SpideyChat ("SpideyChat", "we", "us", or "our") operates the website spideychat.com and the SpideyChat platform (the "Service"), which lets businesses create AI chatbots, train them on their own content, and embed them on their websites. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.
Who this policy covers
This policy applies to two groups:
- Customers: the businesses and individuals who create an account, build chatbots, and manage them in the SpideyChat dashboard.
- End users: the visitors who chat with a SpideyChat-powered chatbot on a customer's website. When you chat with a bot, the customer that deployed it is the controller of your conversation data; we process it on their behalf.
Information we collect
Account information. When you sign up we collect your email address, a hashed password, and your business or company name. If you sign in with Google, we receive your email address, name, and basic profile information from Google.
Content you provide. The material you use to train a chatbot, including website content you ask us to crawl, documents you upload, and question-and-answer pairs you enter, along with your bot's configuration (name, welcome message, system prompt, colors, and allowed domains).
Conversation data. Messages exchanged between end users and your chatbots, including any information an end user chooses to share in chat (for example, an email address or phone number left as a lead), plus metadata such as timestamps and an anonymous visitor identifier stored in the visitor's browser.
Usage and technical data. Log data such as IP address, browser type, pages viewed, and actions taken in the dashboard. We use this to operate, secure, and improve the Service.
Cookies and analytics. We use necessary cookies to keep you signed in and, on our marketing site, Google Analytics to understand aggregate traffic. See "Cookies and analytics" below.
Payment information. If you subscribe to a paid plan, payment details are handled by our payment processor. We do not store full card numbers on our servers.
How we use information
We use the information we collect to:
- Provide, maintain, and improve the Service, including generating chatbot replies;
- Create and secure your account and authenticate sign-ins;
- Deliver transactional emails (welcome, password reset) and, if you opt in, newsletters and product updates;
- Enforce usage limits, prevent abuse, and monitor for fraud and security issues;
- Respond to your requests and provide support;
- Comply with legal obligations.
AI processing
To generate chatbot answers, the relevant conversation text and retrieved passages from your knowledge base are sent to third-party AI providers (for example, OpenAI) through their APIs. These providers process the data to return a response. We only send what is needed to answer the question. Do not put information into a chatbot's knowledge base, or share it in chat, that you would not want processed by a third-party AI provider.
Cookies and analytics
Our application uses a small number of strictly necessary cookies, most importantly a secure, httpOnly session cookie that keeps you signed in. Our public marketing pages load Google Analytics (gtag.js) to measure aggregate visits; this is disabled inside the embedded chat widget so your website visitors are not tracked by us through the widget. You can block cookies in your browser, though some features may not work as a result.
First-party visitor analytics
On our own marketing site we also keep our own analytics rather than relying solely on a third party. Concretely, we record:
- A visitor cookie ("sc_vid"): a random identifier in a first-party, httpOnly cookie that lasts one year. It carries no personal information; it exists only so the pages one person viewed can be joined into a single visit rather than counted as strangers. Clearing your cookies starts a new one.
- Page views: the page path (with the query string removed), the page title, the referring site, any campaign parameters on the link you followed, approximate country, region and city derived from network headers, and your browser, operating system, device type and screen size.
- How the page was used: how far down each page you scrolled, how long you were actively engaged with it (time while the tab is hidden or idle is excluded), which buttons and links you clicked, which form fields you started and which one you were on if you gave up, and whether you clicked the same spot repeatedly because something did not respond.
- A session recording: a replay of pointer movement, clicks, scrolling and which form field had focus. It does not record the content of the page, and it never records a keystroke or anything you typed into a field. A recording is deleted after 30 days by default.
- Actions and their outcomes: when you use a feature such as the chatbot on our site or the enquiry form, we store what was submitted, a short summary of what was returned, whether it succeeded, and what it cost us to run.
- Errors: the message and stack trace of browser or server errors, so we can fix them. Identical errors are stored once with a counter, not once per occurrence.
- A one-way hash of your IP address, so we can tell two visits from the same network apart without holding the address itself. Your raw IP address is used for rate limiting and abuse prevention at the moment of the request and is never stored in our analytics. The hash and your browser's user-agent string are erased after 90 days; the remaining anonymous rows are deleted after around 13 months.
We ask before we do any of this. On your first visit you are asked whether to allow analytics. Until you answer, and if you decline, we count anonymous page views only: no cookie is read or written, the daily identifier we use cannot be followed from one day to the next, and nothing can be joined into a profile of you. You can change your mind by clearing this site's cookies.
We honour Do Not Track. If your browser sends a "DNT: 1" or Global Privacy Control signal we treat it as an instruction and record nothing at all for your visit, not even the anonymous counts, and with no way for us to override it.
Automated traffic. We classify every visit as coming from a person, a bot, or an unclear source, using the browser's user agent, whether the visit shows any human interaction at all, and the address ranges the large search engines publish. This exists so our numbers describe real people; it has no effect on what you can do on the site.
None of this first-party analytics runs inside the embedded chat widget on a customer's website, and none of it is sold or shared with advertisers.
How we share information
We do not sell your personal information. We share it only:
- With service providers who help us run the Service: AI providers (to generate answers), cloud hosting, our email provider, and our payment processor, under agreements that limit their use of the data;
- With the customer who deployed a chatbot, for conversation data generated by their bot;
- For legal reasons, if required by law or to protect the rights, safety, and security of SpideyChat, our users, or the public;
- In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will notify you of any change in control of your information.
Data retention
We keep account and content data for as long as your account is active. We keep conversation and usage data for as long as needed to provide the Service and for legitimate business or legal purposes. When you delete a bot or your account, we delete or de-identify the associated data within a reasonable period, except where we must retain it to comply with the law.
Security
We protect your data with measures including encrypted connections (HTTPS), hashed passwords, a database that is not exposed to the public internet, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update most account data in your dashboard, or contact us at queries@spideychat.com to make a request. If you are an end user who chatted with a bot, contact the business that operates that bot, or reach out to us and we will help route your request.
Newsletter and marketing emails
If you subscribe to our newsletter or opt into product updates, you can unsubscribe at any time by contacting queries@spideychat.com. Transactional emails (such as password resets) are part of the Service and are not marketing.
International transfers
We and our service providers may process information in countries other than your own. Where required, we take steps to ensure your information receives an adequate level of protection when transferred.
Children's privacy
The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you. Your continued use of the Service after an update means you accept the revised policy.
Contact us
Questions about this policy or your data? Email us at queries@spideychat.com.