Privacy Policy & Legal Notice

AI Web GPT is operated by Hera Corporation KK (“we”, “us”). This policy explains what we collect, why we collect it, how we protect it, and how to have it deleted.

It covers two groups of people. Customers create an account and connect their website and documents so we can build an AI agent for them. Visitors chat with that agent on a customer's website. Google user data reaches us only through a customer's own Google account, and is documented in detail in the sections below.

• Account information — your name and email address, and for paid plans the billing details handled by our payment processor. We never see or store full card numbers.
• Website content — the pages we crawl from the website you ask us to index, so your agent can answer questions about it.
• Documents you provide — files you upload directly, and files you choose to import from Google Drive.
• Conversations — the questions visitors ask your agent and the answers it gives, so that you can review them in your dashboard and we can diagnose poor answers.
• Technical data — IP address, browser type and timestamps, kept for security, abuse prevention and fault diagnosis.

When you connect Google Drive we request only the drive.file scope, together with openid and email. Precisely what that permits:

• Your Google account email address, from the openid and email scopes. We use it to show you which Google account is connected, so that someone with both a personal and a work account can tell which one they linked.
• The files you individually select in Google's own file picker. For each one we read its file ID, name, MIME type and last-modified time, and we read its contents. Google Docs, Sheets and Slides hold no downloadable bytes, so we ask Google to export them as text or Markdown; a Sheet with several tabs exports only the first, which we mark in your dashboard.

The drive.file scope is deliberately narrow. It gives us no ability to list, browse or search your Drive, and no access to any file you have not explicitly chosen. Files you have chosen remain readable to us afterwards so that Resync can pick up your later edits; that is the only reason the grant persists.

Only to build and maintain the AI agent belonging to your own account. In concrete terms: the text of each file you import is stored, split into passages, converted into numerical embeddings, and used to find the relevant passages when a visitor to your website asks a question. Those passages are then used to compose the answer.

We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalised or general-purpose AI or machine learning models. No person at Hera Corporation KK reads your Google Drive content except where you have explicitly asked us to — to investigate a support request you raised, for instance — where it is necessary for security purposes such as investigating abuse, or where the law requires it.

We do not sell Google user data, and we do not share it with third parties for their own purposes. It is shared only with the infrastructure providers that run the service on our behalf, under terms permitting them to use it only to provide that service:

• Google Cloud Platform and Firebase (Google LLC) — Cloud Storage holds the imported documents, Firestore holds their embeddings and the record of which files you imported, and Cloud Run and Firebase App Hosting run the application itself.
• The Google Gemini API (Google LLC) — generates the embeddings used to retrieve passages, and composes the answer from the passages retrieved for a given question.

We may also disclose data where the law requires it, or where it is necessary to protect our rights or the safety of users. Were our business ever transferred, we would give notice before any data became subject to a different privacy policy.

Data is transmitted over TLS and encrypted at rest by Google Cloud. Imported documents are held in Google Cloud Storage and their embeddings in Firestore, partitioned by the website domain on your account, so that one customer's content is never used to answer another customer's visitors.

The refresh token that lets us re-read your files is held in a Firestore collection whose security rules deny access to every client application, including your own dashboard. It is readable only by our server-side code, and no endpoint returns it to a browser under any circumstances. Access to production systems is limited to the personnel who need it to operate the service.

We keep imported content only for as long as you keep it in your knowledge base. You can remove it at any time:

• Disconnect Google Drive in your dashboard. We ask Google to revoke the token, delete it from our systems, and delete our record of which files were imported. Our access to your Drive ends at that moment.
• Delete an individual document on the Files page. Both the stored document and the embeddings derived from it are deleted.
• Delete your account, or write to us at support@aiwebgpt.com, and we delete that account's documents, embeddings and stored content.

You can review and revoke our access yourself at any time from your Google Account, at https://myaccount.google.com/permissions. Deletion requests sent to support@aiwebgpt.com are actioned within 30 days, and any residual copies in routine backups are removed as those backups age out of rotation.

Step-by-step deletion instructions, and what each option removes, are on our Data Deletion Instructions page.

AI Web GPT's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use cookies and browser storage to keep you signed in and to remember your dashboard preferences. The chat widget keeps a visitor's recent conversation in that visitor's own browser so it survives a page reload, and clears it after an hour of inactivity. We do not use advertising cookies.

You may access, correct, export or delete your personal information by writing to support@aiwebgpt.com. Depending on where you live, you may also have the right to object to or restrict processing, or to complain to your data protection authority.

We are based in Japan and operate on Google Cloud infrastructure. Where information is transferred internationally, we rely on the safeguards our infrastructure providers have in place for those transfers.

By accessing and using this website, you agree to comply with our Terms of Service. Hera Corporation KK reserves the right to update or modify these terms without prior notice.

All content on this website, including text, images, graphics, and other materials, is the property of Hera Corporation KK and is protected by intellectual property laws. Unauthorized use or reproduction of any content is strictly prohibited.

This website is governed by the laws of Japan. Any legal actions or disputes arising from the use of this website shall be resolved in accordance with Japanese law.

This website is operated by Hera Corporation KK. The content on this site is provided for general informational purposes only. It does not constitute legal, financial, or professional advice. Hera Corporation KK is not liable for any reliance placed on the information provided on this website.

For any legal inquiries or concerns, please contact us at:

Hera Corporation KK reserves the right to update or modify this legal notice at any time. Please check this page periodically for any changes.