Legal

Privacy Policy

Last updated: October 16, 2026

1. Introduction

Chat Widget ("we," "our," or "us") is operated by Quincer AI. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, dashboard, embeddable chat widget, and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and profile picture as provided by your Google account through our OAuth sign-in process. We do not store passwords as authentication is handled by Google.

2.2 Widget Configuration Data

We store the configuration settings you provide for your chat widget, including brand name, colors, welcome messages, persona settings, and knowledge base content (questions and answers you define).

2.3 Conversation Data

We store conversations that occur through the chat widget deployed on your website. This includes messages sent by your website visitors and responses generated by the AI agent. Conversation data may include visitor-provided information such as names, email addresses, and other details voluntarily shared during chat interactions.

2.4 API Keys

If you choose the "Bring Your Own Key" option, we encrypt and store your third-party AI API keys (such as OpenAI or Anthropic keys) to facilitate AI-powered responses. These keys are encrypted at rest and never shared with third parties.

2.5 Usage & Analytics Data

We automatically collect certain information when you use the Service, including IP addresses, browser type, operating system, referring URLs, pages visited, time and date of visits, and interaction patterns within the dashboard.

2.6 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or bank account details on our servers. Stripe's privacy policy governs the handling of payment data.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service
  • Process your chat widget configuration and serve it to your website visitors
  • Generate AI-powered responses using your knowledge base and connected AI models
  • Provide conversation analytics and performance metrics
  • Process subscription payments and manage billing
  • Send transactional emails (account confirmations, billing receipts, usage alerts)
  • Improve and personalize the Service
  • Detect and prevent fraud, abuse, and security issues
  • Comply with legal obligations

4. AI Processing & Third-Party AI Providers

When a visitor messages or calls your AI agent, their message (or, on a call, their voice) may be sent to a third-party AI provider to generate a response. The specific provider depends on your configuration: an AI model provider such as OpenAI, Anthropic, Google (Gemini) or xAI, or a service that hosts or routes to AI models, such as Baseten, Together.ai, OpenRouter or Kindo. We send only the minimum information necessary to generate a response, which includes the visitor's message, the conversation so far and relevant knowledge base context. To search your knowledge base, we also send your knowledge base content and visitors' messages to OpenAI to create search embeddings.

Some other tasks send data to an AI provider chosen by Quincer, whichever provider your AI agent uses:

  • Voicemail: by default, a voicemail is recorded and kept by our phone carrier (Twilio or Telnyx). If voicemail media capture is turned on for a widget, we record the voicemail ourselves and send the recording to OpenAI (its Whisper model) to be transcribed.
  • Conversation analysis: conversation text is sent to a utility model, chosen by Quincer from the providers listed above, for example to detect sentiment, summarize and categorize conversations, translate messages, draft suggested replies for your team and answer questions about your conversations.
  • Memory: if memory is turned on for a widget, short notes from visitors' conversations are saved as memory and sent to OpenAI to create search embeddings.

We do not use conversation data to train AI models. Third-party AI providers process data according to their own privacy policies and data processing agreements.

4.1 Decision Models

Besides the model that writes replies, we use decision models: small AI models from outside providers that answer narrow questions about a conversation. For example: is a message spam, does the visitor or caller want to speak with a person, does a knowledge base passage answer the question, and did a draft reply claim an action that never happened. Today they are only measured against our own rules: nothing your visitors or staff see depends on their answers.

