1. Three roles, and which one applies to you

We hold three different kinds of personal data, and our responsibility differs between them:

• Business accounts. Details of the companies that subscribe to Ailin SaaS and of their staff. For this data [legalEntity] is the controller.
• End-customer data. The people who contact one of those businesses. Here the business decides what is collected and why; we process it on their instructions and act as their processor. If you contacted a company and want your data removed, that company is the right first point of contact - though we will act on any request that reaches us, as described in section 6.
• Enquiries from this website. If you fill in the demo-request form on this site, what you type comes to us and to nobody else. There is no business involved: you are not a customer of anyone using the platform, and we are not acting on anyone's instructions. For this data [legalEntity] is the controller, and it is used to reply to you about the demo you asked for.

Where we act as a processor we do not decide what is collected, how long the business keeps it, or who inside that business may see it. What we do decide is how the platform stores and secures it, which service providers are used, and what the AI assistant is technically able to do - and those are described below because they apply to every business on the platform.

2. What is stored

For business accounts and their staff:

• Company name, contact email and phone, address and billing details
• Staff names, work email addresses, phone numbers and profile photos
• Authentication data - a password stored only as a bcrypt hash, and a record of active sign-in sessions
• Access tokens for the channels a business chooses to connect. Instagram, WhatsApp, Gmail and Google Calendar are connected through that provider's own authorisation flow. Telegram is not: a Telegram bot token is pasted into the product by hand and stored the same way. Either way the token is held so the platform can send and receive on the business's behalf.

For the customers of those businesses:

• The identifier the channel provides - a phone number, an email address, or an account id issued by the messaging platform
• Name and profile name, where the channel supplies one, and a display name a member of staff may set
• The content of messages sent to or from the business, including any files, images or voice notes attached to them
• A copy of the customer's profile photo where the messaging platform provides one. It is downloaded into our own file storage rather than linked, so that it does not stop working when the provider's own link expires.
• Call records, typed transcripts and audio recordings, where the business uses the call centre
• Records the business creates about them - requests, bookings, invoices, deals, notes and tags
• A phone number the AI assistant has asked for and the customer has given, where the business has switched that on - see section 4

If you ask for a demo on this website

The demo-request form on this site asks for five things, and stores exactly those five and nothing more:

• Your name
• Your business
• What that business sells, if you tell us - the field is optional
• One way to reach you, which may be an email address or a phone number: whichever you give is what is stored, exactly as you typed it
• Your message, if you write one - that field is optional too

Stored with it are the language the form was in, the date the request arrived, and, once somebody here has read it, whether it was accepted or declined, any note a colleague added, and who decided. Nothing else about the visit is stored with the enquiry: this site has no analytics, no advertising or tracking cookies and no visitor profile, and there is no CAPTCHA or similar service, so nothing about the visit is sent anywhere to be scored. Every file the site uses, including its fonts, is served from the site itself, so opening a page contacts no other company. Like any website, the server that delivers it, run for us by Amazon Web Services, keeps a technical log of the requests it answers - the network address, the page asked for and the browser's self-description - which is used to operate and secure the site and not to recognise or profile visitors. The form has a tick-box confirming that a person filled it in; it is a yes-or-no answer that identifies nobody. The form does not ask for, and cannot accept, a password or a payment detail.

So that the form cannot be used to flood us, the network address a request arrives from is used to limit how many enquiries can be sent from one place in a short period, and is used for nothing else.

The site stores two things in your browser, and neither is sent to us or used to recognise you: the language you chose and whether you asked for the light or the dark theme. They stay on the device until you clear its site data.

An enquiry is not a business account and does not create one. If you later subscribe, the account is separate; the enquiry does not become part of it, and it does not become part of any business's customer records.

Data the platform works out for itself

Some of what is held is not supplied by anybody. The platform derives it from the records above, and it is stored on the customer's record and shown to the business:

• Mood. Every incoming customer message is scored for sentiment as it arrives, and the score is stored both on that message and as the customer's current mood. The scoring is a phrase match performed on our own systems; the message is not sent anywhere for it.
• Lead score. A score out of 100, recalculated periodically, together with the individual signals that produced it and how they changed. Where a business has enabled it, one of those signals is produced by an AI model.
• Churn risk. A low, medium or high rating with the reasons behind it, derived from how recently the customer was in contact, their mood, their lead score and whether they have opted out of marketing.
• Tier and value. A loyalty tier, a lifetime value figure, and a recency, frequency and money ranking of this customer against the other customers of the same business.

