Privacy Policy

At Savanto, we take your privacy seriously. This policy explains what data we collect, how we use it, and your rights regarding your information.

Overview

Savanto provides AI-powered search and chat tools for websites. We process two types of data:

• Account Data — Information you provide when creating an Savanto account
• Customer Content — Products, posts, or other content you choose to index with our service

We do not collect personal information from your website visitors. When visitors use the search or chat features on your site, their queries are processed but not linked to any personal identity.

Information We Collect

Account Information

When you create an Savanto account, we collect:

• Name and email address
• Password (stored securely using industry-standard hashing)
• Payment information (processed by Stripe; we do not store card numbers)

Customer Content

When you connect your website to Savanto, you choose what content to index. This may include:

• Product information (titles, descriptions, prices, images)
• Blog posts and pages
• Categories and tags
• Course information (for education platforms)
• Documentation articles

This content is used solely to power search and chat features on your website. We do not sell or share your content with third parties for marketing purposes.

Usage Data

We collect anonymized usage data to improve our service:

• Search queries (not linked to individual visitors)
• Chat conversations (not linked to individual visitors)
• Feature usage and performance metrics

Visitor Data

We do not collect personal information from your website visitors. When someone uses the Savanto search or chat widget on your site:

• Their queries are processed to provide results
• Conversations may be stored to maintain context during a session
• No names, emails, or IP addresses are collected
• A pseudonymous visitor identifier is generated using browser characteristics to provide analytics (e.g., unique visitor counts). This identifier cannot be used to identify individuals and is not linked to any personal information

How We Use Your Information

We use the information we collect to:

• Provide and maintain the Savanto service
• Process payments and manage your subscription
• Send important service updates and notifications
• Respond to your support requests
• Improve our AI models and service quality (using anonymized data)
• Detect and prevent fraud or abuse

Third-Party Services

We use trusted third-party services to operate Savanto:

Infrastructure & Hosting

• Amazon Web Services (AWS) — Cloud infrastructure including data storage, AI processing, and caching. Data is stored in the United States.
• Vercel — Website hosting and deployment.

AI Processing

• OpenAI — Powers our AI search and chat capabilities. Customer content is processed to generate embeddings and responses. OpenAI does not use this data to train their models. OpenAI Privacy Policy
• Amazon Bedrock— Used for vector embeddings and select inference workloads running inside our AWS environment. Bedrock processes content under AWS’s standard data-handling commitments and does not retain content for model training by default. Bedrock data protection

Payments

• Stripe — Handles all payment processing. We do not store credit card numbers. Stripe Privacy Policy

Communications

• Resend — Sends transactional emails (account verification, password resets, receipts).

Live Agent Handoff (Optional)

If you enable live agent handoff, conversations may be shared with:

• Slack — If you connect your Slack workspace for support notifications.
• Zendesk — If you connect your Zendesk account for ticket creation.

Sub-processor Changes

The third-party services listed above are the sub-processors we engage to deliver Savanto. Material changes — adding a new sub-processor, replacing an existing one, or substantially changing the data an existing sub-processor processes on our behalf — will be reflected in this policy at least 30 days before they take effect. The “Last updated” date at the top of this page is updated whenever the sub-processor list changes.

If you are a merchant or controller and you object to a planned sub-processor change, email privacy@savanto.aiduring the 30-day notice window. If we cannot accommodate the objection, you may terminate the affected service and request deletion of your data under the “Your Rights” section below.

Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS 1.2+
• Data at rest is encrypted using AES-256
• Passwords are hashed using bcrypt
• API keys are encrypted before storage
• Access to infrastructure is restricted and logged
• Regular security audits and updates

Data Retention

• Account data — Retained while your account is active. Deleted within 30 days of account closure.
• Customer content — Retained while your subscription is active. Deleted within 30 days of subscription cancellation.
• Chat conversations — Retained for 90 days to provide conversation history features, then automatically deleted.
• Usage analytics — Aggregated and anonymized data may be retained indefinitely for service improvement.

Your Rights

You have the right to:

• Access — Request a copy of the data we hold about you
• Correction — Update or correct your account information
• Deletion — Request deletion of your account and associated data
• Export — Download your data in a portable format
• Opt-out — Unsubscribe from marketing communications

To exercise these rights, contact us at privacy@savanto.ai.

California Residents (CCPA)

If you are a California resident, you have additional rights under the CCPA:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

We do not sell your personal information.

European Users (GDPR)

If you are in the European Economic Area, you have rights under the GDPR including:

• Right to access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent

Our legal basis for processing your data is the performance of our contract with you (providing the service) and our legitimate interests in operating and improving the service.

Customer Data Requests via Connected Stores

When Savanto is installed on a Shopify store, WooCommerce site, or any other platform that supports customer privacy webhooks, we act as a data processor on behalf of the merchant (the data controller). Two flows are honored automatically:

• Customer redaction— When the merchant’s platform sends acustomers/redactrequest (e.g. via Shopify’s GDPR webhook), Savanto deletes every indexed conversation thread and durable memory tied to the supplied identifiers (email, phone, or platform customer id) within the merchant’s tenant. Redactions are tracked in an immutable audit log and reconciled against the underlying search-index task IDs to confirm completion.
• Customer data requests — When the platform sends a customers/data_requestwebhook, Savanto records the request, alerts our operations team, and assists the merchant in fulfilling the request within the regulatory deadline (30 days for Shopify-originated requests).
• Shop redaction (uninstall) — When a merchant uninstalls the app, Shopify sends a shop/redactwebhook approximately 48 hours later. On receipt, Savanto permanently purges the merchant’s entire tenant: every indexed conversation thread, durable memory, product / page / blog record, stored API key, and per-shop configuration metafield. This purge is irreversible. The intervening 48-hour window exists so merchants who reinstall promptly do not lose their data.

If you are a shopper and want to exercise these rights, please contact the merchant whose store you interacted with — they will route the request to us through their platform’s standard webhook. You may also email us directly at privacy@savanto.ai if the merchant is unreachable.

Cookies & Local Storage

Essential Cookies (always active)

These cookies are required for the site to function and cannot be disabled:

• Session & authentication — Keeps you logged in and protects against cross-site request forgery.
• cookie_consent — Stores your cookie consent preference (1 year).

Analytics & Advertising Cookies (require consent)

These cookies are only set after you accept cookies via our consent banner. You can change your preference at any time using the “Cookie Settings” link in our footer.

• Google Analytics 4 — Measures site traffic and usage patterns. When consent is declined, GA4 operates in cookieless mode and sends anonymized, modeled data only. Google Privacy Policy

Attribution Cookies

When you arrive via a marketing campaign (e.g., a Google Ad or a link with UTM parameters), we store the campaign details in first-party cookies so we can measure which channels drive signups:

• attr_first — First-touch attribution (30 days). Records the campaign that first brought you to the site.
• attr_last — Last-touch attribution (7 days). Records the most recent campaign interaction.
• attr_gclid — Google Ads click identifier (90 days).

These cookies are first-party, contain no personally identifiable information, and do not send data to third parties on their own. The data they contain is only attached to analytics events that are governed by the consent settings described above.

Savanto Widget on Your Website

The Savanto widget on your website does not set cookies on your visitors' browsers. It uses browser local storage to maintain conversation history during a session and to store a pseudonymous visitor identifier for analytics. This data remains on the visitor's device and can be cleared at any time through their browser settings.

Children's Privacy

Savanto is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through our service. Your continued use of Savanto after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, contact us at:

• Email: privacy@savanto.ai
• Address: San Francisco, CA

For general inquiries, visit our Contact page.