Privacy Policy

1. Who we are

aichat.mn is developed and operated by NueraTech LLC, a company registered in Mongolia. Send privacy questions and requests to hello@aichat.mn.

2. Our role

For your organization’s account and team member information, we are the controller. For your customers’ messages, comments, emails, phone calls and web chats we process data on behalf of your organization and on its instructions — your organization is the controller and we are the processor.

Organizations are responsible for telling their customers that their information is processed with aichat.mn.

For the personal agent we serve you as an individual user and process your Google data only at your request — other members and admins of your organization cannot access it.

3. Information we process

Account and team

• Organization name and dashboard address (subdomain)
• Team members’ names, email addresses, phone numbers (optional), roles and sign-in history
• A one-way hash of each password — never the password itself; two-factor authentication secrets — encrypted

From Meta platforms (Facebook, Instagram)

• The name, ID and profile picture of the Facebook Pages and Instagram professional accounts you connect
• Page access tokens — encrypted
• Messages and attachments received and sent through Messenger and Instagram
• Comments on Facebook and Instagram posts and the replies to them
• Customers’ public names, profile pictures and the user IDs provided by Meta

We only access the Pages and accounts you select. We never read your personal Facebook friends or private messages. The content calendar only publishes the posts you schedule.

Telegram, Viber, WhatsApp

• The name, ID and access token of the bots and WhatsApp Business numbers you connect — encrypted
• Messages and attachments received and sent through them
• Customers’ names and usernames; phone numbers provided by WhatsApp or shared by the customer

Email channel

• Emails arriving at your forwarding address: sender name and address, recipients, subject, body, attachments and technical headers (Message-ID, In-Reply-To, etc.)
• The replies you send, with your sender name and signature
• Your own SMTP credentials if you configure them — encrypted

X (Twitter)

• The name, username and ID of the X account you connect; access and refresh tokens — encrypted
• Direct messages received and sent; the sender’s name, username and profile picture

Phone calls (AI phone operator)

The caller’s number, call time, duration and status, call transcripts, AI summaries, voicemails and — if enabled — call recordings. See “Phone calls and speech recognition” for details. Your phone provider credentials (Account SID, Auth Token) are stored encrypted.

Voice messages

When voice message transcription is on, customers’ voice messages are sent to a speech recognition service and the transcript is stored with the message.

Personal agent

• The email address and name of the Google account you connect; access and refresh tokens — encrypted
• Gmail messages read at your request (sender, subject, content) and Google Calendar events (title, time, attendees, location)
• Your conversations with the personal agent, proposed and approved actions, tasks, reminders and settings
• The URLs, authorization headers (encrypted), tool lists and tool results of the MCP servers you add

Personal agent data is visible only to you. For Google data, see “Google user data”.

Orders, appointments and deliveries

• Ordered items, amounts and payment status; the customer’s name, phone number and delivery address
• Appointment services, times and deposit status
• QPay invoices for customer payments (amount, status, date). We never receive customers’ bank card or account details.
• If sent for delivery: the delivery company, courier name and phone number, tracking, delivery status and history

Web chat

• Messages written by visitors and, if configured, their name, phone number and email address
• The page the visitor wrote from
• A random visitor token (in the browser’s localStorage)

Knowledge base

The FAQs, text, product lists, files (PDF, DOCX, XLSX, etc.), websites and Google Sheets content you add.

CRM integrations

• HubSpot access tokens (encrypted) and portal; Google Sheets connections (encrypted tokens) and spreadsheet IDs
• The data sent to them — contact names, phone numbers and email addresses; order numbers, items, totals and statuses; appointments — and the links between our records and theirs

Payments

QPay invoice numbers, amounts, statuses and dates. We never receive or store bank card or account details. If you take payments in chat, we store your QPay merchant key encrypted along with your receiving account details.

Notifications, SMS and push

If you connect Telegram notifications: the chat or group ID and name. If you send SMS: the recipient number, text and status. The date a customer opted out of broadcasts. If you use the mobile or desktop apps: the device push token (Expo), platform, device name, app version, language, chosen notification types and last-seen time. Push notifications never include customer message content.

Agencies and marketplace

Agency settings, branding (name, logo, colors, support contacts) and client dashboard domains; marketplace install history; templates submitted by agencies and review notes.

API and webhooks

API key hashes (never the keys themselves), the webhook URLs you register and their delivery history.

Technical information

IP addresses, browser and device information, activity (audit) logs and error logs.

4. How we use information

• Providing the Service: receiving messages and emails, generating AI replies, answering phone calls, the inbox, notifications and reports
• Personal agent: answering your requests, preparing briefings and reminders, performing only the actions you approve
• Sending orders to the delivery company you chose and keeping customers informed of progress
• Security: protecting sign-ins and preventing fraud and unlawful use
• Billing and invoicing
• Support and technical assistance
• Improving the Service — using aggregated statistics that do not identify individuals
• Meeting our legal obligations

We never use your or your customers’ information for advertising and never sell it to third parties. We do not train general-purpose AI models on your data.

5. Google user data

aichat.mn’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Google is optional: users who want the personal agent (Gmail, Google Calendar) or the Google Sheets integration connect their own account.

Scopes we request and why

• openid — Identify your Google account’s email address and name — to show which account is connected
• email — Identify your Google account’s email address and name — to show which account is connected
• profile — Identify your Google account’s email address and name — to show which account is connected
• gmail.modify — Personal agent: read, search and draft replies to email at your request; send only the emails you approve
• calendar.events — Personal agent: view events and free time; create, change or cancel only the meetings you approve
• spreadsheets — Google Sheets integration: write order, contact and appointment rows to the spreadsheet you choose
• drive.file — Google Sheets integration: access only the spreadsheet files created with aichat.mn or that you select

Limited Use

• We use Google user data only to provide or improve user-facing features that are prominent in the app’s interface and that you use: personal agent answers, briefings, reminders, proposed actions and Sheets exports.
• We do not transfer it to others except as necessary to provide these features (for example, sending the relevant part of an email to an AI model provider to answer your question, under terms that prohibit training), to comply with applicable law, to protect security, or as part of a merger or acquisition with prior notice.
• We never use it to serve advertisements — personalized, retargeted or interest-based — and never sell it.
• We never use it to determine creditworthiness or for lending purposes.
• We never use it to develop, improve or train generalized or non-personalized AI or machine learning models; AI providers are used under terms that prohibit training on API data.
• No human reads it unless (1) you give explicit consent for specific messages (for example, a support request), (2) it is necessary for security purposes such as investigating abuse, (3) it is required to comply with applicable law, or (4) it is aggregated and anonymized for internal operations.

Storage and deletion

• Google tokens are encrypted with AES-256-GCM; emails and events are read from Google on demand, at your request.
• Your personal agent conversations (your questions, the agent’s answers and the email or meeting details they mention), proposed actions and tasks are kept in your history and visible only to you. You can delete conversations at any time.
• Disconnecting Google deletes the tokens and revokes access at Google too. You can also revoke access at any time from your Google Account permissions page.

6. Phone calls and speech recognition

When someone calls a number with the AI phone operator enabled:

• We record the caller’s number, call time, duration, status and any transfer number.
• Each turn of the caller’s speech is captured as a short audio clip by your phone provider (Twilio, etc.) and transcribed by Chimege’s speech recognition. The transcript is stored in the inbox as a conversation message.
• The AI’s replies are turned into speech by Chimege and played into the call through short-lived links.
• After the call, the AI writes a summary.
• Recording of full calls is off by default — full recordings exist only if the organization turns recording on. Voicemail recordings and transcripts are kept.
• Recordings are stored in your phone provider account, and we only stream them to authorized team members. Retention and deletion follow that provider account’s settings.

The receiving organization’s duty: tell callers in advance (for example in the greeting) that an AI answers and, if so, that the call is recorded, and obtain consent where the law requires it.

If you called an organization that uses aichat.mn, please contact that organization first about your data.

7. Sharing with delivery companies and agencies

Delivery companies

When a shop sends an order for delivery (or automatic sending is on), we share the following with the delivery company the shop chose: the recipient’s name, phone number and delivery address; items (name, SKU, quantity), order number, total, cash to collect and notes; and the shop’s name, phone number and address. The delivery company may use this only to perform the delivery and acts as an independent controller for that purpose. We receive the courier’s name, phone number, tracking and status back from the company and pass them on to the shop and the customer.

Agencies

If an agency created or manages your organization, the agency’s users sign in as members (super admins) of your organization and can access data like any other admin. An agency sees aggregated numbers across its clients (channels, conversations, AI replies, members, plan). The agency’s brand may appear in your dashboard, widget and emails. To remove an agency’s access, contact hello@aichat.mn.

Services you connect

We send data to the services you connect — HubSpot, Google Sheets, webhooks, the API, MCP servers — as you configure them; you are responsible for their processing.

