How HiAgent handles account, workspace, website widget, lead, and source data.
01Who we are
HiAgent is operated as an individual activity (individuali veikla) registered in Lithuania. HiAgent is the data controller for account, billing, and public website data.
For data that customers collect from their own website visitors through the widget, the customer is the controller and HiAgent is the processor. The Data Processing Agreement at hiagent.lt/dpa covers that processing.
Contact for privacy requests: [email protected].
02Information we collect
Account details such as name, email, company name, website, selected plan, authentication provider, and login/session metadata.
Workspace configuration such as widget settings, uploaded or connected knowledge sources, source summaries, activity logs, and plan status.
Customer website widget data such as visitor questions, optional visitor email addresses, conversation history, lead records, missed questions, confidence metadata, page URLs, and timestamps.
Technical data such as IP-derived request metadata, browser/device information, security logs, rate-limit events, and cookies needed for login, Google OAuth state, CSRF protection, and fraud prevention.
03How we use information
Provide the HiAgent dashboard, AI support widget, source-based answers, lead capture, missed-question review, and human handoff workflows.
Authenticate users, preserve selected plan and billing intent, protect sessions, prevent abuse, diagnose production issues, and maintain service security.
Process uploaded or connected sources so the widget can answer from the business knowledge the account owner chooses to connect.
Improve reliability, debug failed requests, comply with legal obligations, and respond to account, support, privacy, or security requests.
04Legal bases
Contract (GDPR Art. 6(1)(b)): account data, workspace data, and billing data needed to provide the service you signed up for.
Legitimate interests (Art. 6(1)(f)): security logs, abuse prevention, rate limits, and service diagnostics.
Consent (Art. 6(1)(a)): optional analytics and marketing cookies, and product update emails. You can withdraw consent at any time.
Legal obligation (Art. 6(1)(c)): accounting and tax records.
05AI providers and third parties
HiAgent may send a visitor question and relevant source excerpts to a server-side AI model provider when an account enables AI answers. Model credentials stay server-side.
Google OAuth is used only when a user chooses to continue with Google. Google may process the OAuth request under Google's own terms and privacy policy.
Google Analytics may process page and device interaction data so HiAgent can understand website traffic and improve the public website and signup funnel.
HiAgent uses a consent banner to store cookie choices and communicate Google Consent Mode signals to Google tags.
HiAgent uses these subprocessors: Hostinger (hosting, database, and email), Cloudflare (network and security), OpenRouter and the AI model provider it routes to, such as OpenAI (AI answers), Stripe (payments), and Google (sign-in, analytics, and service monitoring).
Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
HiAgent does not load Meta Pixel or other advertising pixels on public pages.
07Retention and deletion
Account, workspace, source, conversation, lead, and missed-question data is kept while the account remains active or while needed to provide the service.
Security logs and backup records may be retained for a limited period to prevent abuse, investigate incidents, comply with legal obligations, and restore service integrity.
Account owners can request deletion or export of their workspace data. Some records may remain where retention is legally required or technically necessary for backups and security.
08Customer responsibilities
Customers who install the widget on their own websites are responsible for telling their visitors that the widget may collect questions, email addresses, page URLs, and conversation content.
Customers should avoid uploading sensitive personal data, payment card data, health data, government IDs, or regulated information unless they have a lawful basis and written approval for that use.
Customers are responsible for reviewing AI answers, configuring sources accurately, and providing any visitor notices required by their own privacy obligations.
09Your rights and choices
Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data.
You can stop using the service, remove connected sources, disable lead capture, or request account deletion.
To make a privacy request, write to [email protected] from the email address associated with the account. We reply within one month, as GDPR requires.
You have the right to complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the data protection authority in your country.
Contact
For privacy requests, account deletion, or questions about this policy, write to [email protected].