Privacy policy

Who we are

SmartChatAI is a trading name of MaitrixAI Pty Ltd (ABN 38 669 653 785, ACN 669 653 785) of 6/93 West Burleigh Road, Burleigh Heads QLD 4220, Australia ("we", "us"). We make an AI chatbot that small businesses put on their website, Facebook Messenger and Instagram to answer their customers' questions and collect enquiries.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our terms of service explain what you agree to when you use SmartChatAI, and our security page explains how we protect your data in plain English.

What this policy covers

This policy covers personal information about:

• Our customers and their team members: the people who sign up for SmartChatAI and use the dashboard.
• Visitors to our website, www.smartchatai.io, including people who chat with our own chatbot.
• Our partners: people in our affiliate program.
• Our customers' customers: the people who chat with a chatbot a business has made with SmartChatAI. We handle their information for that business, as explained in Your customers' information. The business's own privacy policy also applies to them.

What we collect

If you have a SmartChatAI account

• Account details: your name, email address, business name, your team members' names and emails, and your password (stored hashed, never as plain text). If you sign in with Google, we receive your name, email address and basic profile details from Google.
• Billing details: your plan, invoices, billing address and payment history. Payments are handled by Stripe; your card details never reach our servers. We can see limited details in Stripe, such as the card type and last four digits.
• Your content: whatever you give your chatbot to learn from, such as your website pages, files, text, Q&A and Notion pages, and your chatbot's settings.
• Connected accounts: if you connect Facebook, Instagram, Google Calendar, Microsoft Outlook, HubSpot, Slack, Notion, Zapier or n8n, the access tokens and account details needed to make the connection work.
• Support and feedback: what you tell us when you email us or reply to a survey.
• How you use SmartChatAI: for example, sign-in times, the features you use, the number of answers your chatbot sends, and technical details such as your browser and IP address.

If you visit our website or chat with our chatbot

• Pages you visit, how you arrived, your browser and device, and your approximate location from your IP address, collected through cookies and similar tools (see Cookies and analytics).
• What you write to our chatbot, and the name, email address, phone number and preferred contact method if you leave them.

If you join our affiliate program

• Your name, email address, the referral links you share and the clicks, sign-ups and commissions linked to them, collected through FirstPromoter, our affiliate platform.
• The details needed to pay you, which you give to Stripe when you connect a Stripe account.

We don't ask for sensitive information, such as health information, and we ask you not to give it to us. See Your customers' information for what businesses should do if their customers might share it.

How we collect it

We collect most information directly from you: when you sign up, set up your chatbot, connect an account, pay, or contact us. We collect some information automatically through cookies and similar tools on our website and in the dashboard. We receive some information from others: from Google when you sign in with Google, from Stripe about payments, from FirstPromoter about referrals, and from the services you choose to connect.

You don't have to give us personal information, but without it we can't create your account, run your chatbot or reply to you. You can browse our website and ask our chatbot questions without telling us who you are.

How we use it

We use personal information to:

• provide SmartChatAI: create your account, train and run your chatbot, show chats and leads in your Inbox, send leads (and bookings, once appointment booking is available) to you and to the apps you connect, and send the emails the service needs (such as sign-in, trial-ending, billing and lead emails);
• take payments, issue tax invoices and keep financial records;
• set up your chatbot for you, if you've bought our set-up service or you're on the Business plan;
• answer questions, give support and fix problems;
• keep SmartChatAI safe: prevent fraud, spam and misuse, and enforce limits;
• understand how people use our website and the product, and improve them;
• tell you about SmartChatAI, if you've agreed or the law otherwise allows (see Emails and marketing);
• run our affiliate program and pay commissions; and
• meet our legal obligations, such as tax record-keeping, and respond to lawful requests.

We only use personal information for another purpose if you'd reasonably expect it, you agree, or the law allows it.

Decisions made automatically

Some routine decisions in SmartChatAI are made by computer, using account, billing and usage information:

• whether a team can start a free trial, based on whether it has had a trial or paid plan before;
• pausing a chatbot when its answers run out, or 3 days after a payment fails;
• blocking traffic that looks like spam or abuse, using rate limits; and
• once appointment booking is available, which times the chatbot offers, based on the staff member's calendar and working hours.

If you think one of these decisions is wrong, email us and a person will review it.

