Privacy Policy

Bahas serves two groups of people, and the policy applies differently to each.

• Customers — the teams who register for an account, upload a knowledge base, and deploy a support bot. We act as the controller of your account data.
• Visitors — the end users who chat with a Bahas-powered widget on a customer’s website. That conversation data belongs to the customer who deployed the widget; we process it on their behalf and under their instructions. If you are a visitor with a question about your data, contact the website operator you were chatting with first.

When you register for and use the Services, you generally provide:

• Your name, email address, and password (stored only as a salted hash).
• Your profile image and the details of any project, team, or invitation you create or accept.
• Knowledge base content you upload — documents, articles, and answers — along with any content your team writes in tickets and conversation replies.
• Your own OpenAI API key, if you choose to bring one. Keys are encrypted at rest and are used solely to make model calls on your project’s behalf.
• Information you provide when contacting us for help or joining a waitlist.

The collected information is categorised as “Personal Information”, “Sensitive Personal Information”, and “Associated Information” as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We may use this information to contact you, provide the Services, send important notices, and share product updates. You will be asked whenever we need additional personally identifying information. To keep your information accurate, you must sign in using your own credentials.

Please do not upload payment card numbers, government identifiers, health records, or other sensitive personal data into a knowledge base or conversation. The Services are not designed to hold that category of information.

When a visitor opens a Bahas widget on a customer’s website, we process the messages they send, any details they enter into a pre-chat or contact form, and a randomly generated visitor identifier stored in that browser so a conversation can be resumed. We do not use this identifier to track visitors across unrelated websites, and we do not build advertising profiles from it.

The Services may automatically collect:

• The type of device you use and its unique identifier.
• The IP address of your device.
• Your operating system and the type of internet browser you use.
• Information about how you use the Services.
• A push notification token, if you enable browser or mobile notifications, so we can alert you to new conversations and escalations.
• Other relevant information based on the permissions you grant.

We use the information we collect to operate and administer the Services, answer questions from your knowledge base, route escalations to your team, analyse trends, conduct research, and gather aggregate usage data. We may combine usage patterns with account information to improve answer quality and surface gaps in your knowledge base. Aggregated and anonymised data may be used to improve the Services.

We do not sell, trade, or rent your information to any third party unless we have been expressly authorised by you, in writing or electronically. We do not use your knowledge base content or your conversations to train our own general-purpose models. We may provide aggregate statistics about usage and traffic patterns in a non-identifying form. We will occasionally send email notices or contact you about the Services and their benefits, as these are essential parts of the service you have chosen.

We rely on a small set of trusted providers to deliver the Services. They process data only on our instructions and are bound to protect it:

• OpenAI — receives conversation messages and relevant knowledge base excerpts to generate answers. Where you supply your own API key, these calls are made under your own OpenAI account and are additionally governed by your agreement with OpenAI.
• SendGrid — delivers transactional email such as invitations, escalation notices, and ticket replies.
• Web Push and Expo push services — deliver notifications to browsers and mobile devices that have opted in.
• Our hosting and database providers — store the data described in this policy.

We may disclose information:

• As required by law, such as a subpoena or other legal process.
• To enforce applicable terms of use and investigate violations.
• When we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, address security or technical issues, or respond to government requests.
• With trusted service providers who work on our behalf and have agreed to follow this policy.
• To protect against imminent harm to the rights, property, or safety of the Services, the Company, or its users.
• In connection with a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different policy.

The Services are not directed at children. Any personal data relating to minors is deemed to be given with parental or guardian consent upon registration.

We provide means to ensure your personal information is correct and current. Your profile page lets you review and change your details, and project administrators can manage team membership, knowledge base content, and conversation history from the dashboard. We adopt reasonable security measures to protect your password. To request a copy of your data or the deletion of your account, write to [email protected].

We use cookies (small text files) to keep you signed in, secure your session, and remember preferences. The chat widget stores a visitor identifier in the browser so a conversation can be resumed on a later visit. Most browsers accept cookies initially, but you can reset yours to refuse all cookies or to be notified when one is sent. Some features may not function properly if cookies are disabled — signing in, in particular, requires them.

The Services may present links that take you outside our domain, including links your knowledge base or your team’s replies contain. We are not responsible for the privacy practices of other websites, and we encourage you to read the privacy statement of every website that collects personally identifiable information. This policy applies solely to information we collect.

We may alert you by email or push notification about new conversations, escalations, service offerings, or other useful information. When you send emails or communications to us, we retain them to process inquiries, respond to requests, and improve the Services. You can unsubscribe from non-essential email at any time; transactional messages required to operate your account will continue.

We care about safeguarding the confidentiality of your information. We provide physical, electronic, and procedural safeguards — traffic is encrypted in transit, passwords are stored only as salted hashes, API keys are encrypted at rest, and access is limited to authorised personnel who need it to operate, develop, or improve the Services. Although we endeavour to provide reasonable security, no system can prevent every potential breach.

We retain account data while an account is active and for a reasonable period afterward so the account can be restored and legal obligations met. Conversation and ticket history is retained for as long as the owning project keeps it; project administrators can delete content from the dashboard, and deleting a project removes its knowledge base, conversations, and visitor records. We may alter this practice according to legal and business requirements, lengthening retention periods to comply with the law or shortening them to free up storage.

Our servers automatically record information your browser sends when you use the Services. Server logs may include web requests, IP addresses, browser type and language, the date and time of your request, and cookies that uniquely identify your browser.

As the Company evolves, this privacy policy will too. You are advised to review this policy regularly for changes, as continued use indicates approval of all changes. The date at the top of this page reflects the most recent update.

Every user should provide informed consent before providing any required information. By registering, you expressly consent to our collection, processing, storing, disclosing, and handling of your information as set forth in this policy now and as amended by us. Your information is processed, stored, and handled in India. If you reside outside India, your information will be transferred, processed, and stored in accordance with India’s applicable data protection laws.

If you have any questions about this privacy policy or how we handle your information, please reach out.