Security and your data

Where is my data stored?

In a database and private file storage run by Supabase, in its Singapore region (ap-southeast-1). The website and dashboard are served by Vercel. Data travels between your browser, our servers and our providers over encrypted connections (HTTPS).

What we store for a business: your account, your workspace settings, your knowledge (text read from your website, your uploaded documents and the answers you write), your conversations and contacts, and your logo.

How are uploaded documents stored, and who can see them?

You can upload PDF, plain text and Markdown files up to 10MB. The file goes into private storage: it has no public link, and only our server can read it. We read the text out of it, split it into passages and store those, so your agent can answer from them.

• In the dashboard, everyone on your team can see the list of documents. Only owners and admins can upload or delete one; teammates with the Agent role cannot.
• No other business can reach your documents or anything else of yours. Every business's data is walled off at the database level, and the chat widget on your site never talks to the database directly.
• Your visitors never get the file. But your agent answers from its contents, so anything written in a document can be repeated to any visitor who asks. That is what documents are for. Don't upload anything you wouldn't put on your website, such as staff details, internal pricing or customer records.
• Deleting a document removes its text from your agent straight away and deletes the file from storage.

Who can see my conversations and contacts?

You and the teammates you invite. Each teammate has a role: an owner controls billing, the team and deleting the workspace; an admin can do everything else, including changing what the agent knows; an agent can read and answer conversations but cannot change the agent's knowledge. Remove someone from your team and their access ends.

Can Whizchat see my data?

Whizchat is run by a sole trader based in Australia. As the operator, we can technically reach stored data through our hosting providers' tools. We only look at a business's data when that business asks us for help, or when it is needed to keep the service running or secure. We never sell your data, and we share it only with the providers listed in our privacy policy, and only for what each of them does for us.

Is my data used to train AI?

No. Replies are generated by OpenAI through its API: the visitor's message, the passages of your knowledge that fit the question and the recent conversation are sent to it for each reply. OpenAI's API terms state that data sent this way is not used to train its models. We don't train any model on your conversations, documents or website either, and one business's data is never used for another business's agent.

Can the agent say something it shouldn't?

• It answers only from what your business has given it. When it doesn't know, it says so and offers to put the visitor in touch with you, instead of guessing.
• Every reply is checked before it is shown. A phone number, email address or link that isn't one of your business's own is replaced, so it cannot send a visitor somewhere you didn't intend.
• Text on your website is treated as information, never as instructions. If a page contains wording aimed at the AI, such as “ignore your rules”, the agent ignores it.
• You can take over any conversation from the inbox, and the agent steps back.

What do you collect about my website's visitors?

What they type, any contact details they choose to give, their IP address and approximate location (recorded once per conversation), their browser and device, and the pages of your site they visit while the widget is installed. A random ID in their browser's storage keeps their conversation if they come back. The widget sets no advertising or tracking cookies and cannot see any other website. Section 2 of the privacy policy has the full list, written for visitors.

Visitors can attach photos and PDFs (up to 5MB each, 10 per conversation). They are stored privately and only your team can open them. Photos are re-saved from their pixels, which strips hidden metadata such as GPS location, and PDFs are checked for embedded scripts and always open as a download. The AI never reads an attachment; it tells the visitor your team will see it.

How do I control where the widget runs, and who a visitor is?

• Allowed domains: list your own domains in Settings, Installation, and the widget refuses to load anywhere else.
• Verified visitors: if your visitors log in to your site or app, your server can sign who they are. A verified visitor's identity is then a fact in your inbox rather than something they typed. See the developer docs.

How do I sign in securely?

Sign in with an email and password, or with Google. Passwords are handled by our authentication provider and stored hashed; we never see them. Whizchat does not have its own two-step verification yet. If you sign in with Google, your Google account's two-step verification protects your Whizchat account too.

How long do you keep my data, and how do I delete it?

• Nothing expires automatically. Your conversations and contacts are your business's records, kept until you delete them.
• You can delete any conversation, contact, document or answer yourself, any time, from the dashboard.
• Closing your account deletes your workspace, conversations, contacts, documents and knowledge within 30 days, including from backups.
• To ask for a copy of your data, or for anything you can't delete yourself, email support@whiz.chat.

Do you follow privacy law, and are you certified?

We handle personal information under the Australian Privacy Principles, and our privacy policy sets out the rights visitors and account holders have, including under the GDPR. For your visitors' data we act as your processor: you decide why it is collected and how long you keep it. We don't hold a SOC 2 or ISO 27001 certification. If you need a data processing agreement or answers to a security questionnaire, email support@whiz.chat.

What happens if something goes wrong?

If we become aware of a data breach likely to cause serious harm, we will tell the people affected and the relevant regulator, as the law requires. If you think you have found a security problem in Whizchat, please email support@whiz.chat and we will look at it straight away.