How the AI uses information

Your chatbot answers questions using OpenAI's models through OpenAI's API, together with a search index of your own content. When someone asks your chatbot a question, we send the conversation and the most relevant parts of your content to OpenAI, so it can write the answer.

• We don't train AI models on your content or your customers' chats.
• OpenAI doesn't use data sent through its API to train its models. It keeps that data for up to 30 days to monitor for abuse.
• Your chatbot answers only from the content you give it, not the whole internet. AI can still make mistakes, so our terms of service ask you to check what your chatbot says.

Your customers' information

When a business puts a SmartChatAI chatbot on its website, Facebook Page or Instagram account, the business decides what the chatbot asks for and what happens to it. We handle the information its customers share on the business's behalf, to provide SmartChatAI to that business. This includes:

• chat messages, and the time and channel of each conversation;
• lead details people choose to leave: name, email address, phone number and preferred contact method;
• booking details, if the business uses appointment booking once it's available: name, email address, phone number if the business asks for it, notes, time zone and the time booked; and
• for Messenger and Instagram, the person's name or username and profile details that Meta shares with the business's connected Page or account.

We use this information only to provide SmartChatAI to that business, to keep the service secure and working, and as the law requires. We don't use it to market to those people, and we don't sell it.

If you're a business using SmartChatAI, you're responsible for telling your customers about your chatbot and how you use their information, including in your own privacy policy, and for having a lawful basis for anything you ask them for. If your customers might share health or other sensitive details (for example, at a clinic), add a line to your chatbot's welcome message asking them not to, and make sure you're allowed to collect anything sensitive you do ask for.

If you've chatted with a business's chatbot and want to see, correct or delete your information, please contact that business first. If you contact us, we'll pass your request to the business and help it respond.

Calendar connections and Google data

Appointment booking is coming soon. When it's available, a team member can connect a Google or Microsoft Outlook calendar so customers can book appointments through the chatbot. If they do:

• Google Calendar: we ask for permission to see when you're busy (free/busy) and to create, change and cancel events, plus your email address so we know which account is connected.
• Microsoft Outlook: we ask for permission to read and write your calendars, plus your email address.

We use this access only to check when you're available, so the chatbot offers free times, and to add, change or cancel the bookings made through SmartChatAI. We don't store the details of your other events, use them for anything else, or share them. Calendar access tokens are stored encrypted.

You can disconnect a calendar at any time in SmartChatAI. When you disconnect Google Calendar, we revoke our access with Google and delete the tokens; when you disconnect Outlook, we delete the tokens. You can also remove access in your Google or Microsoft account settings.

SmartChatAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes, such as Google Calendar, will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular, we don't use Google, Microsoft or Meta data to train AI models or for advertising, we don't sell it, and our team only looks at it to support you, when you ask us to.

Facebook and Instagram

If you connect a Facebook Page or Instagram professional account, we use the access Meta gives us to receive messages sent to that Page or account and to send your chatbot's replies. The conversations appear in your Inbox. Access tokens are stored encrypted. We use this information only to provide SmartChatAI to the business that connected the Page or account, and keep each business's information separate.

How to delete your Facebook and Instagram data

1. In SmartChatAI, disconnect Facebook and Instagram in your chatbot's integrations.
2. In Facebook, go to Settings & privacy → Settings → Business integrations (or Apps and websites), find SmartChatAI and remove it.
3. Email hello@smartchatai.io from your account's email address and ask us to delete your Facebook and Instagram data. We'll delete the connection details and the conversations from that Page or account, and confirm by email.

If you messaged a business's Facebook Page or Instagram account and want your messages deleted, contact that business first. You can also email us with the name of the Page or account, and we'll pass your request on and help.

Who we share it with

We share personal information only with the service providers that help us run SmartChatAI, with the apps you choose to connect, and where the law requires. Our main providers are:

If you connect HubSpot, Zapier, n8n or a webhook, we send new leads to it as they arrive. If you connect Slack, your chatbot answers messages there. If you connect Notion, we read the pages you choose so your chatbot can learn from them. Those services' own terms and privacy policies apply to what they do with the information.

We may also share information with our professional advisers, with a buyer if we sell our business (they'd have to handle it as this policy says), and with courts, regulators or law enforcement where the law requires or allows it.

Information stored outside Australia

Most of the information we hold, including your content, chats and leads, is stored in the United States, and some of our providers handle information in the other countries listed above. We choose established providers and take reasonable steps, through their terms and our settings, to make sure they protect personal information in a way that is consistent with the Australian Privacy Principles.

