Privacy policy

Overview

BusinessLyft lets businesses create AI assistants trained on their own website and documents, and add them to their site as a chat widget. This policy covers our website, the BusinessLyft dashboard, and the widget when it runs on a customer's site.

There are two kinds of people whose data we handle:

• Customers: the businesses and people who sign up for BusinessLyft and build assistants.
• Visitors: people who chat with a customer's assistant on the customer's website.

What we collect

From customers

• Account details: your name, email address and password (stored hashed), or your basic Google profile if you sign in with Google.
• Workspace content: the website pages we crawl for you, files you upload, text and FAQs you add, assistant settings, actions you configure and the secrets they use.
• Technical data: logs we need to run and secure the service, such as request times and errors.

From visitors, on behalf of our customers

• Conversations: the messages a visitor sends and the assistant's replies, plus any ratings or feedback they give.
• Contact details they choose to share, such as a name, email address or phone number entered in a chat form.
• Context: a random visitor ID, the page they chatted from and the page that referred them, their device type, browser and operating system, their browser's language and timezone, and an approximate country based on network headers, timezone or language. We don't store visitors' IP addresses or precise location.

How we use it

• To provide the service: train assistants, answer visitors, run the actions you set up and show you conversations and leads.
• To score and summarise conversations as leads (for example "Hot · Ready to buy") for the customer who owns the assistant.
• To keep BusinessLyft secure, prevent abuse and enforce usage limits.
• To contact customers about their account and the service.

We don't sell personal data, and we don't use your content or your visitors' conversations to train AI models of our own.

AI processing

To generate a reply, we send the visitor's message, the relevant parts of your knowledge base and your assistant's instructions to an AI model provider through the Vercel AI Gateway. To learn your website, we fetch and convert its pages using Jina Reader. These providers process the data only to return results to us.

AI answers can be wrong. The assistant cites the pages it used so you and your visitors can check them.

Your website visitors

When a customer adds the widget to their site, that customer decides what the assistant is for and is responsible for its visitors' data. BusinessLyft processes visitor data on the customer's behalf and following their settings. If you chatted with an assistant on someone else's website and have a question about your data, please contact that business first. We'll help them respond.

Customers should tell their visitors about the assistant in their own privacy policy.

Service providers

We share data only with providers that help us run BusinessLyft:

• Hosting and database providers, which store and serve the service.
• AI model providers, reached through the Vercel AI Gateway, to generate replies.
• Jina AI, to fetch and read the website pages you ask us to learn.
• Google, if you choose to sign in with Google.
• DiceBear and flagcdn, which serve avatar and flag images. They receive only a random seed or a country code, never names or messages.
• Your own systems: when you set up an API request or webhook action, we send the details that action needs to the address you choose.

We may also disclose data if the law requires it, or to protect the rights and safety of our users and the service.

Cookies & local storage

We keep this short because we use very little:

• Dashboard sign-in: a session cookie keeps you logged in. It's essential and is removed when you log out or it expires.
• The widget: it stores a random visitor ID and the visitor's latest conversation in the browser's local storage, so a chat can continue across pages and visits. It doesn't set tracking cookies.

We don't use advertising cookies or third-party analytics trackers on our website or in the widget.

Retention & deletion

We keep your data for as long as your account is active. You can delete assistants, knowledge sources and conversations from the dashboard at any time. Deleting your account from your profile removes your account and every workspace you own alone, including its assistants, knowledge and conversations.

Security

• All traffic is encrypted in transit with HTTPS.
• Passwords are stored hashed, never in plain text.
• Secrets you add to actions are kept on our servers and are never sent back to the browser.
• You can lock your widget to your own domains, and webhooks are signed so you can verify they came from us.

No system is perfectly secure, but we work to protect your data and will tell affected customers promptly if a breach affects them.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. Email hello@businesslyft.com and we'll help. You can also complain to your local data protection authority.

BusinessLyft isn't meant for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll let customers know by email or in the dashboard before they take effect.