  • What we send: conversation text from any channel, such as chat, voice calls, SMS and social messages; the address of the page the visitor is on; and your AI agent's draft reply and the knowledge base passages found for it. Decision models are not used for staff alerts today. If they are, they will receive non-identifying facts about the waiting request, plus facts about available staff under anonymous labels (for example, how many alerts each received recently), never names, email addresses or phone numbers.
  • Who processes it: TypeSafe AI, Inc. (the “Jev” model) is our primary decision-model provider. When we compare models, we also use Cloudflare Workers AI (the “Clef” and “Clef Flash” models).
  • Where: TypeSafe currently processes this data in the United States, through the subprocessors listed at trust.typesafe.ai/subprocessors. Cloudflare processes it on Cloudflare's network.
  • No training: TypeSafe's contract does not allow it to use this data to train its models without our consent. Cloudflare does not use Workers AI inputs to train models. We do not attach any Cloudflare storage service to decision-model calls.
  • What is excluded: conversations that involve a confidential voicemail or a lookup in your people directory are excluded from decision models. This exclusion has known gaps, for example a directory lookup made in the first moments of a voice call, before the call's record exists. We are closing them.
  • Turning them off: an owner or admin of your workspace can turn decision models off at Settings → Workspace → Decision models. When the switch is off, nothing from your workspace's brands is sent to a decision model. Brands identified as health clinics are always excluded, whatever the switch says. Any business can also turn decision models off with this switch.

5. LinkedIn Integration Data

If you connect Quincer AI to LinkedIn through our LinkedIn integration, we access and process LinkedIn member data on your behalf in accordance with the LinkedIn API Terms of Use, the LinkedIn User Agreement, and the LinkedIn Privacy Policy. This section explains specifically what LinkedIn data we access, how we use it, how it is retained and deleted, and the rights you retain over it.

5.1 LinkedIn data we access

When you authorize the LinkedIn integration via LinkedIn's OAuth 2.0 sign-in flow, we receive only the data covered by the scopes you grant. Depending on the features you enable, this may include:

  • Basic profile information (name, headline, profile photo, vanity URL, LinkedIn member ID)
  • The email address associated with your LinkedIn account
  • Posts, articles, or messages you authorize us to read or send on your behalf
  • Connection or network information, only where the granted scope explicitly permits it
  • Organization or Company Pages you administer, when you have granted access to manage them

We do not request, scrape, harvest, or store any LinkedIn data outside the scopes you have granted, and we use only LinkedIn's official APIs to obtain it.

5.2 How we use LinkedIn data

LinkedIn data is used solely to deliver the features you have enabled inside Quincer AI. Examples include authenticating you, displaying your name and photo in the dashboard, composing or sending messages on LinkedIn at your direction, posting content to LinkedIn at your direction, and attaching the LinkedIn profile URL to a contact in your connected CRM when you explicitly choose to do so.

5.3 Prohibited uses of LinkedIn data

Consistent with the LinkedIn API Terms of Use, we do not, and will not:

  • Sell, lease, rent, sublicense, or otherwise transfer LinkedIn data to any third party
  • Use LinkedIn data for advertising, retargeting, or building advertising profiles
  • Use LinkedIn data to make or inform decisions about credit, employment, housing, insurance, education, or other consequential matters about an individual
  • Aggregate LinkedIn member data into a public, exportable, or third-party database
  • Train, fine-tune, or evaluate machine-learning models on LinkedIn data
  • Use LinkedIn data after your authorization has been revoked

5.4 Retention and deletion of LinkedIn data

We retain LinkedIn data only for as long as necessary to provide the features you have enabled.

  • If you disconnect LinkedIn from the Integrations page in your Quincer AI dashboard, we revoke and delete your OAuth tokens immediately and delete LinkedIn-derived member data within 30 days.
  • If you delete your Quincer AI account, all LinkedIn data we hold about you is deleted within 30 days.
  • If LinkedIn revokes our access (for example, if you remove Quincer AI from your LinkedIn permitted-services page), we treat that as a disconnect and follow the same deletion timeline.
  • Operational logs that may contain LinkedIn member IDs are retained for up to 90 days for security and abuse-prevention purposes, then purged.

5.5 Your rights over LinkedIn data

You may, at any time:

5.6 Non-endorsement

Quincer AI is not endorsed by, certified by, sponsored by, or otherwise affiliated with LinkedIn Corporation. “LinkedIn” is a trademark of LinkedIn Corporation. The LinkedIn integration described in this section is provided by Quincer AI under the LinkedIn API Terms of Use.