Cookies and analytics

Cookies are small files a website stores in your browser. Our website and dashboard use cookies and similar tools:

• To make things work: keeping you signed in, remembering your settings, and running our chat widget.
• To understand our website: Google Analytics (through Google Tag Manager) and HubSpot show us which pages people visit and how they found us.
• For our advertising: the Meta Pixel helps us measure our ads on Facebook and Instagram and show them to people who've visited our website.
• For our affiliate program: when you arrive through a partner's referral link, FirstPromoter stores a cookie for up to 90 days so the right partner is credited if you sign up.

You can block or delete cookies in your browser settings, but parts of the website or dashboard may then stop working. You can also opt out of Google Analytics with Google's opt-out browser add-on, and change your ad settings in your Facebook and Instagram account.

Emails and marketing

We send emails the service needs, such as email verification, trial reminders, invoices and billing messages, lead notifications and important changes to the service. These aren't marketing, and you'll get them while you have an account.

We also send emails about getting the most from SmartChatAI and about new features and offers. We only send these if you've agreed or the Spam Act 2003 (Cth) otherwise allows it, every one says who it's from, and every one has an unsubscribe link that works. You can unsubscribe at any time, and we'll stop within 5 business days.

How we protect it

• Our website, the dashboard and the chat all use HTTPS, so information is encrypted on its way between your browser and our servers.
• Our database is encrypted at rest. It's backed up automatically every day, and backups are kept for 7 days.
• Passwords are stored hashed. Access tokens for Facebook, Instagram, HubSpot, Slack and Notion are stored encrypted.
• Only the SmartChatAI team can see your account, and only to support you.
• You can limit your chatbot to your own websites in Settings → Domains, and each chatbot has rate limits.

No system is completely secure. Please use a strong password that you don't use anywhere else, and tell us straight away at hello@smartchatai.io if you think someone has accessed your account.

How long we keep it

• Your content, chats and leads: while your account is open, so they're in your Inbox when you need them. Nothing is deleted on a timer.
• Billing and tax records: for as long as Australian tax law requires, usually 5 years.
• Website analytics: for the periods set in Google Analytics and HubSpot.
• Marketing contacts: until you unsubscribe or ask us to delete your details, after which we keep only what we need to stop emailing you.

When we no longer need personal information for any purpose the law allows, we delete it or remove anything that identifies you.

Deleting your information

To delete your account or any of your data, including your customers' chats and leads, email hello@smartchatai.io from your account's email address. We'll confirm what will be deleted, delete it within 30 days, and tell you when it's done. Deleted information drops out of our backups within 7 days after that. We may keep what the law requires us to keep, such as tax invoices.

Deleting a chatbot in the dashboard doesn't by itself erase its data, so please email us if you want that data deleted.

Seeing and correcting your information

You can see and update most of your account details in the dashboard. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing hello@smartchatai.io. We'll need to check who you are first. We'll respond within 30 days and won't charge you for asking. If we can't do what you ask, we'll tell you why and how to complain.

Data breaches

If personal information we hold is lost or accessed without permission, we'll act quickly to contain it and work out what happened. If it's likely to cause serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. If it affects information we handle for a business, we'll tell that business straight away and work with it on who notifies the people affected and the OAIC.

Children

SmartChatAI is for businesses, and account holders must be 18 or older. It isn't designed for websites or services directed at children, and our terms ask businesses to tell us before using it on one. We don't knowingly collect personal information from children for our own purposes. If you think a child has given us personal information, please contact us and we'll delete it.

If you live outside Australia

We're an Australian business and handle personal information as this policy describes, wherever you are. The laws where you live may give you other rights. Contact us and we'll help.

Changes to this policy

We'll update this policy when our practices or the law change, and show the date it took effect at the top. If we make an important change, we'll email our customers at least 30 days before it applies, unless the law requires it sooner.

Contact us and complaints

For questions, requests or complaints about privacy, contact our Privacy Officer:

Privacy Officer, MaitrixAI Pty Ltd (trading as SmartChatAI)
6/93 West Burleigh Road, Burleigh Heads QLD 4220, Australia
Email: hello@smartchatai.io

Please tell us what your complaint is about and how to reach you. We'll acknowledge it within 5 business days and aim to resolve it within 30 days. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.