The staff mobile app

Staff of a business can also use Ailin through a mobile app for iPhone, iPad and Android. It signs in to the same account as the web app and shows the same records. What it keeps on the phone and what it sends is:

• Sign-in. The email address and password you sign in with are sent to us to start a session. The app then keeps your session tokens and your account details - name, email address, phone number, role, preferred language and the businesses you belong to - in the phone's secure storage - the iOS Keychain or the Android Keystore - so that you stay signed in. It also keeps your chosen language, the business you last opened, and a random identifier for this installation, which lets the list of your active sessions tell your devices apart. Signing out deletes the session and your account details from the phone.
• Notifications. If you allow notifications, the app obtains a push token for the device and sends it to us with the device's platform and the app's version, so that notifications meant for you reach this device. A notification shows the kind of event and the name of the customer or record it concerns, on the lock screen as well; a reminder to follow up with a customer can also show the note a colleague typed for it. It is sent through Expo's push service and from there through Apple or Google - see section 5. Signing out removes the device's registration.
• Business records. Customers, conversations, files and every other record are fetched from our servers when you open them. The app keeps no offline copy: what it has loaded is held in memory while it runs. The phone's operating system may keep images the app has shown in its own temporary cache.
• Camera, photos and microphone. Used only when you choose to take a photo, attach a photo, video or file to a message or a record, change your profile photo or record a voice message, and only after the phone has asked for your permission where it asks. What you choose is uploaded to us as part of that message, record or profile; a temporary copy the phone makes while doing so stays in the app's cache until the system clears it.
• Exports. When you export a customer list, the app writes the file to its cache and opens the phone's share sheet. Where the file goes from there - saved to the phone, sent by email or by a messenger - is your decision, and once it leaves the app it is outside our service.
• Crash reports. If crash reporting is switched on in the version of the app you use, a report of the error is sent to Sentry. Email addresses, phone numbers, tokens and the query part of links are removed from it first, no screenshot is taken, and no name or email address is attached. A crash inside the phone's native code is reported with details of the device and its operating system.
• Nothing else. The app has no advertising and no analytics, does not track you across other apps or websites, and does not read your location or your contacts.

Technical data

If a page fails, a crash report may be sent to our error-reporting provider. From the pages a business's own staff use, the report is filtered to remove secrets and query strings. From the public chat and call pages, which are used by people who have no account with us, the report is rebuilt from a short list of permitted fields: the error type, the code location, and a redacted error message. Browsing history within the page is discarded, the business's public code is removed, and any email address or phone number is redacted. There is no session recording and no performance tracing.

We do not ask for, and the platform is not designed to hold, special categories of data such as health, biometric or financial-account information. Because message content is stored as written, a customer may include such information in a message; it is then handled under the same terms as the rest of the conversation.

3. Why it is stored

Each purpose below is listed with the legal basis we rely on for it. Where we act as a processor for a business, the business is responsible for having a basis for its own collection; the basis named here is the one that covers our own processing.

• To deliver the service the business subscribed to. Running the shared inbox, the customer records and the modules a business has switched on. Huquqiy asos: [legalBasis]
• To let an AI assistant answer questions. Using material the business published into its own knowledge base, its catalogue and its records - see section 4. Huquqiy asos: [legalBasis]
• To send the messages a business or its assistant composes. Delivering over the channel the customer used, and by SMS or email where the business has chosen that. Huquqiy asos: [legalBasis]
• To score and rank customers for the business. Producing the mood, lead score, churn risk and tier described in section 2, so that staff can decide who to contact. Huquqiy asos: [legalBasis]
• To produce the reports and metrics shown inside the product. Including per-colleague workload and performance figures for the business's own staff. Huquqiy asos: [legalBasis]
• To reply to an enquiry sent from this website. Arranging the demo you asked for, answering the question you sent with it, and keeping a record of the enquiry and what we decided about it - see section 2. Huquqiy asos: [legalBasis]
• To keep accounts secure and to investigate misuse. Including sign-in throttling, the limit on how many enquiries can be sent from one network address, session records and the error reporting described in section 2. Huquqiy asos: [legalBasis]
• To meet accounting and other legal obligations. Retaining what the law requires us or the business to retain. Huquqiy asos: [legalBasis]

