Skip to content
Get started free

Privacy

Privacy Policy

Your data privacy matters to us. Learn how we handle your personal information.

Last updated: May 20, 2026

This Privacy Policy describes how Aihio AI ("we", "our" or "Service") collects, uses, and protects your personal data when you use our chatbot building platform. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

Aihio AI acts as the data controller for your personal data. Contact information:

privacy@aihio.ai

Helsinki, Finland

  • Name and email address
  • Company name (for teams)
  • Password hash
  • Profile picture (optional)
  • Chatbot configurations and training data
  • Conversation logs and analytics
  • API usage statistics
  • Billing and payment information
  • IP address and browser information
  • Device information and operating system
  • Cookies and similar technologies
  • Login information and timestamps

We use your data for the following purposes:

  • Creating and managing user accounts
  • Providing chatbot functionality
  • Technical support and customer service
  • Billing and payment processing
  • Improving user experience
  • Developing and optimizing AI models
  • Planning new features
  • Performance monitoring and analytics
  • Service notifications and updates
  • Security and maintenance notifications
  • Marketing communications (with your consent)

We process your personal data based on the following legal grounds:

  • Contract: Service provision requires processing your data
  • Legitimate Interest: Service development and ensuring data security
  • Consent: Marketing communications, cookies, and product analytics (e.g. PostHog in the EU)
  • Legal Obligation: Compliance with accounting and tax legislation

We share data with trusted service providers who help us provide the Service:

  • Supabase: Database and authentication (within EU)
  • Stripe: Payment processing
  • Mistral AI (France, EU): Language models for generating chatbot responses. All language model inference runs in the EU; conversation data never leaves the EU.
  • Vercel: Infrastructure and hosting
  • Sentry: Error tracking and performance monitoring
  • PostHog (EU, Frankfurt): Product analytics and usage metrics (explicit consent only)
  • Resend (EU, Ireland): Email communications
  • Crawl4AI (Railway, EU region, Ireland): Web crawling and content collection for customer chatbot knowledge bases — self-hosted service within the EU
  • Twilio (United States) — only with the SMS channel: Delivery of SMS messages when the customer activates the BYO Twilio channel for their chatbot. The customer brings their own Twilio account and acts as the controller toward Twilio; Aihio acts only as a technical relay. Not in use for customers who have not activated the SMS channel.
  • Upstash (Redis, EU region): Rate limiting and caching. Stores short-lived counters whose key may contain a visitor IP address.

When you join a team, the team owner and other members can see your profile name and email address.

We may disclose your data to authorities if required by law.

We retain your personal data:

  • Active Accounts: As long as your account is active
  • Deleted Accounts: 30 days after deletion, after which data is anonymized or deleted
  • Billing Data: 10 years in accordance with accounting law
  • Log Data: 90 days for security purposes

We protect your data with many technical and organizational measures:

  • Encryption during transfer and storage (TLS/AES-256)
  • Access control and role-based permissions (RLS)
  • Regular security audits
  • Backup and recovery plans
  • Staff training on data security

In accordance with GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Restriction: Restrict processing of your data
  • Portability: Receive your data in a machine-readable format
  • Objection: Object to processing of your data, including dashboard product analytics. Email privacy@aihio.ai and we will stop processing your account.

You can exercise your rights in account settings or by contacting privacy@aihio.ai.

We store your data within the EU. Language model inference runs in the EU (Mistral AI, France) – conversation data never leaves the EU. Web crawling for chatbot knowledge bases runs on Crawl4AI, a self-hosted service within the EU. Two of our sub-processors are US companies. Upstash (Redis) stores short-lived rate-limiting counters in an EU-region instance; the company is US-incorporated, so the transfer relies on EU Commission Standard Contractual Clauses (SCCs). Twilio is used solely when a customer explicitly activates their own Twilio account for the SMS channel; in that case the customer acts as Twilio’s controller and the transfer likewise relies on SCCs.

We use cookies to improve Service functionality and user experience. See more details in our Cookie Policy.

The Aihio AI chatbot widget uses the browser's localStorage and sessionStorage to store conversation history, session identifiers, and configuration data. This data is stored locally on the end user's device and is not transmitted to our servers without an active chat session.

Our Service is not intended for users under 16. We do not knowingly collect children's personal data.

We may update this policy from time to time. We will notify you of significant changes via email or through the Service.

For privacy-related questions, contact:

privacy@aihio.ai

If you are dissatisfied with how we process your data, you can file a complaint with the data protection authority (tietosuoja.fi).