Privacy Policy

BrainX Inc. (“we”, “us”, or “our”), operating as WebtoChat, is committed to protecting your privacy and being transparent about how we handle data. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it. By using WebtoChat you agree to the practices described here.

1. We Do Not Collect Personally Identifiable Visitor Data

When visitors interact with a WebtoChat widget embedded on a customer website, we do not collect, store, or process any Personally Identifiable Information (PII) about those visitors. This means:

• We do not collect visitor names, email addresses, phone numbers, or physical addresses.
• We do not build visitor profiles or track individuals across websites.
• We do not use cookies or persistent identifiers to follow visitors beyond a single session.
• No visitor data is linked back to a real-world identity.

The only account-level data we collect is from registered WebtoChat clients (business owners who sign up for the Service) — specifically the name, email address, and domain provided during registration. This is used solely to operate and manage your account.

2. We Do Not Sell Your Data

We do not sell, rent, trade, or otherwise transfer any data — from website visitors or registered clients — to third parties for commercial or advertising purposes. Your data and your visitors’ data are not a product. We operate a subscription-based service and have no interest in monetising your information beyond providing the Service you paid for.

3. How We Use Interaction Data

When a visitor submits a query through a WebtoChat widget, that query is processed by our AI backend to generate a response. We may retain anonymised, aggregated interaction data for the following purposes only:

• Service improvement — to identify common query patterns, improve AI response accuracy, and enhance the overall quality of the widget experience.
• Performance monitoring — to detect errors, measure response times, and maintain system reliability.
• Safety & abuse prevention — to identify and block misuse of the Service, including attempts to extract harmful content from the AI.

All interaction data used for these purposes is anonymised before retention. It cannot be used to identify individual visitors.

4. Website Content Indexing

To power the AI widget on your website, WebtoChat indexes content from the domain you register. This indexing is limited strictly to publicly accessible pages on your domain and is used solely to enable the widget to answer queries about your business. We do not share, republish, or repurpose your website content for any other purpose.

5. Data Security

We take data security seriously and implement industry-standard technical and organisational measures to protect the data we hold, including encrypted data transmission (TLS), access controls, and secure cloud infrastructure. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to contact us immediately if you believe your account has been compromised.

6. Third-Party Services

We use a small number of trusted third-party services to operate the platform:

• Resend — used to send transactional emails (signup confirmations, integration details). Only the email address and name of the registered client are shared for this purpose.
• Neon (PostgreSQL)— our serverless database provider, used to store registered client account data. Data is stored in the United States and governed by Neon’s own security and compliance standards.

We do not share data with analytics providers, advertising networks, or data brokers.

7. Data Retention

Registered client account data is retained for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where we are required to retain it by law. Anonymised, aggregated interaction data used for service improvement does not have a fixed retention period as it cannot be traced back to any individual.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate or incomplete data be corrected.
• Deletion — request deletion of your personal data (“right to be forgotten”).
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing of your data in certain circumstances.

To exercise any of these rights, please contact us via our contact form. We will respond within 30 days.

9. Children’s Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect any data from children. If you believe a child has provided us with personal information, please contact us via our contact form and we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post a notice on the Service and update the effective date at the top of this page. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact

If you have any questions or concerns about this Privacy Policy or how we handle your data, please reach out via our contact form.