to import
• OAuth access and refresh tokens, stored encrypted at rest and never exposed to your chatbot's end users

We access YouTube data only for the videos you explicitly select for import. We do not crawl your channel, access your watch history, viewing activity, subscriptions, playlists, comments, or private messages, and we do not build advertising profiles or sell YouTube data to anyone.

How We Use YouTube Data

Transcript text from your imported videos is converted into vector embeddings and stored in your chatbot's isolated namespace so that your chatbot can answer questions using that content. Video metadata is used to display your video library in the dashboard and to attribute chatbot answers back to the source video. YouTube data is never shared between accounts or used to train general-purpose AI models.

Revoking Our Access

You can revoke WizChat AI's access to your YouTube data at any time, in either of two ways:

• From within WizChat AI: use the “Disconnect YouTube” control in your dashboard.
• From your Google Account: visit the Google security settings page and remove WizChat AI's access.

YouTube Data Deletion Policy

When you disconnect your YouTube account through our dashboard, we immediately and automatically:

• Revoke your OAuth tokens with Google's token revocation endpoint;
• Permanently delete the stored access and refresh tokens from our systems; and
• Purge the synced catalog of your YouTube video metadata.

Deleting an imported video from your dashboard removes its transcript text and the vector embeddings derived from it. Deleting a chatbot removes the entire vector namespace for that chatbot, including all embeddings derived from YouTube content. Deleting your WizChat AI account revokes your YouTube authorization and removes all of the above.

Regardless of any action you take, stored YouTube API data that is refreshable is either refreshed or deleted within 30 days of retrieval, in line with the YouTube API Services Developer Policies. Aggregated, non-identifying usage statistics may be retained.

8. Data Sharing and Disclosure

We do not sell your personal information. We may share information in these circumstances:

• With your explicit consent
• To comply with legal requirements or court orders
• To protect our rights, property, or safety
• With service providers who assist in our operations (under strict confidentiality)
• In connection with a business transfer or acquisition

9. Data Security

We implement industry-standard security measures:

• Encryption in transit and at rest
• Secure authentication and access controls
• Regular security audits and monitoring
• Compliance with data protection regulations

10. Your Rights and Choices

You have the right to:

• Access, update, or delete your personal information
• Access and review your personal information through your dashboard
• Opt-out of marketing communications
• Delete your chatbots and associated content
• Request restriction of processing

11. Data Retention

We retain your data for as long as your account is active or as needed to provide services. You can delete your data at any time through your account settings. We may retain certain information for legal compliance or legitimate business purposes.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

13. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the information immediately.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.