Privacy policy
Fourth Dimension ("we") builds ChatWidget, an assistant you embed on your own website. This policy covers two different sets of people, and the distinction matters throughout: our customers, who hold an account with us, and our customers' visitors, who talk to an assistant on a customer's site. For visitor conversations we are a processor acting on our customer's instructions; our customer is the controller.
What we collect from customers
- Account details: name, email address, password hash, and the workspaces you belong to.
- Content you upload: pages you ask us to crawl, files you upload, product catalogues you sync, and the instructions you write for your assistant.
- Configuration: your widget settings, model choice, tool credentials and store URL.
- Billing details, held by our payment processor. We never see or store a full card number.
- Product telemetry: which console pages you open and which actions you take, so we can tell what is broken.
What we collect from your visitors
- The messages they type, and the answers the assistant gives.
- The page they were on when they opened the chat, its title, and the referring page.
- A conversation identifier and, where a cart is in use, a cart token issued by your store.
- Approximate location, only if the visitor presses a button asking to find their nearest store, and only for as long as it takes to answer.
- Whether they are signed in to your store, when your store tells us.
We do not place advertising or tracking cookies through the widget (the cookie policy names the one cookie we set), we do not fingerprint visitors, and we do not build profiles of them across our customers' sites. The widget discloses that it is an AI assistant before the first reply, and that disclosure cannot be silently removed.
Where it is processed
Customer content and conversations are stored in India (Bengaluru, DigitalOcean). Generating an answer sends the visitor's question, the retrieved excerpts from your own content, and your instructions to a third-party model provider, which may process them outside India. Embeddings, the numeric representation used to search your content, are computed on our own infrastructure and are not sent anywhere.
Who else touches it
Our sub-processors, what each one does and where it operates are listed on the subprocessor page, which you can subscribe to for change notifications. In summary: a model provider generates answers, a cloud provider hosts the service, a payment processor handles billing, and an email provider sends transactional mail. Where a visitor asks for their nearest store, a public geocoding service converts coordinates to a locality. We do not sell personal data, and we do not share it for anyone else's marketing.
How long we keep it
| Data | Retention |
|---|---|
| Visitor conversations and messages | Until you delete them. A workspace can set a period of 30, 90, 180 or 365 days, which an admin applies by running the purge in the console. We do not run it for you on a schedule. |
| Retrieval traces | Deleted with the conversation they belong to. |
| Your uploaded content and its embeddings | Until you delete the source. Deleting a workspace deletes its content at once. |
| Encrypted backups | 14 days on the server, 30 days off it. A row you deleted can still sit in a backup until it ages out. |
| Account and billing records | As long as the account is open, then as long as tax law requires. |
Deleting a conversation deletes its messages and its traces with it, and is not reversible.
Your rights
Depending on where you live you may have rights to access, correct, export or delete your personal data, to object to processing, or to withdraw consent. Write to our contact form and we will respond within 30 days. If you are a visitor to one of our customers' sites, ask that customer first, they decide what happens to your conversation, and we act on their instruction. Indian residents can also read our DPDP notice, which names our Data Protection Officer and the grievance route.
Security
Data is encrypted in transit and at rest. Access to production data is limited to the engineers who need it and is logged. Our current certification status, including what we have not yet certified, is stated plainly on the security page, and vulnerabilities can be reported through our disclosure process.
Children
ChatWidget is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, write to us and we will delete it.
Changes
We will post any change here and update the date above. If a change materially affects how we handle personal data, we will email account owners at least 30 days before it takes effect.
Contact
Fourth Dimension · our contact form · other ways to reach us.