4. Automated processing by the AI assistant

When a business enables it, an AI assistant reads incoming messages and composes replies. To do this, the text of the message, the recent conversation, and the relevant material from the business's own records are sent to a model provider. The business chooses which model, and a business may switch the assistant off entirely.

What the assistant can do

Beyond replying, the assistant can create and change records inside the business's own workspace. Each of these is switched on or off individually for each business by us, at the business's request, and an action tied to a module is offered only to a business that uses that module:

• Open a request for the team to handle
• Schedule a follow-up
• Hold an appointment slot. It is held as pending and a member of staff has to confirm it.
• Open a deal, and move an existing deal one stage forward
• Flag the conversation to staff
• Save a phone number the customer has given
• For a hotel, hold a room for the customer's dates. It is held as tentative, a member of staff has to confirm it, and it lapses if nobody does.

What it cannot do

• It cannot mark a deal won or lost. Only a person does that.
• It cannot set or agree a price, a discount or an amount. It quotes only figures the business itself has recorded, and no tool it has accepts a price.
• It cannot confirm a booking, only request one.
• It cannot delete anything, change a customer's tier, or send anything outside the conversation it is in.

Asking for a contact number

Where the business has switched it on, the assistant may ask a customer for a phone number on its own initiative, once per conversation, after a number of messages the business sets. It asks; it does not require. If the customer gives one it is stored on their record and used by that business to contact them. If a number is already on file the assistant does not ask, and it is not read back to whoever is typing.

Handing over to a person

The assistant hands the conversation to a person when it cannot answer, when the business's rules say a person should take over - for example when a customer sounds unhappy, asks for a person, or has written several times without a reply - or when it runs into an error. The customer is told in the conversation when this happens.

Decisions with legal effect

The assistant does not make decisions producing legal effects or similarly significant effects. The scoring described in section 2 ranks customers for the attention of the business's staff; it does not decide whether anyone is offered a service, on what terms, or at what price, and a member of staff can override a score by hand. Whether a business acts on a score, and how, is that business's own decision and outside our control.

Messages sent to a model provider are not used by us to train models, and we select providers that state the same for data sent through their API.

5. Who the data is shared with

We do not sell personal data and we do not share it for advertising. It is processed by the following service providers, each only to the extent the service requires:

• Hosting and file storage Amazon Web Services, in [hostingRegions], for the application and for uploaded files, images, voice notes and call recordings
• Database MongoDB Atlas for the records themselves, and Qdrant as the search index the assistant retrieves from
• AI model providers OpenRouter, which routes a request to the model the business has chosen, for composing replies and for the language detection that decides which language a customer is answered in; and Voyage AI for the search embeddings that decide which of the business's own material is relevant
• Messaging and delivery The channel a business has connected - Meta for WhatsApp and Instagram, and Telegram - together with an SMS provider where SMS is used and Mailgun for transactional email
• Push notifications Expo, which delivers notifications for the staff mobile app through Apple Push Notification service and Google Firebase Cloud Messaging
• Error reporting Sentry, for the crash reports described in section 2

This list is a description of what the platform uses today. If a business connects an additional integration from within the product, that provider receives whatever that integration requires.

Data may also be disclosed where the law requires it, or to establish or defend a legal claim.

6. Keeping and deleting data

How long records are kept

Records are kept for as long as the business's account is active. There is no automatic expiry on conversations, customer records, calls or the files attached to them: nothing deletes them on a timer, and they remain until the business deletes them or the account is closed. Four kinds of short-lived record do expire on their own - sign-in sessions, verification codes sent to confirm an email address or phone number, the counters used to throttle repeated sign-in attempts, and the logs of what the assistant retrieved to answer a question.

