Privacy policy

Last updated 1 October 2026 · version 2026-10-01

1. Two roles

For your account (you, the business customer), bidi decides how your data is used. For your visitors (the people who talk to your assistant), your business decides, and bidi processes their data on your behalf to run the assistant you configured.

2. What we collect about you

• Account: your email address, and the profile details you add (name, phone, company, role, country, tax registration number).
• Your configuration and knowledge: the answers you give us, files you upload, websites and research sources you add, settings and business rules.
• Billing: invoices, plan status and payment references. Card details go straight to our payment provider; we never receive them.
• Service records: sign-in events and the technical logs needed to keep the service secure and working.

3. What your assistant collects about visitors

• The conversation itself, the page of your site it started on (the address without any query string), and the language used.
• Contact details a visitor chooses to share, which become a lead for your team.
• A keyed, one-way hash of the visitor's IP address, used only for rate limits and abuse prevention.
• A conversation token kept in the visitor's own browser storage so the chat survives a page change. No advertising or cross-site tracking cookies.

Visitors' secrets that look like card numbers or bank accounts are redacted before a message is stored.

4. Why we use it

To provide the service you signed up for (running your assistant, answering visitors, routing handoffs and leads), to bill you, to keep the service secure, to send you service emails (sign-in codes, alerts, receipts), and to support you. We don't sell personal data and don't use your or your visitors' content to train AI models for others.

5. Who processes it for us

• AI model providers (for example OpenAI and Anthropic) generate answers and embeddings from the conversation and your approved knowledge.
• Our payment provider (Stripe) processes payments.
• Our email provider delivers sign-in codes, alerts and receipts.
• Our hosting provider runs the application and database.

These providers may process data outside the UAE. We use them under terms that protect the data.

When a business chooses to block countries, a visitor's country is looked up on our own servers, in a location database we keep there: IP geolocation by DB-IP, or GeoLite2 data created by MaxMind. The visitor's address is not sent to either.

6. How long we keep it

• Visitor conversations: as long as your retention setting says (keep, or delete after 30, 90 or 365 days), and you can delete any conversation at any time from your inbox.
• Leads: until you delete them.
• Your account and configuration: while your account is open; deleting the account erases them.
• Invoices and payment records: for as long as tax and accounting law requires, even after an account closes.

7. Security

Data travels encrypted. IP addresses are kept only as keyed hashes, and our team accesses customer data only when needed to run or support the service.

8. Your choices and rights

You can view and change your profile, set conversation retention, and delete conversations from your dashboard. From your profile you can download a copy of your data at any time, sign out of every device, and delete your account. Deleting it takes your live assistants offline for good, cancels your plan so nothing more is charged, and erases your bots, their knowledge and conversations, and your profile straight away; invoices and payment records stay for as long as tax law requires. If other people work in a workspace you own, you first make one of them its Owner. For anything else (a correction, for example), contact us and we'll respond within 30 days. Visitors who want their conversation removed should contact the business they spoke with; we'll help that business fulfil the request.

9. Changes

We'll update this page when our practices change and tell you by email about significant changes.