Privacy Notice
This notice explains how AI-ssistant handles information when you create, purchase, access or request support for an AI-ssistant Decision Report.
1. Controller and contact
AI-ssistant determines how report and support data are used to provide the service. For privacy questions, access requests or complaints, contact contact@ai-ssistant.store.
2. Information we collect
We collect the email address used for report delivery; process and organization context; the process description, answers and optional operational or financial inputs you submit; text extracted from a document you choose to upload; report and preview content; payment order status and references; feedback and support messages; and limited technical data such as IP address, device/browser information, request identifiers and security logs. Lemon Squeezy handles payment-card details; AI-ssistant is not designed to receive or store full card numbers.
3. Why we use it
We use information to create the free quality preview; generate, render and deliver the paid report; verify payment and prevent duplicate fulfilment; provide customer support; process deletion, quality or refund requests; secure and troubleshoot the service; measure reliability; and meet accounting, fraud-prevention and legal obligations. These uses rely on performance of our contract, your consent where requested, legitimate interests in operating a secure service, and compliance with law.
4. AI processing
When you use document autofill, extracted text may be sent through Vercel AI Gateway to a configured model provider to classify the document, prepare an editable draft and build a source-linked evidence inventory. The free readiness preview may also use rules-based analysis. After payment, the submitted report content and retained extracted evidence may be sent through the same controlled AI route to produce and validate the full analysis. Submitted content is treated as customer content, not as instructions for system administration. Do not include unnecessary personal or sensitive data. AI-ssistant does not use your private report content to train its own general-purpose model.
5. Service providers and disclosures
We disclose only the information needed to providers that operate the service: Vercel for hosting and AI routing; Neon for database services; Vercel Blob for private generated files; Upstash for rate limiting and temporary operational data; Resend for transactional and support email; Lemon Squeezy as merchant of record; and the selected AI model provider for paid analysis. We may also disclose information when required by law, to protect users or the service, or as part of a business transfer subject to appropriate protections. We do not sell personal information.
6. Retention and deletion
The original uploaded file is processed temporarily, removed after text extraction and is not added to the guest report record. Before submission, an editable browser draft—including retained extracted evidence—is stored on your device so a refresh does not silently erase it; clearing the draft removes that browser copy. If you submit the report request, the extracted text, evidence inventory and page or section references are retained with that guest report so findings can be checked against the source. Guest report access normally expires 90 days after first successful delivery. At expiry, or when you use the report's Delete data control, the service is designed to delete or minimize the guest email, source evidence, contextual inputs, report JSON and generated files. Security logs, support records, payment references and accounting records may be kept longer when reasonably needed for fraud prevention, dispute handling, tax, legal or audit obligations. Deletion from encrypted backups may occur on the backup rotation schedule.
7. International transfers
Providers may process information outside your country. Where data-protection law requires safeguards, we rely on the provider's contractual and organizational transfer mechanisms, such as approved standard contractual clauses or an applicable adequacy mechanism.
8. Security
We use HTTPS, high-entropy private access links stored as hashes, private object storage, restricted internal services, rate limiting, request correlation and signed payment webhooks. No system is perfectly secure. Keep the report link private and contact us promptly if you believe it has been exposed.
9. Cookies and local storage
The guest report flow uses essential technical storage for security and report state. The report builder may use browser storage for a local draft, but the email field is excluded from that draft. We do not currently rely on advertising cookies in the public report flow.
10. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent and complain to a regulator. The private report page provides direct deletion. Verified platform owners and authorized support personnel may access report metadata and, when necessary, report content to investigate delivery, quality, security or support issues; those views are access-controlled and audited. You may also email us; we may need to verify your identity and authority before acting. Withdrawing consent does not affect processing already completed lawfully.
11. Children
The service is intended for business users and is not directed to children under 18. Do not submit children's personal data.
12. Updates
We may update this notice when the service, providers or law changes. The effective date above identifies the current version. Material changes will be presented through the service where appropriate.