What happens when a customer is deleted

When a business deletes one of its customers in the product, that is immediate and permanent. The customer record is destroyed, and with it their conversations and messages, deals, follow-ups, bookings, invoices and payment receipts, calls, requests, notes, files and the record of any campaigns they were sent. Files, images, voice notes, call recordings and the copied profile photo are deleted from our file storage in the same operation. This cannot be undone. Property units and vehicles the customer had bought or reserved are not deleted - they are the business's own stock, and are returned to it as available.

What happens when a workspace is deleted

Deleting a whole business account behaves differently, and it is worth being plain about it. The business and its main records are marked as deleted and disappear from the product, but they are not immediately destroyed, so that an accidental deletion can be reversed. Some records associated with the workspace are not covered by that step at all and remain stored until they are removed separately. If you want a workspace and everything in it permanently erased rather than deactivated, say so in the request and we will carry it out and confirm when it is done.

What happens to an enquiry from this website

A demo request is kept while we are dealing with it and for as long as it is useful as a record of who asked and what we said - it does not expire on a timer. Deleting it destroys the request, the contact detail in it, your message and the note and decision attached to it, and it cannot be undone. Ask by writing to support@ailin.uz from the address you gave us, or naming the phone number you gave; you do not need an account and you do not have to give a reason. You may also ask us not to contact you again while keeping the record itself, if you would rather we simply did not write back.

How to request deletion

If you are a customer of a business using Ailin SaaS: ask that business to delete your data, since they decide what is held about you. You can also write to us at support@ailin.uz with the phone number, email address or messaging account you used to contact them, and we will pass the request on and act on it.

If you are a business using Ailin SaaS: write to us from the account's registered email address stating what you want deleted - a specific record, a connected channel, or the whole workspace. Disconnecting a channel in the product removes the stored access token for it immediately.

If you are a member of staff with an account: ask for your own account to be deleted in the mobile app, under Menu → Settings → Delete account or Menu → your name card → My profile → Delete account, or by writing to support@ailin.uz from the address you sign in with. Every sign-in session is ended as soon as the request is made, and the deletion is completed within 30 days. Completing it replaces your name with "Deleted user" and removes your email address, phone number, profile photo and password, your sessions, the devices registered for your notifications and the notifications addressed to you; where a business record names you as the person who wrote, uploaded or changed something, that name becomes "Deleted user" too. The account record itself is kept, emptied of those details, so that the business's records that point to it keep working; those records stay with the business. Your name is not searched for in free text: where it was typed into a message, a note or a notification, it stays as written. The steps are also on the "Delete your account" page of this site.

We answer deletion requests within 30 days and will tell you what was removed and what had to be kept, if anything, to meet a legal obligation. Copies in encrypted backups and in logs are not edited; they expire within [backupRetention] of the deletion.

7. Your rights

Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict or object to how it is used, to object to profiling, and to receive it in a portable form. You may also complain to your local data-protection authority.

Which of these rights you have, and the law under which you have them, depends on where you live; [governingLaw] governs this policy. Where we hold data as a business's processor we will forward your request to that business and act on their instruction, and we will tell you that we have done so. Requests reach us at the address in section 10.

For people in the European Union and the United Kingdom, our representative is [euRepresentative].

8. Security and international transfers

Application data is held in [hostingRegions]. Traffic is encrypted in transit, and passwords are stored only as bcrypt hashes and never in a form we can read. Access inside a business's workspace is governed by the roles that business configures, and each workspace's data is separated from every other's: every record carries the workspace it belongs to and every query is filtered by it.

Some of the providers listed in section 5 operate outside the European Union, and a message sent to a model provider or delivered over a messaging platform is processed wherever that provider operates. Where that is the case, transfers are made under the safeguards those providers offer, such as the European Commission's standard contractual clauses.

No system is completely secure. If a breach affects your data we will notify you and the relevant authority where the law requires it.

9. Children

The platform is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16, and there is no age check on the public chat and call pages, because they are a way of contacting a business rather than an account anybody registers for. If you believe a child's data has reached us through a business's conversation history, write to us and it will be removed.

10. Changes and contact

If this policy changes materially we will update the date at the top of this page and notify account holders. Questions, requests and complaints reach us at support@ailin.uz, or by post to [legalEntity], [legalAddress].