Privacy Policy

1. Who is responsible

For site-owner accounts (email, login, billing status, agent settings), tidyAgent is the controller. For visitor chat content on your live site, you are typically the controller and tidyAgent is the processor acting on your instructions to provide the Service. Wix is a separate controller for App Market billing and the Wix account.

2. Data we collect

Site owners. Name, email, password hash (or Google login identifiers), workspace settings, agent names and photos you upload, plan entitlements reported by Wix (instance id, package, trial/paid status), and support messages you send us.

Connected site. Site display name, URL, locale, currency, installed Wix apps, and content we are allowed to read under your plan (pages, CMS, catalog, bookings, and similar public or API-accessible business information).

Visitors. Chat messages, optional email if lead capture is on, timestamps, and technical identifiers needed to keep a conversation (for example a visitor id in the widget). We do not ask visitors for payment cards through tidyAgent.

Logs. Standard server logs (IP, user agent, request path) for security and debugging, retained for a short period.

3. How we use data

• to authenticate you and isolate each Wix site’s workspace;
• to scan and index site knowledge so the AI can answer visitors;
• to generate replies, spoken audio (if enabled), and specialist handoffs;
• to show you conversations, analytics, and leads in the dashboard;
• to enforce plan limits and investigate abuse;
• to send operational email (login, security, service notices) — not unrelated marketing unless you opt in.

4. Processors and sharing

We share data only as needed to run the Service:

• Wix — install, permissions, site APIs, and App Market billing;
• AI model providers (for example Google Gemini, Groq, OpenAI) — prompts built from your knowledge and the visitor message, to generate a reply;
• speech providers (Google Cloud Text-to-Speech and, if configured, Amazon Polly) — text of replies you enable for voice;
• image hosting (Cloudinary, if configured) — agent photos you upload;
• hosting and database providers that store the application and PostgreSQL data.

We do not sell visitor chats or site-owner lists. We do not use CRM or order data to build a marketing database for ourselves.

5. Cookies and similar tech

The dashboard uses a session cookie after you sign in. The public widget uses a signed init token scoped to one site — not a client-supplied organization id. On the live Wix site, you are responsible for cookie banners and visitor consent tools required by your audience (including GDPR/ePrivacy where they apply).

6. Retention

Account and knowledge data are kept while the app is installed and the workspace is active. After uninstall or a deletion request, we delete or anonymize personal data within a reasonable period unless we must keep a record for security, billing disputes, or law. Conversation logs follow the same rule unless you export or delete them sooner from the dashboard where that control exists.

7. Security

Traffic is served over HTTPS. Passwords are stored as hashes, not plaintext. Tenant queries are bound to the verified organization for the session. You still need a strong password and should revoke access if a teammate leaves.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Site owners can start with the dashboard and support@tidyflowapp.com. Visitors should contact the site owner first; we will assist the owner as processor.

If you are in the EEA/UK, you may also complain to a supervisory authority. We process owner-account data to perform the contract (provide the app) and, where needed, for legitimate interests such as securing the Service.

9. Children

The Service is for business site owners, not for children. Do not use tidyAgent to target visitors you know are under 16 (or the age required in your country) with personal data collection.

10. International transfers

Data may be processed in the country where our hosts and AI providers operate. If we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as standard contractual clauses where required.

11. Changes

We may update this policy. The “Last updated” date will change. Continued use after an update means you accept the new policy.

12. Related terms

Use of the Service is also governed by the Terms of Use.