Privacy Policy

Executive AI Studio (“we”, “us”) operates EAS Chatbot Engine, a platform that lets a business run an AI assistant that answers customers on its website, WhatsApp, Messenger, Instagram, and email. This policy describes what we collect and why, for both the businesses that run an assistant (“operators”) and the people who talk to one (“visitors”).

What we collect

Conversation content. When a visitor messages an assistant — on the website widget, WhatsApp, Messenger, Instagram, or email — we store the message text, the assistant's reply, and basic metadata (channel, timestamp, token/cost accounting). On the website widget, the page URL and page title the visitor was on are sent along with their question, so the assistant can answer about the right product or page; nothing else about their browsing is collected.

Channel identifiers. A WhatsApp/Messenger/Instagram message carries the sender's platform-assigned id (e.g. a WhatsApp number) so a reply can be sent back. An email reply carries the sender's email address for the same reason.

Business content an operator adds. Knowledge base entries, uploaded files and images, product/service listings, booking and appointment records, and channel credentials (a WhatsApp/Messenger/Instagram access token, a mailbox password) an operator connects so their assistant can answer and act on their behalf. Channel credentials are encrypted before storage and are never shown back to anyone, including the operator who entered them.

Account information. Name and email address for anyone who signs in to the dashboard, and which workspace(s)/assistant(s) they administer.

How we use it

• To generate and deliver an assistant's replies, on whichever channel a message arrived on.
• To let an operator review, search and edit their own assistant's knowledge, conversations and bookings.
• To detect and flag questions an assistant could not answer, so an operator can add the missing knowledge.
• To compute usage and cost, for billing and for keeping the service running reliably.
• To secure the platform — verifying a channel credential actually works before it is stored, and auditing who changed what.

We do not sell any of this data, and we do not use it for advertising.

Who else sees it

Processing a message means it passes through a small number of named third-party providers, each doing one specific job:

• Anthropic (Claude) — generates the assistant's replies from the conversation and the operator's knowledge base.
• Google (Gemini) — converts knowledge base content into a searchable form (embeddings); Google Calendar, only for an operator who explicitly connects it, to record a confirmed booking.
• Meta — delivers and receives WhatsApp, Messenger and Instagram messages.
• Resend — sends transactional email (replies on the email channel, account invitations).
• Supabase — hosts our database, file storage and sign-in. Every table enforces which customer can read which row at the database level, not only in application code.
• Railway and Vercel — host the application itself.

None of these providers may use the data for their own purposes beyond providing the service to us.

Google user data

An operator can connect a Google account to their workspace from the Connectors page. We only ever access a Google account its owner has connected, only for the feature they switched on, and only with the permission listed here:

• Gmail (send only) — sends the emails the operator's assistant is set up to send, such as a booking confirmation. We cannot read, search or delete the mailbox. We read the account's email address only to show which account is connected.
• Google Calendar — adds, updates and cancels events for bookings the operator's assistant has confirmed, on the calendar the operator chose.
• Google Sheets — reads and writes the one spreadsheet the operator chose, so their assistant can look up and record rows in it.
• Google Drive (files the operator picks) — reads only the files the operator selects in Google's own file picker, so their assistant can answer from them. We cannot see any other file in the Drive.

What we keep: an encrypted token that lets us act for the connected account, and the content the operator asked us to use (for example the text of a picked file, kept as part of their assistant's knowledge). To answer customers, that content passes through the providers listed above (Anthropic to write replies, Google Gemini to make it searchable) only to provide this feature to the operator.

We never sell Google user data, never use it for advertising, never use it to train or improve general artificial-intelligence or machine-learning models, and no person at Executive AI Studio reads it unless the operator asks us to for support, or the law or the platform's security requires it.

Disconnecting the account on the Connectors page deletes the stored token and stops all access straight away; access can also be removed at any time at myaccount.google.com/permissions. Content already added to an assistant's knowledge stays until the operator deletes it, or asks us to (see Data Deletion).

Executive AI Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

Conversation history and account data are kept for as long as an operator's workspace is active, so an assistant's answers stay consistent and an operator can review their own history. An operator can delete individual knowledge entries, products, or a whole assistant at any time from the dashboard. See Data Deletion for how a visitor or an operator can ask us to delete their data outright.

Security

Every database table enforces row-level access control, so one business's data is not reachable through another's session even if application code has a bug. Channel credentials (WhatsApp/Messenger/Instagram tokens, mailbox passwords) are encrypted at rest and only ever decrypted server-side, at the moment a message is sent. Traffic to and from the platform is encrypted in transit (HTTPS).

Your rights and choices

You can ask us what data we hold about you, ask us to correct it, or ask us to delete it — see Data Deletion. An operator manages their own workspace's data directly from the dashboard. If you are a visitor who messaged a business through one of these assistants and want your conversation removed, contact us and we will remove it or direct your request to the business you messaged, as appropriate.

Children

This service is intended for business use and is not directed at children.

Changes to this policy

If this policy changes materially, we will update the date at the top of this page. We encourage checking back occasionally if you rely on it.

Contact

Questions about this policy, or a request about your data: anesu@executiveai.studio.