Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how Chatbot App Limited collects, uses, retains, and protects the personal data of Aithor users.

1. Data controller

The controller of personal data is:

Chatbot App Limited
Business Registration Number: 79362831
Room 5, 17/F, Strand 50
50 Bonham Strand
Sheung Wan, Hong Kong

Contact email: [email protected]

This Policy applies to the services offered through:

• aithor.io
• app.aithor.io
• dashboard.aithor.io
• Aithor mobile applications, when available.
• Extensions, integrations, and services associated with Aithor.

Chatbot App Limited determines the purposes and essential means of the personal data processing carried out through Aithor.

2. Data we collect

The data we process depend on how you use Aithor and which features you have enabled.

Account data

We may collect:

• Name, alias, or username.
• Email address.
• Credentials and identifiers needed to sign in.
• Preferences, language, and account settings.
• Data received from Google, Apple, or other providers when you use an external sign-in.

We do not store your password in plain text.

Payment information

When you purchase a subscription, paid trial, or credit package, we may process:

• Plan purchased.
• Price, currency, and taxes.
• Status, date, and transaction reference.
• Renewal, cancellation, or refund dates.
• Data needed to issue invoices.
• Limited information about the payment method.

Full card or bank account details are managed directly by Stripe, Apple, Google, or other enabled payment providers. Aithor does not store full card numbers or security codes.

User-provided content

To provide Aithor features we may process:

• Questions, instructions, and prompts.
• Conversations with artificial intelligence systems.
• Texts written, pasted, or edited.
• Documents, PDFs, images, photographs, audio, videos, or links selected by the user.
• Works, projects, folders, templates, and saved documents.
• Responses and content generated by artificial intelligence models.
• Ratings, corrections, and comments on the results.

The user should avoid entering personal, confidential, or specially sensitive data that are not necessary. When providing information about third parties, the user must have a legitimate basis or sufficient authorization to do so.

Technical and usage data

We may automatically collect:

• IP address and approximate location derived from it.
• Browser, operating system, and device type.
• Language, time zone, and regional settings.
• Dates, duration, and frequency of sessions.
• Features, pages, and buttons used.
• Error, activity, security, and sign-in logs.
• Credit consumption, documents, queries, or limits.
• Information needed to detect fraud, abuse, bots, or unauthorized access.

When mobile applications are used, we may also process the application version, technical identifiers, purchase status, and granted permissions.

Aithor will only access files, photographs, camera, microphone, or notifications when the user activates a feature that requires it and grants the corresponding permission.

3. How we use the data

We use personal data to:

• Create, authenticate, and administer the account.
• Provide writing, research, and assistance tools powered by artificial intelligence.
• Process prompts, conversations, documents, and files.
• Generate, save, and deliver the requested results.
• Synchronize the account and content across devices.
• Manage subscriptions, credits, payments, renewals, and refunds.
• Send confirmations, invoices, and communications related to the service.
• Handle support inquiries and requests.
• Maintain security and prevent fraud, abuse, or unauthorized access.
• Detect errors and improve Aithor’s operation and experience.
• Comply with legal, tax, accounting, and regulatory obligations.
• Send promotions or commercial communications when consent or another valid legal basis exists.

Data will not be used for purposes incompatible with those described without first informing the user and, where necessary, requesting consent.

4. Legal bases

Where the European Union General Data Protection Regulation applies, processing will rely on one or more of the following bases:

Performance of the contract

To create the account, provide the requested features, process content, manage subscriptions, and provide support.

Consent

For commercial communications, non-essential cookies, certain analytics tools, promotional notifications, or optional features that require authorization.

Consent may be withdrawn at any time.

Legitimate interest

To protect Aithor, prevent fraud and abuse, maintain reasonable security records, diagnose errors, and defend our rights, provided these interests do not override the user’s rights.

Legal obligation

To comply with tax, accounting, consumer, security, fraud prevention requirements, or valid requests from authorities.

5. Processing through artificial intelligence

To generate the requested responses, Aithor may transmit the necessary prompts, documents, files, or fragments to external providers of artificial intelligence models.

Only the information reasonably necessary to perform the requested function will be sent.

The user’s identifiable content will not be used to train models for a purpose other than providing, securing, evaluating, or personalizing Aithor without first informing the user and having a valid legal basis.

Results produced by artificial intelligence may contain errors. The user should review them before using them for academic, professional, legal, medical, financial, or other significant decisions.

6. Providers and recipients

Chatbot App Limited does not sell or rent users’ personal data.

We may share information with providers we need to operate Aithor, including:

• Infrastructure, storage, and authentication services, such as Google Firebase.
• Artificial intelligence providers, such as OpenAI, Google, Anthropic, DeepSeek, or Mistral.
• Payment providers, such as Stripe, Apple App Store, Google Play, or PayPal, when enabled.
• Email and communications services, such as Mailgun.
• Security, diagnostics, analytics, and user experience services.
• Legal, tax, accounting, or technical advisors when necessary.
• Public authorities when a legal obligation or valid request exists.

Each provider will receive only the data needed to provide its service.

The list of providers may change when technologies are added, replaced, or removed. When a change materially affects the user’s rights, the corresponding information will be provided.

7. International transfers

Chatbot App Limited is incorporated in Hong Kong and uses providers that may process data from Hong Kong, the United States, the European Economic Area, and other countries.

When European law applies and data are transferred to a country without an adequacy decision, legally recognized mechanisms will be used, such as standard contractual clauses, contractual safeguards, and additional technical or organizational measures when necessary.

The user may request more information about these safeguards by writing to [email protected].

8. Data retention

Data will be retained only for as long as necessary for the purposes described.

In particular:

• Account data will be retained while the account remains active.
• Conversations, documents, and projects will be retained while the user keeps them in the account or until deletion is requested.
• Payment and billing records will be retained for the periods required by applicable law.
• Security logs may be retained for a limited period to prevent fraud, investigate incidents, or defend claims.
• Data used for commercial communications will be retained until the user withdraws consent or objects.
• Backups may temporarily retain deleted information until their technical replacement cycles are completed.

Canceling a subscription does not automatically delete the account or stored content.

When the user requests account deletion, data will be deleted or anonymized within a reasonable period, unless they must be temporarily retained to comply with a legal obligation, manage a payment, resolve a claim, or investigate a security incident.

Irreversibly anonymized data are no longer considered personal data.

9. User rights

Depending on applicable law, the user may request:

• Access to their personal data.
• Correction of inaccurate data.
• Deletion of their data.
• Restriction of processing.
• Objection to certain processing.
• Data portability.
• Withdrawal of consent.
• Information about international transfers.
• Review of automated decisions when they produce legal or similarly significant effects.

To exercise these rights, the user may write to:

[email protected]

The request should state the email associated with the account, the right to be exercised, and a sufficiently clear description of the request.

We may request additional information when needed to verify the requester’s identity and prevent unauthorized access or deletion.

The request will be handled within the time limits established by applicable law.

Users subject to the GDPR may lodge a complaint with the data protection authority of their habitual residence, place of work, or place of the alleged infringement.

Where Hong Kong law applies, they may also contact the Office of the Privacy Commissioner for Personal Data of Hong Kong.

10. Cookies and similar technologies

Aithor uses cookies, local storage, technical identifiers, and similar technologies to:

• Keep the session signed in.
• Protect the account.
• Remember preferences.
• Process payments.
• Analyze service performance.
• Measure campaigns or personalize the experience when the user has authorized it.

Strictly necessary technologies may be used without consent when they are essential to provide the requested service.

Non-essential analytics, advertising, or personalization cookies will remain disabled until the user grants consent when required by law.

The user may accept, reject, or configure these technologies through the cookie panel.

Detailed information is available in the Aithor Cookie Policy.

11. Minors

Aithor is not directed at minors who do not have the legal age needed to contract or consent themselves to the processing of their data.

Where applicable law requires authorization from a parent or guardian, the minor may only use Aithor with such authorization.

If we discover that we have collected data of a minor in breach of these requirements, we will take reasonable steps to delete them.

12. Security

We apply reasonable technical and organizational measures to protect personal data, including:

• Encryption of communications.
• Access controls and authentication.
• Restriction of permissions.
• Security logs and monitoring.
• Backups and recovery mechanisms.
• Measures to detect unauthorized access, fraud, and abuse.

No computer system can guarantee absolute security. The user must also protect their credentials, use strong passwords, and avoid sharing access codes.

13. Changes to this Policy

This Policy may be updated to reflect legal, technical, corporate, or feature- and provider-related changes to Aithor.

The current version will be available at aithor.io and will indicate the date of its last update.

When a change materially affects users’ rights or the processing of their data, reasonable notice will be provided by email, within the platform, or through another appropriate channel.

When new processing requires consent, it will be requested separately and expressly.

14. Contact

For inquiries, complaints, or requests related to this Policy:

Chatbot App Limited
Business Registration Number: 79362831
Room 5, 17/F, Strand 50
50 Bonham Strand
Sheung Wan, Hong Kong

Email: [email protected]