Privacy Policy

Background

This Privacy Policy applies to all data subjects whose personal data is collected, used, disclosed, and otherwise processed in accordance with the provisions of the UK Data Protection Act 2018 and the General Data Protection Regulations (GDPR UK) as well as other international laws in countries for which we have an operating business or store data.

Personal data is defined as any information relating to an identified or identifiable living individual. All such data is handled and processed in accordance with the principles of data protection outlined in the GDPR UK.

1. Definitions and Interpretation

In this notice, we use definitions from the GDPR unless otherwise stated.

Controller

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processing

Any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure or destruction.

Processor

A natural or legal person, public authority, agency or other body that processes personal data on behalf of the Controller, acting as an agent in accordance with the Controller's instructions.

Special Categories

Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data related to sex life or sexual orientation. We do not knowingly collect Special Categories of data.

2. Information About Us

Ayima Chat is operated by Ayima UK Ltd, a limited company registered in England under company number 06680571, whose registered address is Kingsley House, 22-24 Elm Road, Leigh-On-Sea, Essex, SS9 1SN, United Kingdom. VAT number: GB 940 6588 04. ICO Registration reference: ZA566156.

3. Scope

This Privacy Policy applies to your use of Ayima Chat. It does not extend to any websites that are linked from the Service. We have no control over how your data is collected, stored, or used by third-party websites and advise you to check their privacy policies before providing any data to them.

4. What Data Do We Collect?

When you use Ayima Chat, we may collect the following data:

• Account information — name, email address, and encrypted password (when you register)
• Conversation data — messages you send and AI responses, stored to provide conversation history
• Usage data — credit balance, transaction history, message counts, and costs associated with your usage
• Google OAuth tokens — if you connect your Google account, we store OAuth access and refresh tokens to query Search Console and Analytics data on your behalf. These are read-only and stored server-side only.
• Payment information — credit purchases are processed by Stripe. We do not store card numbers or payment details. We store Stripe session IDs for transaction records.
• Anonymous identifier — a UUID stored in an HTTP-only cookie to track anonymous usage before registration
• Automatically collected data — IP address, browser type, operating system, and referral URLs

5. How Do We Use Your Data?

All personal data is stored securely in accordance with UK Data Protection Legislation. We use your data to:

• Provide and manage your access to Ayima Chat
• Process your conversations through AI language models to provide SEO analysis
• Maintain conversation history so you can resume previous sessions
• Track credit usage and process payments
• Query Google Search Console and Analytics data on your behalf (when connected)
• Optionally search your past conversations for relevant context (Conversation Memory, when enabled by you)
• Generate vector embeddings of AI responses for semantic search (admin and optional user features)
• Analyse usage patterns to improve the Service
• Respond to support requests

We will not send you unsolicited marketing or spam.

6. Your Rights as a Data Subject

Under data protection law, you have the following rights:

• Right of access — you have the right to ask for copies of your personal information.
• Right to rectification — you have the right to ask us to correct inaccurate personal information or complete incomplete information.
• Right to erasure — you have the right to ask us to erase your personal information. You can delete your account and all associated data from Settings > Profile > Delete Account.
• Right to restriction of processing — you have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Right to object to processing — you have the right to object to the processing of your personal information in certain circumstances.
• Right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
• Automated decision-making — we make no decisions based solely on automated processes without human involvement. AI analysis provided by the Service is informational and does not constitute automated decision-making about you.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond. Please contact us at contact@ayima.com.

7. How and Where Do We Store Your Data?

We only keep your data for as long as we need to in order to provide the Service.

Your data is stored on Cloudflare's global network, which may include locations outside of the UK and European Economic Area. Cloudflare maintains appropriate safeguards including Standard Contractual Clauses for international data transfers.

Data security is of great importance to us. We use encrypted connections (HTTPS), encrypted password storage (bcrypt hashing), server-side-only token storage, and Cloudflare's infrastructure security. Ayima's certification in ISO 27001 underscores our commitment to robust data security practices.

The transmission of data via the internet may not be completely secure. You are advised to take suitable precautions when transmitting data to us via the internet.

8. Do We Share Your Data?

We may share your data with:

• AI language model providers (Anthropic, OpenAI, Google, xAI, Fireworks) — your conversation messages are sent to the selected AI provider for processing. These providers have their own data processing agreements and privacy policies.
• DataForSEO — domain names and URLs you discuss are sent to DataForSEO for SEO analysis. No personal data is shared.
• FireCrawl — URLs you discuss may be sent to FireCrawl for page content analysis. No personal data is shared.
• Stripe — payment processing. We do not store card details. Stripe handles payment data under their own privacy policy.
• Google APIs — when you connect your Google account, we query Google Search Console and Analytics APIs using your authorised tokens. No data is shared with Google beyond the standard API requests.
• Cloudflare — infrastructure provider. Data is processed on Cloudflare's network (D1 database, KV storage, Vectorize, Workers AI).
• Other companies in our group — subsidiaries and holding company as needed.

We may be legally required to share data in certain circumstances, such as compliance with court orders or governmental requirements.

9. Legal Basis for Processing

Our legal basis for processing personal data includes:

• Consent — you have given clear consent for us to process your personal data, for example by creating an account or connecting your Google account.
• Contract — the processing is necessary to provide the Service you have requested.
• Legitimate interests — the processing is necessary for our legitimate interests, such as improving the Service and preventing abuse.
• Legal obligation — the processing is necessary for us to comply with the law.

10. Third-Party Processors

Our service providers that may process personal information on our behalf include:

• Cloudflare, Inc. — infrastructure and data storage
• Stripe, Inc. — payment processing
• Anthropic, PBC — AI language model provider
• OpenAI, Inc. — AI language model provider
• Google LLC — AI language model provider, Search Console, and Analytics APIs
• xAI Corp. — AI language model provider
• Fireworks AI, Inc. — AI language model provider
• DataForSEO — SEO data provider
• FireCrawl — web scraping and crawling service

11. Automated Decision Making

No automated decision-making that has legal or similarly significant effects is made by Ayima Chat. The AI analysis provided by the Service is informational and advisory only.

12. Withdrawing Consent

You have the right to withdraw consent at any time. You can:

• Delete your account and all associated data from Settings > Profile
• Disconnect your Google account from Settings > Connections
• Disable Conversation Memory from Settings > Preferences
• Contact us at contact@ayima.com for any other requests

13. Retention Period

We retain your personal information only for as long as necessary to provide the Service. Conversation data is retained until you delete it or delete your account. Anonymous usage data may be retained in aggregate form for analytical purposes.

14. Changes of Business Ownership

We may expand or reduce our business, which may involve the sale or transfer of control of all or part of our business. Data provided by users will, where relevant, be transferred along with that part. The new owner will be permitted to use the data for the purposes for which it was originally collected.

15. Controlling Your Data

You can control your data through the Settings pages within Ayima Chat:

• Edit your profile information (name, email, password)
• Delete individual conversations
• Disconnect third-party connections (Google)
• Toggle Conversation Memory on/off
• Delete your entire account and all associated data

16. Accessing Your Data

You have the legal right to ask for a copy of any personal data held by us. Please contact us at contact@ayima.com.

17. Complaints

If you wish to make a complaint about how your personal data is being processed, please contact our Data Protection Officer at contact@ayima.com. All complaints will be treated confidentially.

If you feel unsatisfied with our handling of your data, you are entitled to escalate your complaint to the ICO (Information Commissioner's Office) at ico.org.uk/make-a-complaint or telephone 0303 123 1113.

18. Contacting Us

If you have any questions about the Service or this Privacy Policy, please contact us:

• Email: contact@ayima.com
• Post: Ayima UK Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom

19. Changes to This Policy

This policy may be updated from time to time. Changes will be posted on this page with an updated date. We encourage you to check this policy regularly.

Legal Information

Ayima UK Ltd is a limited company registered in England and Wales under company number 06680571.

Registered office: Kingsley House, 22-24 Elm Road, Leigh-On-Sea, Essex, SS9 1SN, United Kingdom.

VAT number: GB 940 6588 04

Postal correspondence: Ayima UK Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.