6. Google Integration Data

6.1 Google data we access

When you connect a Google account to Quincer AI, we access only the data needed for the features you enable:

  • Email (Gmail): messages in the connected inbox (to monitor for new customer conversations and provide thread context), drafts we create for your review, your verified send-as aliases, and — only when you confirm — sending email from your address.
  • Calendar: your calendar list and events, to check availability and to create, update, or cancel events you ask us to book.
  • Drive: files in the Drive you connect (or, where you pin a folder, files in that folder), searched to answer questions with your own documents as context. If document sharing is enabled for an assistant, a person chatting with that assistant may request a document and we may create an “anyone with the link can view” link for the matched file so it can be delivered to them; anyone who obtains that link can view the file until you change its sharing settings in Google Drive.
  • Google Business Profile: your business locations and their reviews, to monitor reviews and post replies.
  • Account identity: the connected account's email address, to show which account is connected and to sign you in.

6.2 How we use Google data

We use Google data only to provide the features described above: monitoring an inbox you connected, drafting replies for your review (email is sent only when you confirm it, or when you have explicitly enabled automatic replies for that inbox), booking meetings you request, retrieving documents and — where document sharing is enabled — creating share links requested through the assistant, and monitoring and replying to your business reviews. Connected-account tokens are stored encrypted and are never exposed to AI models.

6.3 Limited Use

Quincer AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not allow humans to read it except for the limited purposes permitted by that policy (for example, with your explicit consent, for security purposes, or to comply with applicable law).

To draft replies and answers, message and document content may be processed by the third-party AI providers described in Section 4, solely to generate the response you requested. We do not use Google user data to train generalized AI models.

6.4 Retention and deletion of Google data

  • If you disconnect a Google account from the Integrations or Connectors page in Quincer AI, we delete the OAuth tokens we store for that connection. Disconnecting in Quincer AI does not by itself revoke the grant on Google's side; to revoke it at Google, use your Google account permissions page.
  • If you revoke our access on Google's permissions page, Google will no longer let us use that grant. When we next attempt to use it we mark the connection as needing re-authorisation. Revoking at Google does not by itself delete copies or tokens already stored in Quincer AI; to have those deleted, also disconnect the account in Quincer AI or contact us as described below.
  • You may request deletion of Google data we hold about you at any time by emailing privacy@quincer.com. We delete the requested Google data within 30 days of verifying the request, except where we must retain records for legal, tax, security, or accounting obligations.
  • Copied inbox content is also subject to the retention window configured for the relevant workspace or assistant, where one is set.

7. Data Sharing & Disclosure

We do not sell your personal information. We may share information with:

  • Service Providers: Third-party companies that help us operate the Service (hosting, payment processing, email delivery, AI processing)
  • Integration Partners: When you connect third-party services (CRMs, calendars, ticketing systems), data necessary for the integration is shared with those services per your configuration
  • Legal Requirements: When required by law, subpoena, or other legal process
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

8. Data Retention

We retain your data as follows:

  • Account data: Retained while your account is active and for 30 days after deletion
  • Conversation data: Retained per your plan tier (7 days for Free, 90 days for Pro, unlimited for Enterprise) unless you delete it sooner
  • Analytics data: Aggregated and anonymized data may be retained indefinitely for product improvement
  • Billing data: Retained for 7 years as required by tax and accounting regulations

9. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest for sensitive data (API keys, credentials), regular security audits, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Delete your personal information
  • Export your data in a machine-readable format
  • Opt out of marketing communications
  • Restrict or object to certain processing activities

To exercise any of these rights, contact us at privacy@quincer.com.

11. Cookies & Tracking

We use essential cookies to maintain your session and preferences. The embeddable chat widget may use localStorage on your visitors' browsers to persist conversation history (if enabled). We do not use third-party advertising cookies. Analytics cookies (if any) are anonymized and used solely for Service improvement.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.

Data sent to our AI providers, including the decision-model providers described in section 4.1, may be processed in the United States, and TypeSafe currently processes decision-model data there (see section 4.1). This processing is covered by those providers' standard contractual safeguards. For example, TypeSafe's data processing addendum includes the EU Standard Contractual Clauses and the UK Addendum.

13. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete that information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@quincer.com

Company: Quincer AI