Privacy Policy

1. Introduction

Welcome to KwenTalk ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered chatbot platform and related services (collectively, the "Services").

This Privacy Policy complies with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us:

• Account Information: Name, email address, password, and organization details when you register
• Profile Information: Organization name, business description, logo, and contact information
• Content: Chat messages, documents, files, product information, and knowledge base content you upload
• Billing Information: Payment details, billing address, and invoice information (processed securely)
• Support Communications: Messages and attachments you send to our support team

2.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: IP address, browser type, device type, and operating system
• Cookies and Similar Technologies: Session data and preferences (see Section 8)

2.3 Information from AI Processing

Your chat conversations and uploaded documents may be processed by third-party AI services (OpenAI, DeepSeek) to provide chatbot functionality, document understanding, and embeddings. We retain:

• Chat conversation history and context
• Document content and generated embeddings (vector representations)
• AI-generated responses and artifacts
• Usage metrics (token counts, model used)

3. How We Use Your Information

We use your personal information to:

• Provide Services: Operate chatbots, process documents, manage bookings, and deliver core functionality
• Account Management: Create and maintain your account, process authentication, manage subscriptions
• AI Processing: Generate responses, embeddings, and semantic search using third-party AI models
• Communication: Send service updates, subscription notifications, invoice reminders, and support responses
• Analytics: Understand usage patterns, improve features, and optimize performance
• Security: Detect and prevent fraud, abuse, and unauthorized access
• Legal Compliance: Comply with legal obligations and enforce our Terms of Service

4. How We Share Your Information

We share your information with:

4.1 Third-Party Service Providers

• OpenAI: Chat completions, embeddings, and AI model processing
• DeepSeek: Alternative AI model processing
• Supabase: Database hosting and file storage
• Vercel: Application hosting and deployment
• Email Service Providers: Transactional emails and notifications

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or security issues
• Protect user safety

4.3 Business Transfers

If KwenTalk is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with other parties when you explicitly consent to such sharing.

5. Data Retention

We retain your information for as long as:

• Your account is active
• Needed to provide Services
• Required by law or contractual obligations
• Necessary for legitimate business purposes

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., dispute resolution, fraud prevention).

5.1 Guest User Data Retention

If you use KwenTalk as a guest user (without creating a permanent account), special data retention rules apply:

What Data We Collect from Guest Users

• Chat Messages: Conversations with businesses and AI chatbots
• Favorites: Businesses you have marked as favorites in the marketplace
• Booking Information: Appointments and bookings you create (if applicable)
• Session Cookies: Authentication tokens stored as HTTP-only cookies
• IP Address: For rate limiting and abuse prevention purposes

How Long We Keep Guest Data

Guest user accounts and all associated data are automatically and permanently deleted after 30 days of inactivity. Inactivity is measured by:

• No chat messages sent or received
• No favorites added or modified
• No active or confirmed bookings

Important: This deletion is permanent and irreversible. We cannot recover guest data once it has been deleted. It is your responsibility to upgrade to a permanent account if you wish to retain your data.

Session Duration

Guest sessions are valid for 7 days from creation. Your session data (stored in cookies) will automatically restore your account when you return within this period using the same browser and device. After 7 days without activity, you will need to create a new guest session.

How to Convert to Permanent Account

You may convert your guest account to a permanent account at any time by providing your name, email address, and password. When you upgrade:

• All your chat history is permanently preserved
• All your favorites are permanently preserved
• All your bookings are permanently preserved
• Your data will NOT be deleted after 30 days
• You gain access to business features and organization management

Rate Limiting Data

We store IP addresses and timestamps of guest account creation attempts for up to 7 days to prevent abuse and ensure fair use. This data is automatically deleted after the retention period.

Legal Basis for Processing

We process guest user data under legitimate interest (Article 6(1)(f) of the GDPR, analogous to Philippine Data Privacy Act principles) to provide our service. The 30-day retention period balances our operational needs with data minimization principles.

Your Rights as a Guest User

As a guest user, you have the right to:

• Upgrade to permanent account: Convert your guest account at any time to preserve all data
• Request immediate deletion: Contact us at privacy@kwentalk.com to delete your guest data before the 30-day period
• Access your data: Upgrade to a permanent account to view and export your data

6. Your Rights Under Philippine Law

Under the Philippine Data Privacy Act, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal exceptions)
• Right to Object: Object to processing for direct marketing or legitimate interests
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Withdraw Consent: Withdraw consent for processing at any time
• Right to Lodge a Complaint: File a complaint with the National Privacy Commission

To exercise these rights, contact us at privacy@kwentalk.com. We will respond within 30 days.

7. Data Security

We implement security measures to protect your information:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest
• Access Controls: Role-based access and authentication
• Infrastructure Security: Secure hosting with Supabase and Vercel
• Regular Audits: Periodic security reviews and updates

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but strive to use commercially acceptable means to protect your data.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain user sessions and authentication
• Remember preferences and settings
• Analyze usage patterns and performance
• Improve user experience

You can control cookies through your browser settings. Disabling cookies may limit functionality of the Services.

9. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

10. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Your information may be transferred to and processed in countries outside the Philippines, including the United States where our service providers (OpenAI, Vercel, Supabase) are located. These countries may have different data protection laws. We ensure appropriate safeguards are in place.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our website. Continued use of the Services after changes indicates acceptance of the updated policy.

13. Contact Us

For privacy-related questions or to exercise your rights, contact: