Privacy Policy

This policy explains how Sitovai Agency (business ID / Y-tunnus 3638129-8, Finland), the provider of Vandio Chat, handles personal data. Contact: support@sitovaiagency.com.

1. Two different roles

Vandio Chat has two kinds of user, and our role differs for each:

• Our customers — the businesses who sign up and install the chat widget. For their account data we are the controller.
• Their website visitors — the people who chat with a customer's bot. For those conversations the customer is the controller and we are their processor: we handle that data on their instructions, and questions about it should go to them first.

2. What we collect

• Account data — your email address and workspace details.
• Billing data — plan and subscription status. Card details are handled by our payment provider; we never see them.
• Website content — the pages we crawl from the site you point the bot at, converted into a searchable index. Public pages only.
• Conversations — messages exchanged between your visitors and your bot, with timestamps and the model cost of each reply.
• Captured details — where a conversation produces a lead, an escalation or a booking, the contact details the visitor chose to give.
• Server logs — standard technical records kept briefly for security and debugging.

Please do not point a bot at pages containing personal or confidential information you would not want the bot to repeat: anything in the index can be quoted back to a visitor who asks about it.

3. Why we process it

To provide the service you signed up for — crawling, indexing, answering questions, and reporting on conversations (performance of a contract). To bill you. To keep the service secure and working. We do not sell personal data and we do not use your content or your visitors' conversations to train AI models.

4. Who else processes data

• Supabase — database, authentication and storage.
• Vercel and Railway — hosting and the crawler.
• Mistral, Anthropic and OpenAI — the language models that generate answers and embeddings, depending on the configured model.
• Resend — notification and transactional email.
• Stripe — payments.

Where a provider processes data outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

5. How long we keep it

Conversation logs follow the retention period set in your workspace, and are deleted automatically once it passes. You can delete individual conversations, a bot and its index, or your whole workspace at any time. When you close your account we remove your data within 30 days, except anything accounting law requires us to keep.

6. Your rights

If you are in the EU/EEA or the UK you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its use, or provide it in a portable form. Email support@sitovaiagency.com and we will answer within a month. You may also complain to your local supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

If you chatted with a bot on someone else's website, that business controls the conversation. Contact them; we will help them respond.

7. Security

Data is encrypted in transit. Workspaces are isolated from one another at the database level, so one customer cannot read another's bots, indexes or conversations. Access to production systems is limited to those who need it.

8. Cookies

We use only the cookies needed to keep you signed in and to keep the service secure. The chat widget stores a short-lived identifier in the visitor's browser so a conversation survives a page change. No advertising or cross-site tracking cookies are used, and we run no third-party analytics or advertising scripts on this site.

Two further cookies exist and are worth naming, because neither is strictly necessary. If you arrive through a partner link — an address containing ?ref= — we set a first-party cookie called sb_ref recording which partner sent you and, optionally, which channel. If you arrive from one of our own ads or campaigns, an address carrying utm_source, utm_medium or utm_campaign, we set a first-party cookie called sb_utm holding those three values.

Both last 60 days, both are set only on visits that actually carry the parameter, and both exist for one purpose: to know which partner or which campaign brought a customer. Neither is shared with anyone, neither is used for advertising, and neither can follow you to another website — they are readable only by this site. Deleting your cookies removes them.

9. Changes

If our processing changes we will update this page and the date above, and announce significant changes by email.