Privacy Policy

integrable.cloud provides a platform for adding AI assistants to websites. We operate from India, and we serve customers worldwide.

Whether this policy covers your data depends on who you are, and the distinction matters more than it looks:

Questions, requests or complaints: privacy@integrable.cloud. If we have not resolved something, see grievance redressal.

We have no establishment in the European Union or the United Kingdom. Where the GDPR or the UK GDPR requires a non-established controller to designate a representative, that appointment is made in writing and named here.

• Account data. Your name, email address, company name, and a hashed password. If you sign in with Google or Microsoft, we receive your email address, name and profile picture from them instead.
• Content you provide. The pages, documents and text you add to an assistant’s knowledge base, and how you configure it.
• Conversation data. Messages between your assistants and the people who talk to them, and any details those people choose to give — a name, an email address, a phone number.
• Technical data. IP address, user agent, page URL and referrer, used for security, rate limiting and the analytics in your dashboard. We store an anonymous visitor identifier so a conversation survives a page reload.
• Billing data. Your plan, invoices and payment status.

• Operate the service — authenticate you, run your assistants, generate answers, store conversations.
• Send transactional email: activation, password reset, one-time codes, team invitations, and notifications about leads your assistant captures.
• Enforce quotas, rate limits and abuse protection.
• Produce the analytics in your dashboard.
• Bill you, and meet our tax and accounting obligations.
• Send product and marketing email, only if you opted in, with an unsubscribe link in every message.

Where the GDPR or UK GDPR applies:

Under India’s Digital Personal Data Protection Act, 2023 we process account data on the basis of your consent and for the legitimate uses that Act permits, and we give notice of what we collect and why at the point we collect it.

We request Google and Microsoft permissions in three separate, optional contexts. Signing in does not grant calendar or spreadsheet access — each is a distinct consent screen you can decline, and declining only disables that feature.

Revoke our access at any time from your Google account permissions or your Microsoft apps, from inside our dashboard, or by deleting your account. Revoking access disables the feature; it does not delete bookings already made.

We use a small number of subprocessors, each for one purpose. The complete, current list — what each does, where it runs, and whether it is in the path always or only if you connect it — is maintained at subprocessors, and customers are notified before it changes.

The most important one to understand: model providers receive message content. To answer a visitor’s question, the question and the retrieved passages from your knowledge base are sent to a model provider. That is not an incidental transfer — it happens on every answered message, and no configuration avoids it. Which providers, and what they may do with it, is in the AI transparency statement.

Beyond subprocessors we disclose personal data only: to comply with a binding legal obligation, on the terms in our government requests policy; to establish or defend legal claims; or to a successor in a merger or acquisition, in which case we will tell you before your data is transferred.

We operate from India and our infrastructure is largely in the United States. If you are in Europe, your data leaves the EEA.

• Standard Contractual Clauses. India has no adequacy decision. Transfers from the EEA rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914), incorporated into our DPA. UK transfers rely on the UK Addendum to those clauses.
• A transfer impact assessment. We have assessed the laws of the countries we transfer to, including Indian government access powers, and the supplementary measures that mitigate them — principally per-tenant envelope encryption and database row-level security, described at security architecture.
• Encryption. In transit with TLS, at rest with per-tenant keys.

Under India’s DPDP Act, transfers out of India are permitted except to countries the Government restricts by notification. We monitor that list.

Which region your data sits in, and what we can and cannot offer on residency, is at data residency.

Specific periods, not “as long as necessary” — that phrase usually means nobody has decided.

We do not run a two-tier privacy programme. The strongest right in any of these regimes is offered to everyone.

Tenant isolation is enforced in the database with row-level security, content is encrypted at rest with per-tenant keys, and access to production is limited and logged. The detail, without marketing adjectives, is at security architecture. What we are not certified for is stated just as plainly at compliance.

If there is a personal data breach:

• Where we are the controller, we notify the relevant supervisory authority within 72 hours where the GDPR requires it, and the Data Protection Board of India as the DPDP Act requires.
• Where we are your processor, we notify you without undue delay, with what we know, what we are doing, and what we recommend you do — so that you can meet your own deadline.
• We notify affected individuals directly where the risk to them is high.
• We report qualifying incidents to CERT-In within the timescale the Indian directions require.

Our incident process, including what we commit to telling you and when, is at incidents.

The service is for businesses, and it is not directed at children. We do not knowingly collect personal data from a child.

If you believe a child has given us personal data, write to privacy@integrable.cloud and we will delete it.

This website sets none — no analytics, no tag manager, no advertising pixel, which is why you have not seen a consent banner. The dashboard sets a strictly necessary session cookie. The chat widget stores one identifier so a conversation survives a page reload. Full detail, and whose job it is to disclose the widget’s storage on your own site, is in the cookie policy.

This page carries a version number and an effective date at the top. If we make a change that materially affects how we handle your personal data, we will email account holders at least 30 days before it takes effect. Smaller corrections take effect when published.