Privacy Policy

This Privacy Policy explains how [Company Legal Name] (“we,” “us,” or “our”), the operator of the Mochi Assistant service (the “Service”), collects, uses, and protects personal data. We are the data controller for the personal data described in this policy. Our registered address is [Registered business address]. You can reach us at mochiassistant@gmail.com.

This policy is intended to comply with the General Data Protection Regulation (GDPR) and the ePrivacy Directive of the European Union, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

We collect the following categories of personal data, depending on how you use the Service. We do not intentionally collect sensitive personal data (such as health, biometric, racial, or political information); if you upload such data to your knowledge base, it is your responsibility to obtain the required consents.

• Account data: name, email address, password (hashed), and organization details when you register.
• Billing data: payment information processed by our payment provider. We do not store full card numbers.
• Usage data: pages visited, features used, IP address, device and browser information, and log data.
• Content and conversation data: the knowledge base you upload, your configuration, and transcripts of conversations between your visitors and the AI assistant, which may contain visitors' personal data.
• Cookies and similar technologies: as described in our Cookie Policy.

We use personal data for the following purposes. Consistent with the LFPDPPP, we distinguish between purposes that are necessary to provide the Service and purposes that are optional and require your consent.

Necessary purposes (contract performance and legitimate interests):

• To create and manage your account and authenticate you.
• To provide, operate, secure, and maintain the Service, including generating AI responses from your knowledge base.
• To process billing and renewals.
• To comply with legal obligations and to prevent fraud, abuse, or security incidents.

Optional purposes (require your consent):

• To send product updates, marketing, or promotional communications (you can opt out at any time).
• To use analytics cookies and other non-essential tracking, subject to your consent choices in our cookie banner.
• To use your content to train or improve our models beyond what is necessary to provide the Service, if we ever do so (we will only with your express consent).

For individuals in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract: to provide the Service you requested.
• Legitimate interests: to secure the Service, prevent fraud, and improve our products, balanced against your rights.
• Consent: for cookies, marketing communications, and any optional processing.
• Legal obligation: where processing is required by law.

We use cookies and similar technologies to make the Service work, analyze usage, and personalize content. Strictly necessary cookies do not require consent. All other cookies are only placed after you provide consent through our cookie banner, in accordance with the ePrivacy Directive. For details, see our Cookie Policy.

We do not sell your personal data. We share personal data only with service providers who process it on our behalf and under written agreements consistent with this policy, including:

• Hosting and infrastructure providers (e.g., cloud platform providers).
• AI providers that process your knowledge base and conversation data to generate responses.
• Payment processors for billing transactions.
• Analytics providers that help us understand usage.
• Professional advisors and authorities, where required by law or to protect our rights.

Where you connect third-party integrations (such as telephony or messaging providers), your data may be shared with those providers under their own terms.

We and our service providers may process personal data in countries outside your country of residence, including the United States. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to countries not recognized as adequate, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), to protect your data. You may request a copy of the relevant safeguards by contacting us at mochiassistant@gmail.com.

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Conversation transcripts and knowledge base content are retained while your account is active and deleted or anonymized within a reasonable period after you delete them or terminate your account, unless we are required to keep them by law.

Depending on where you are located, you may have the following rights, which we honor free of charge:

• Under the GDPR: access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Under the CCPA/CPRA (California residents): the right to know the categories and specific pieces of personal information we collect, the right to delete, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising these rights. We will respond to verifiable requests within 45 days.
• Under Mexico's LFPDPPP (ARCO rights): the right to access your data, rectification of inaccurate data, cancellation (suppression) of data, and opposition to processing for certain purposes. We will respond to ARCO requests within 20 business days.

To exercise any of these rights, email us at mochiassistant@gmail.com. We may need to verify your identity before acting on your request. You also have the right to lodge a complaint with your local data protection authority.

The Service uses AI to generate automated responses to your visitors. This automated processing evaluates and responds to visitor questions based on your knowledge base. Under the CPRA, you may opt out of the “sale or sharing” of personal information and of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not use your data for such profiling. California residents may exercise their opt-out rights using the “Do Not Sell or Share My Personal Information” link described in Section 11.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. If our practices change in the future, California residents may opt out of the sale or sharing of their personal information by contacting us at mochiassistant@gmail.com or through the dedicated “Do Not Sell or Share My Personal Information” link on our website.

The Service is not directed to children under 13 (or under 16 in the European Economic Area, or under the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us at mochiassistant@gmail.com and we will delete it promptly.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and regular security reviews. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of a breach that compromises your personal data, we will notify you and, where required, the relevant supervisory authority and affected individuals, without undue delay and in accordance with applicable law.

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date. If we make material changes, we will notify you by email or through the Service. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

For privacy questions, to exercise your rights, or to request a copy of our DPA, contact us at mochiassistant@gmail.com or at our address: [Registered business address].