Privacy Policy

Refleks("we", "our", "us") provides an AI-powered website assistant service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Refleks is operated by Ebubekir Korkut, a sole proprietor based in Kosovo.

If you have questions, contact us at support@refleks.dev.

We collect the following categories of information:

Account Information

• Email address
• Password (stored as a salted hash — we never store plaintext passwords)
• Account creation date and account preferences

Website Content

• The URL(s) of the website(s) you connect to the Service
• Content crawled from those websites (page titles, text content, page URLs)
• Numerical search representations derived from crawled content to find relevant pages
• Crawl metadata such as page count, crawl timestamps, and crawl errors

Chat Data

• Chat messages sent through the embeddable widget (questions and AI-generated responses)
• A visitor identifier stored in the visitor's browser for conversation continuity
• Conversation timestamps and metadata

Usage & Technical Data

• Usage counters needed to enforce plan limits and monitor AI and crawl costs
• Operational events such as request timestamps, crawl activity, response latency, and failures
• IP address and user-agent information in security logs, where available, for rate limiting, abuse prevention, and incident investigation

Lead / Contact Form Data

• Name, email address, phone number, and message submitted through an enabled widget contact form
• The page URL where the form was submitted
• Submission timestamp and abuse-prevention metadata (no raw IP address is stored)

Billing Data

• Billing information is collected and processed by Paddle, our payment processor. We do not store credit card numbers or full billing addresses on our servers.
• We receive from Paddle: your name, billing email, transaction IDs, and plan details necessary for account provisioning.

Customers that process personal data through the Service can review our general Data Processing Addendum template, which describes processor terms without making unsupported certification or transfer-mechanism promises.

We use the collected information for the following purposes:

• Providing the Service: Organizing your website content for search, generating responses through an AI provider, and displaying the chat widget on your site.
• Account Management: Creating and maintaining your account, authentication, and communicating with you about your subscription.
• Billing: Processing payments, invoicing, and managing subscriptions through Paddle.
• Improving the Service: Analyzing usage patterns to improve performance, fix bugs, and develop new features. We do not use customer content to train or fine-tune AI models.
• Abuse Prevention: Monitoring for unauthorized access, rate limit enforcement, and preventing fraudulent activity.
• Lead Follow-up: To let the website owner follow up with visitors who asked to be contacted through an enabled widget contact form.
• Legal Compliance: Complying with applicable legal obligations and responding to lawful requests.

If you are a resident of the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract Performance: Processing is necessary to provide the Service under our Terms of Service.
• Legitimate Interests: Processing for security, abuse prevention, and service improvement, where our interests do not override your rights.
• Consent: Where we rely on consent, you may withdraw it at any time.
• Legal Obligation: Where processing is required by law.

We use the following third-party service providers to operate the Service:

• Self-hosted database — Database storage on our own infrastructure. The website content, searchable representations, conversations, and usage data are stored here.
• MiMo— AI model provider used to generate chat responses. Relevant website excerpts and the visitor's question are sent through its API and handled under the provider's applicable API terms.
• OpenAI — Search-representation provider. Website content and search queries are sent through the API for retrieval processing. OpenAI states that API data is not used to train its models by default; see its enterprise privacy page.
• Paddle— Payment processing, invoicing, and tax compliance. Paddle acts as the merchant of record. See Paddle's Privacy Policy.
• Resend — Transactional email delivery for account verification, password resets, and service messages. Email addresses and message content are processed as necessary to deliver those messages.
• Contabo — Virtual-server infrastructure used to host the application, worker, and self-hosted PostgreSQL database. Contabo processes data as an infrastructure provider where the server is located.

We use session cookies for authentication (you must be logged in to access the dashboard). These are essential for the Service to function.

The chat widget uses browser storage to keep a visitor identifier, conversation ID, and, where enabled, a signed visitor-session token for continuity and abuse prevention. These identifiers are sent to our widget APIs when the visitor uses the assistant.

We do not currently use third-party tracking, advertising, or analytics cookies. Optional first-party conversion measurement is disabled by default. If an operator enables it, we accept only bounded UTM values in a first-party, HttpOnly cookie for up to 30 days and may store signup and completed-checkout conversion events for up to 90 days. The mechanism does not use third-party trackers, advertising cookies, raw IP addresses, or device fingerprints. Any required legal basis or consent decision remains the operator's responsibility.

We retain your data for the following periods:

• Account data: Retained while your account is active. Account deletion removes the account and related service data from the primary database immediately after any active paid subscription has been cancelled. Residual copies may remain in restricted operational backups until those backups rotate out.
• Website content (pages, chunks, embeddings): Retained while the site exists. Removing a site deletes this content from the primary database through cascading database relationships.
• Chat conversations & messages: Retained for up to 90 days by default, then removed by scheduled cleanup. Deleting the related site or account removes them sooner.
• Lead/contact submissions: Retained for up to 12 months by default, unless deleted earlier by the customer or with the related site or account.
• Usage and AI-operation logs: Retained for up to 12 months by default for quota enforcement, cost monitoring, reliability, and abuse prevention.
• Security and administrator audit logs: Retained for up to 12 months by default. An administrator actor snapshot may remain after account deletion so security-sensitive actions can still be investigated.
• Billing records: Subscription and transaction records may be retained by us and Paddle for the period required by applicable tax, accounting, chargeback, and financial regulations.

We implement appropriate technical and organizational security measures, including:

• Encryption in transit (TLS) for all API and web traffic where HTTPS is configured
• Tenant isolation enforced in application queries and through scoped database access (each customer's data is queried by site_id/user_id)
• Server-side authentication with session tokens and salted password hashing (scrypt)
• Regular security updates and dependency monitoring
• Access controls limiting staff access to production data

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we follow industry best practices.

Depending on your jurisdiction, you may have the following rights:

• Access: Download a copy of account data from your dashboard account page.
• Rectification: Request correction of inaccurate or incomplete data.
• Deletion: Delete your account and related service data from your dashboard account page after any active paid subscription is fully cancelled. Legally or operationally required billing, security-audit, and backup records follow the retention periods above.
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Request transfer of your data to another service provider.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, you may withdraw it.

You can export or delete account data from your dashboard account page. For other rights requests, contact us at support@refleks.dev. We will respond within the period required by applicable law.

Your data may be processed on infrastructure operated by us, our hosting provider, and the service providers listed above, including in countries with different data protection laws. Where applicable law requires safeguards for an international transfer, we rely on the provider's contractual transfer terms and other legally recognized safeguards appropriate to that transfer.

The Service is not intended for use by children under 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the dashboard. We encourage you to review this policy periodically.

For privacy-related inquiries, data requests, or concerns, contact us at:

Refleks, operated by Ebubekir Korkut
Email: support@refleks.dev