What happens to your data, in plain words.

Only what they choose to share in the chat. When a visitor is interested, TailGPT asks for their name and phone number, and they may add an email address; these are kept with their conversation for you. No login. The chat bubble sets no cookies; it keeps a random id in the visitor's browser so a returning visitor sees their own conversation. We do not sell anything about you or your visitors.

TailGPT runs on Amazon Web Services in Mumbai (ap-south-1). Uploaded files and logos sit in encrypted storage in the same region. To build the search index and write each answer, page text and visitors' questions are sent to our AI provider, which may process them outside India.

Payments go through Razorpay; your card or bank details go to Razorpay, not to us. The full list of companies involved is on our privacy page.

• Visitors' questions and answers: kept while the account is open; deleted when the account is closed.
• Visitors' conversations: kept while the account is open; deleted when the account is closed. A business can delete any single conversation at any time.
• Your account and content: until you remove them.
• A closed account is kept, not deleted, so it can be reopened; ask and we erase it.

No. TailGPT doesn't train any AI model on your pages, documents or visitors' questions. Your content is turned into a private search index used only to answer your own visitors.

• Delete a website in your dashboard and its pages, its documents and its search index are removed, including the copy held by our AI provider.
• Delete a chatbot and it stops answering; its logo is removed.
• Delete a document and it leaves the search index.
• Close your account and your chatbots stop, your plan is cancelled and you are not charged again.

For anything else - conversations, a closed account - write to [email protected] from your account's address and we erase it within 30 days.

• It answers only from the content you approved; when nothing matches, the AI is not asked at all.
• Every fact in an answer is checked against the page it came from; one the page doesn't back up is rewritten once, or the agent says it doesn't know.
• Email addresses and phone numbers that appear nowhere in your content are removed from answers.
• Attempts to give it orders (“ignore your instructions”) are refused, and it won't write code.
• Text read from your pages and files is checked for hidden instructions.
• Each visitor, each address and each chatbot has a limit on questions per minute, so nobody can run up your bill.
• The bubble loads only on your own website's domain.

• Passwords are stored only as a bcrypt hash.
• Your session cookie can't be read by scripts on the page.
• You can sign in with Google instead of a password.

Everything between your browser, your visitors and TailGPT travels over HTTPS.

For your visitors' questions, you decide why they are collected, so under the Digital Personal Data Protection Act 2023 you are the data fiduciary and TailGPT processes them for you. We collect no more than answering needs, keep question logs while the account is open and delete them when the account is closed, ask for a visitor's details only when they're interested, and keep them for you, and erase on request. TailGPT does not claim any certification under the Act. If your privacy notice needs a line about us, use the one on our privacy page.

TailGPT does not hold SOC 2, ISO 27001 or similar certifications today. If you need one, tell us.

Write to [email protected]. We reply to security reports first.