Legal

Privacy Policy

Last updated: October 26, 2026

Aidanto lets businesses run AI employees that answer their customers on the business’s website chat, Telegram, Instagram, Facebook Messenger, WhatsApp and other messaging channels. Aidanto is operated by CIPHRA SOFTWARE INC., a company incorporated in British Columbia, Canada (“Ciphra”, “we”, “us”). This policy explains what personal information we handle, why we use it, who we share it with and how you can control it.

Who this policy covers

• Website visitors and the waitlist: people who visit aidanto.com or join the early-access waitlist.
• Business users: people who sign in to Aidanto to set up and manage a business, its AI employees and its conversations.
• Customers of businesses: people who send messages to a business that uses Aidanto.

For customer conversations, the business decides which channels to connect and how to use the information. We process that information on the business’s behalf and according to its instructions, as set out in our Data Processing Addendum. If you are a customer of a business, you can also contact that business directly about your information.

Information we collect

• Waitlist: your email address, the time you joined, the language of the page and a record that you agreed to early-access emails.
• Account: your name, email address and sign-in details, your role in a business, and your settings. Sign-in is handled by Google Firebase Authentication; we do not store passwords.
• Business content: information a business enters, such as its name, contacts, services, opening hours, booking settings, knowledge base and documents.
• Conversations: messages and attachments exchanged between a business’s customers, its AI employees and its team, with the time and channel of each message.
• Customer records: information a business keeps about its customers, such as names and contact details customers share, bookings, requests, notes, and a summary of past conversations written by the AI, which the business can view, edit and clear.
• Connected channels: when a business connects Instagram, we receive its Instagram professional account ID and username and an access token that lets us receive and send that account’s direct messages. From people who message that account, we receive their Instagram-scoped user ID, username and messages. When a business connects a Facebook Page, we receive the Page’s ID and name and a Page access token that lets us receive and send the Page’s Messenger messages. From people who message the Page, we receive their Page-scoped user ID and messages. When a business connects WhatsApp, we receive its WhatsApp Business account ID, phone number ID and phone number and an access token that lets us receive and send that number’s messages. From people who message the number, we receive their phone number, WhatsApp profile name and messages. For these Meta channels we also receive the replies the business sends from Meta’s own apps, such as Meta Business Suite, Instagram or WhatsApp Business, so they appear in the business’s inbox. When a business connects Telegram, we receive its bot token and, from people who message the bot, their Telegram user ID, username and messages.
• Billing: Stripe processes payment card details. We receive the plan, subscription status, billing contact and invoice records, not full card numbers.
• Technical information: IP address, browser and device details, request logs and security events, used to run and protect the service.
• Usage analytics: when you visit aidanto.com or use the Aidanto app, Google Analytics records which pages you open (as page templates, without account, business or customer identifiers), the site that referred you, actions such as joining the waitlist, creating an account or a business and connecting a channel, and your device, browser, language and approximate location, which Google derives from your IP address. In the app, an internal account ID lets us count returning users. We never send names, email addresses or conversation content to Google Analytics. Sign-ups, sign-ins and payments are recorded by our servers, so they are counted even if a browser blocks scripts; they follow the same cookie choice, and without consent they carry no identifier.
• Website chat usage statistics: when a business’s website chat is shown or used, we record anonymous events: that the chat was shown or opened, that a conversation started, that a message was sent or answered, or that a visitor asked for a person or left contact details. Each event includes internal IDs of the business and its AI employee, the chat language and the visitor’s country and device type. It contains no visitor identifier, message content, contact details, IP address or page address. Our servers, not the visitor’s browser, send these events to Google Analytics. A business can turn them off in its website chat settings.

Cookies and browser storage

We use the cookies and browser storage needed for sign-in, security, language and the website chat, for example to let a visitor continue a chat conversation on the same device unless the business or the visitor turns this off.

On aidanto.com and in the Aidanto app we also use Google Analytics cookies (_ga and _ga_*, kept for up to 13 months) to measure how our sites are used, and a rw_consent cookie, kept for 6 months, that remembers your choice:

• In the European Economic Area, the United Kingdom, Switzerland and Quebec, analytics cookies are set only after you accept them. Until you choose, or if you decline, Google Analytics receives only cookieless measurements without an identifier, which Google uses to estimate overall traffic.
• Elsewhere, analytics cookies are on unless you turn them off.
• You can change your choice at any time with Cookie settings at the bottom of our pages or in the account menu of the app. Declining removes the analytics cookies.

The website chat that businesses add to their own websites does not set analytics cookies. We do not use advertising cookies, and Google Analytics runs without Google’s advertising features.

How we use information

• To provide the service: receive and deliver messages, generate AI replies, keep bookings and requests, notify business teams and send service emails.
• To generate AI replies and summaries: messages and the relevant business content are sent to AI model providers. We do not use conversation content to train AI models, and the AI model providers we use do not use it to train theirs, as described on our Subprocessors page.
• To understand and improve our websites, the app and the website chat, using the usage analytics and statistics described above.
• To secure the service, prevent abuse, fix problems, handle billing and meet legal obligations.
• To email waitlist members about Aidanto early access only.