Other

We never sell data. We disclose it only in response to lawful requests from authorities, or where strictly necessary to protect security or our rights.

8. Legal basis

We process information under Mongolia’s Law on Personal Data Protection (2021) and related laws. Our bases are: performing our service contract, legal obligations, legitimate interests (security) and, where needed, your consent — for example when you connect a Google account or allow push notifications.

9. AI and third-party providers

To generate AI replies we send the customer’s message and relevant knowledge to a large language model (LLM) provider. We may use the following kinds of third-party providers:

• Meta Platforms (Facebook, Instagram, WhatsApp) — channel connections, receiving and sending messages, publishing posts
• Telegram, Viber — the bots you connect and Telegram notifications
• X Corp. — receiving and sending X direct messages
• Google — the Gmail, Google Calendar and Google Sheets you connect
• LLM providers such as OpenAI, Anthropic and Egune — AI replies, the personal agent, call summaries, knowledge search
• Chimege — speech recognition (STT) and speech synthesis (TTS) for voice messages and phone calls
• Phone providers such as Twilio, Telnyx and SignalWire — receiving, transferring and recording calls on your own account
• Inbound email services such as Postmark, Mailgun and SendGrid — receiving forwarded email; outbound email services or your SMTP — verification codes, invitations, notifications and email replies
• Expo (through Apple Push Notification service and Firebase Cloud Messaging) — mobile push notifications
• HubSpot — if you connect it
• QPay — payments to us, and customer payments through your QPay merchant
• SMS providers — broadcasts and appointment reminders
• Hosting and data center providers — storage and backups

The delivery company you choose is an independent recipient (see above). Data is sent to the webhook URLs, API-connected systems and MCP servers you configure on your instructions — you are responsible for their processing.

Some of these providers may process information outside Mongolia. We share information only to provide the Service and under confidentiality protections. We use LLM providers’ APIs under terms that do not use the data for model training.

10. Retention

• We keep Service data while your account is active.
• We delete data within 30 days of an account closure or deletion request; it is purged from backups within the following 30 days.
• Disconnecting a channel deletes the access details of that Page, bot, number, X account or email SMTP.
• Disconnecting Google deletes the tokens and revokes them at Google; personal agent conversations and tasks are kept until you delete them or the account is deleted. Unapproved actions expire after 24 hours.
• Call transcripts and summaries are kept with the conversation; recordings are kept by your phone provider per your settings.
• Removing a device, or Apple or Google invalidating its push token, stops push notifications to it.
• Delivery records are kept with the order.
• Webhook delivery history is kept for 30 days.
• Invoices and payment records are kept for the period required by accounting laws.
• Security logs are kept for up to 12 months.

11. Security

• All connections are encrypted with HTTPS (TLS).
• Page, bot, X and Google tokens, phone provider Auth Tokens, SMTP passwords, MCP server headers and QPay merchant keys are encrypted; API keys are stored only as hashes.
• Every webhook is signed with HMAC-SHA256; phone provider webhooks are verified with their signature (X-Twilio-Signature).
• Each organization’s data is isolated — PostgreSQL row-level security prevents one organization’s data from being shown to another.
• Every outward-facing personal agent action requires the user’s approval.
• Passwords are stored as one-way hashes; two-factor authentication works in the dashboard and the apps.
• Team access is limited by roles and permissions, and important actions are logged.
• Data is backed up regularly.

12. Your rights

You have the right to access, correct and delete your information, restrict processing, withdraw consent and receive a copy of your information. Send requests to hello@aichat.mn and we will respond within 10 business days. If you believe your rights have been violated, you may complain to the competent authority.

You can revoke the Google connection at any time — from the personal agent section or from your Google Account.

If you are a customer of an organization that uses aichat.mn, please contact that organization first — we help it handle your request.

Instructions for deleting Facebook-related data (in Mongolian): Data deletion.

13. Cookies and device storage

This public site uses no advertising or tracking cookies. The organization dashboard uses an essential cookie to keep you signed in (aichat_rt). The web chat widget keeps a visitor token in the browser’s localStorage.

The mobile app keeps its sign-in token in the iOS Keychain or Android Keystore, and the desktop app in the operating system’s encrypted storage.

14. Age limits

The Service is built for businesses and is not intended for people under 16.

15. Changes

If we change this policy we will update the date on this page and notify you of important changes in advance by email or a dashboard notification.

16. Contact

NueraTech LLC · hello@aichat.mn