Privacy Policy
This explains what AISupportForge stores, what it deliberately avoids storing, who else touches the data, and how to get it removed. It is written to be read, not to be survived.
Effective 11 August 2026 · Version 1.0 · Operated by Michael Goldsmith, New Jersey, USA
Who we are, and two different relationships
AISupportForge is operated by Michael Goldsmith, a sole proprietor based in New Jersey, United States. That business is the data controller for the account data described below, and can be reached at support@aisupportforge.com. A postal address is available on request.
AISupportForge sits between two groups of people, and our obligations differ for each.
- Our customers. The businesses who hold an account and install the agent. For their account data we are the controller: we decide what to collect and why.
- Our customers' visitors. The people who type into the agent on someone else's website. For that data we are a processor acting on our customer's instructions. The website you were visiting is the controller, and their privacy notice governs.
If you talked to an agent on a website and want your conversation removed, the fastest route is to ask that website. You can also write to us and we will help them action it.
What we store
If you hold an account
- Your email address, and whether it has been verified
- Your business name and your agent's configuration: its name, greeting, tone, guardrails and escalation email address
- The domains you have registered for your agent
- The knowledge you supply: documents, pasted text, and pages we fetched from URLs you gave us, along with the numerical embeddings we derive from them to make search work
- Your Stripe customer and subscription identifiers, so we can match payments to your account. We never see or store your full card number
- Monthly usage counts, so we can apply your plan's credit allowance
If you talked to an agent on a customer's website
- The messages exchanged in the conversation, including what you typed
- A short trail of the pages you visited on that site before opening the agent, so it can understand what you were looking at. This is the "breadcrumbs" feature and it stays within that one website
- Your email address, but only if you typed it in, for example to be contacted back or to raise an escalation
- Questions the agent could not answer, which are reported to the site owner so they can improve their documentation
What we deliberately do not store
These are design decisions, not omissions. They are worth stating plainly because most chat widgets do the opposite.
Visitor IP addresses
Your IP is used for a few minutes in memory to enforce rate limits, then discarded. It is never written to our database and never associated with your conversation.
Cookies, from the widget
The agent sets no cookies. It uses sessionStorage for a session id and the page trail, both of which your browser clears when you close the tab.
Cross-site tracking
There is no advertising network, no analytics pixel and no profile that follows you between different websites. A conversation on one customer's site is invisible to every other.
Training data
Nothing you or your visitors type is used to train an AI model, by us or by the providers we use. It is used to answer the question in front of it and to build the site owner's own reports.
The one cookie we do set is on the customer portal: asf_portal, which keeps you logged in. It is HttpOnly, Secure and SameSite=Lax, and it is strictly necessary for the portal to function. There is no consent banner because there is nothing optional to consent to.
Why we hold it
- To provide the service. Answering questions, showing site owners their conversations, capturing leads they asked to capture
- To bill correctly. Counting messages against your plan and processing subscriptions
- To keep the service standing up. Rate limiting, abuse prevention and debugging
- To contact you. Service notices, verification emails, and escalation emails you configured
Where the law requires a lawful basis, ours is the performance of our contract with our customers, and our legitimate interest in keeping the service secure and working.
Who else processes the data
We keep this list short on purpose. Every additional provider is another place your data lives.
| Provider | What it does | What reaches it |
|---|---|---|
| Anthropic | Generates the agent's replies | The visitor's message and the relevant extracts from the site owner's knowledge base |
| Voyage AI | Turns text into embeddings so the agent can find the right passage | The knowledge material supplied by the site owner, and the visitor's question |
| Stripe | Takes payments | Billing details you enter with Stripe directly. Card numbers do not pass through us |
These providers are based in the United States, so data may be processed there. Our own servers are operated by us, not rented from a hyperscaler, and conversation data is not copied to any analytics or marketing platform.
We do not sell personal information, and we do not share it for behavioural advertising. There is no arrangement under which anyone pays us for access to it.
How long we keep it
Being honest about the current position: we do not yet run an automatic deletion schedule. Conversations, knowledge material and account data are kept until the account holder deletes them or closes the account, at which point we remove them within a reasonable period.
If you want something removed sooner, ask us and we will do it. We intend to introduce a configurable retention window, and we will update this page and tell account holders when we do.
Ask us to delete something
Email support@aisupportforge.com with enough detail to find the record. If you are a visitor rather than an account holder, tell us which website you were on and roughly when.
Your rights
Depending on where you live, you may have the right to ask for a copy of your data, to correct it, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. Residents of the EU and UK have these rights under the GDPR. Residents of California have comparable rights under the CCPA, including the right not to be discriminated against for exercising them.
Exercise any of them by writing to support@aisupportforge.com. We aim to respond within 30 days. We will not charge you for a reasonable request, and we will not treat you differently for making one.
If you are a visitor to one of our customers' websites, we may need to pass your request to that customer, because the data is theirs to control. We will tell you when we do.
Security
Traffic to and from the agent and the portal is encrypted in transit with TLS. Portal sessions use HttpOnly, Secure cookies. Account credentials are stored hashed, never in plain text, and tenant secrets are kept separately from ordinary account records. The agent will only run on domains that have been registered to an account, which stops a site key lifted from your page source being reused elsewhere.
No system is perfectly secure. If we discover a breach affecting personal data, we will notify affected account holders and, where the law requires it, the relevant regulator, without undue delay.
Children
The service is not directed at children and we do not knowingly collect personal information from anyone under 13, or under 16 where local law sets that threshold. If you believe a child has supplied us with information, tell us and we will delete it.
Changes to this policy
We will update this page when what we do changes, and revise the version and date at the top. For material changes affecting account holders we will send an email rather than relying on you noticing. Past versions are available on request.
Contact
Questions, requests, or a concern about how we handled something: support@aisupportforge.com.
Data controller: Michael Goldsmith, trading as AISupportForge, New Jersey, United States. If you are in the EU or UK and are not satisfied with how we handled your request, you may also complain to your local supervisory authority.