We do not sell personal information and do not use it for advertising.

Information from Instagram and other Meta products

We use information received through Meta’s platform only to provide the messaging features a business has turned on: receiving messages sent to its Instagram account, Facebook Page or WhatsApp number, showing them in the business’s inbox and sending replies from its AI employee or team. We do not sell this information, use it for advertising, or share it with anyone other than the service providers listed below who help us process it. When a business disconnects Instagram, Facebook or WhatsApp, we stop receiving and sending that channel’s messages and stop using its access token. To delete information, see Data deletion. Meta’s own processing is covered by Meta’s privacy policy.

Service providers

We share information with service providers only as needed to run Aidanto:

• Cloudflare: hosting, networking, storage of files, logs and backups, and processing by AI models through Cloudflare Workers AI.
• OVHcloud: servers in Canada that host our database.
• Ollama: processing by AI models through Ollama Cloud.
• OpenRouter: processing by AI models when we route a request through it. OpenRouter forwards each request to the model provider selected for it, such as OpenAI, and we ask it to use only providers that do not keep the content of the request or use it for training.
• Google Firebase and Google Cloud: sign-in and waitlist storage.
• Google Analytics: usage analytics for our websites, the app and the website chat.
• Resend: delivery of service emails.
• Stripe: payments and billing, when a business subscribes to a paid plan.
• Meta and Telegram: delivery of messages when a business connects Instagram, Facebook Messenger, WhatsApp or Telegram.

Our Subprocessors page lists these providers with their locations and the information each one handles, and explains how we announce changes to the list.

We may also disclose information when the law requires it, to protect people or the service, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

International transfers

We are based in Canada, and our database is hosted in Canada. Our service providers process information in the United States, the European Union and other countries where they operate, which may have different data protection laws than where you live. The European Commission, the United Kingdom and Switzerland recognise Canada as providing adequate protection for organisations subject to its federal private-sector privacy law, as we are. When information protected by European, UK or Swiss law is processed by a provider in a country without such recognition, we rely on safeguards these laws allow, such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.

How long we keep information

• Waitlist entries: until you ask to leave the list or we no longer need them for early access.
• Account and business data: while the account is active. After an account is closed or deletion is requested, we delete it within 30 days, except records we must keep for legal, tax or dispute reasons.
• Conversations and customer records: as long as the business keeps them. A business can delete a customer’s data at any time from that customer’s record.
• Archived businesses: when a business is deleted from an account, its conversations, customer records and settings are kept for 90 days so we can restore it at the owner’s request, then deleted permanently.
• Usage analytics: Google Analytics keeps event data for 14 months; analytics cookies expire after 13 months.
• Operational logs: 30 days. Backups are replaced on a rolling schedule; deleted information can remain in backups until they expire.

Your choices and rights

Depending on where you live, you may have the right to access, correct or delete your personal information, to withdraw consent, and to object to or limit some uses. To make a request, email contact@ciphra.ca. We will confirm your identity and reply within 30 days. If your request concerns a business’s customer records, we may pass it to that business or ask you to contact it. You can withdraw consent to analytics cookies at any time with Cookie settings. You can also complain to the Office of the Privacy Commissioner of Canada or to the data protection authority where you live.

If you are in the EEA, the UK or Switzerland

Our role. For website visitors, the waitlist and business user accounts, Ciphra is the controller of your personal information. For conversations and customer records, the business is the controller, and Ciphra processes the information on its behalf under our Data Processing Addendum. Questions about how a business uses your information are best sent to that business.

Legal bases. We rely on:

• our contract with business users, to provide their accounts and the service;
• your consent, for early-access emails to the waitlist and for analytics cookies; you can withdraw it at any time;
• our legitimate interests in securing the service, preventing abuse, fixing problems, keeping a record of accepted terms and understanding overall use through cookieless measurements and anonymous website chat statistics;
• legal obligations, such as keeping billing and tax records.

Your rights. In addition to the rights above, you can ask us to restrict the use of your personal information and to give you the information you provided to us in a portable format. Make requests by email as described above. You can complain to the data protection authority where you live or work: in the European Union, the authority of your member state; in the United Kingdom, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.

Security

We encrypt information in transit, store channel access tokens encrypted, and limit access to personal information to people and systems that need it to run the service. No system is perfectly secure, but we work to protect your information and will notify affected people as the law requires if a breach occurs.

Children

Aidanto is a service for businesses and is not directed to children under 16.

Changes to this policy

We may update this policy. We will change the date above and, for significant changes, tell business users by email or in the dashboard.

Contact

CIPHRA SOFTWARE INC., British Columbia, Canada. Email: contact@ciphra.ca.