AIWAP Privacy Policy

Last updated: 22 August 2026

AIWAP is an AI chat agent that businesses embed on their own website. This policy explains what AIWAP collects, why, and who it is shared with. It covers the AIWAP product at aiwap.lbclouds.com. For the LB Clouds website itself, see the LB Clouds privacy policy.

AIWAP is operated by LBCLOUDS LLC (Delaware, USA), trading as LB Clouds ("we", "us"). Contact: [email protected].

Two kinds of people, two different roles

This matters, because our obligations differ:

Our customers — the businesses who sign up for AIWAP. For their account data, we are the controller: we decide what to collect and why.
Their website visitors — the people who chat with a customer's AIWAP agent. For those conversations, the customer is the controller and we are their processor: we handle the data on their instructions, to run the service. If you are a visitor with a question about your data, contact the business whose site you used; they can reach us and we will help.

What we collect

Data	Why
Account: business name, email address, website URL, and any note you add at signup	To create and support your account, and to contact you about it
Email confirmation: a single-use token, stored only as an irreversible hash, and the date you confirmed your address	To check that the address given at signup can actually be reached before the account is activated. The token expires after 48 hours
Attribution: the referring page and any campaign tags present when you signed up	To understand which of our own marketing brought you to us. Recorded once at signup and not updated afterwards
Knowledge base: the pages, prices, hours and services you give the agent	So the agent can answer as your business rather than generically
Conversations: the messages exchanged between a visitor and the agent, and any name, email or phone number a visitor chooses to provide	To deliver the reply, to show the conversation in your inbox, and to let your team take over
Technical: a session identifier, IP address and derived country, and the referring page	To keep one visitor's conversation together across messages, to apply rate limits, and to prevent abuse
Bookings, where enabled: the appointment time and the contact details given to make it	To create and remind you of the appointment

We do not use conversation content to train any AI model of our own, and we do not sell personal data or share it for advertising.

Sub-processors

Running AIWAP means some data passes through other providers:

Fly.io — application hosting and the database that stores the above.
DeepInfra and, where a customer selects it, Anthropic — the AI models that generate replies. Message content is sent to whichever provider the customer's agent is configured to use, in order to produce the answer.
Meta Platforms — only where a customer has added the optional WhatsApp channel, in which case WhatsApp messages are delivered through Meta's Cloud API under Meta's own terms.
Microsoft — delivery of transactional email such as account notices and appointment reminders.
Netlify and Cloudflare — hosting and protection for our marketing pages.

We use Meta for advertising measurement in two separate ways, and it is worth being precise about which does what.

A signup event, sent from our server. It is sent when you confirm your email address, not when the form is submitted, so an account that is never confirmed is never reported. It contains a hashed (irreversible) form of the email address plus the IP address and browser user agent, and identifies that a signup happened — never conversation content.
Meta’s pixel, in your browser, on our signup pages only. It records that the page was viewed, so that we can tell how many people who clicked one of our ads actually reached the page. It sets Meta cookies and shares your IP address and browser user agent with Meta, who may use them to show you our ads later. It runs on aiwap.lbclouds.com signup and account-activation pages — not on the customer chat widget, and not anywhere your conversations are handled.

The pixel does not report signups. That event stays server-side, for the reason given above. If you would rather not be measured this way, browser settings or tracker-blocking extensions that block connect.facebook.net will stop the pixel loading, and nothing about creating or using an AIWAP account depends on it.

Where data is held

Application data is hosted on Fly.io infrastructure and may be processed in the United States and other countries where our providers operate. By using AIWAP you accept that your data may be transferred outside your own country.

How long we keep it

Account data — for as long as the account exists.
Conversations, contacts and bookings — retained while the account is active, so the customer's inbox and history remain usable.
Closed accounts — an account that is archived or suspended keeps its data so it can be restored and for our business records. A customer can ask us to delete it.

Security

Traffic is encrypted in transit. Each customer's data is separated by tenant, and the chat widget will only respond to the website origins that customer has authorised. Access to production data is limited to the people who operate the service. No system is perfectly secure, and we do not claim otherwise.

Your rights

You can ask us to access, correct, export or delete the personal information we hold about you. Email [email protected] and we will respond within 30 days. If you are a website visitor rather than an AIWAP customer, please contact the business whose website you were using — the data is theirs, and we act on their instructions.

Children

AIWAP is a product sold to businesses and is not directed at children under 16. We do not knowingly collect their personal information.

Changes

We may update this policy. The date at the top reflects the latest revision, and material changes will be notified to customers by email.

Contact

Questions about this policy? Email [email protected].