PRIVACY POLICY

1. Who We Are

VegaMind ("we", "us", "our") is a product of QBS Global. We operate the website thevegamind.com and the VegaMind AI chat widget platform. This privacy policy explains how we collect, use, store, and protect information when you use our website, dashboard, or embeddable chat widget.

2. Information We Collect

Account Information

When you create a VegaMind account, we collect:

• Name and email address
• Company name (optional)
• Website URL (for bot training)
• Authentication data via Google OAuth or email/password

Chat Widget Data

When visitors interact with a VegaMind chat widget on your website, we collect:

• Chat messages (visitor questions and bot responses)
• Session identifiers (anonymous, no login required for visitors)
• Visitor-provided contact information (name, email, phone — only when voluntarily shared in chat)
• Timestamp and session duration

Website Content

VegaMind accesses your website URL to scrape publicly available content. This content is used to train your bot so it can answer visitor questions accurately. We do not access password-protected pages or private areas of your website.

Usage & Analytics

We use Google Analytics (GA4) to collect anonymized usage data about how you interact with our website. This includes page views, session duration, and device type. We do not use this data to identify individuals.

3. How We Use Your Information

• Provide the service: Power your AI chat widget, deliver bot responses, capture leads, and display analytics in your dashboard.
• Improve the product: Analyze aggregate usage patterns to improve widget performance, response quality, and user experience.
• Communicate with you: Send account-related emails, billing notifications, and (with your consent) product updates.
• Security: Detect and prevent abuse, unauthorized access, and fraudulent activity.

4. Data Isolation & Multi-Tenancy

VegaMind is a multi-tenant platform. All customer data is isolated by tenant at the database level using row-level security (RLS) policies. Your data — bots, sessions, messages, leads — is never accessible to other tenants. Admin operations use separate authentication with elevated permissions.

5. Data Sharing

We do not sell your data. We share information only with:

• Supabase: Our database and authentication infrastructure provider (PostgreSQL, hosted in cloud).
• AI providers: Chat messages are processed through AI models to generate bot responses. Messages are sent without personally identifiable visitor information where possible.
• Notification services: If you configure Discord, Telegram, or email notifications, message data is sent to those platforms per your configuration.
• Legal requirements: We may disclose data if required by law or to protect our rights.

6. Data Retention

We retain your data for as long as your account is active. Chat sessions and messages are retained for the lifetime of the associated bot. If you delete your account, we will delete your data within 30 days, except where retention is required by law.

7. Cookies

Our website uses:

• Authentication cookies: To keep you signed in to your dashboard (Supabase Auth).
• Theme preference: A localStorage item (vm-theme) to remember your light/dark mode choice.
• Google Analytics: Standard GA4 cookies for anonymized site analytics.

The embeddable chat widget uses sessionStorage to maintain conversation state within a single browser session. No persistent cookies are set by the widget on your visitors' browsers.

8. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data in your account settings.
• Delete your account and associated data.
• Export your data (chat logs, leads) via CSV export in the dashboard.
• Withdraw consent for marketing communications at any time.

To exercise these rights, email us at [email protected].

9. Security

We implement industry-standard security measures including:

• HTTPS encryption on all pages and API endpoints
• Row-level security (RLS) for tenant data isolation
• JWT-based authentication with token expiry
• Password hashing via Supabase Auth (bcrypt)

10. Children's Privacy

VegaMind is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email. The "last updated" date at the top reflects the most recent revision.

12. Contact Us

If you have questions about this privacy policy or your data, contact us:

• Email: [email protected]
• Company: QBS Global
• Website: thevegamind.com