Version v1.2 — under legal review — currently under legal review. This document is not yet final.

Privacy Policy

Last updated:

Jump to section ▾

This Privacy Policy describes how The First IT LLC, an Illinois limited liability company doing business as TaiChu Web AI (“we”, “us”, or “our”), collects, uses, and shares personal information. We aim to be specific about what we collect and why, and to keep that scope as small as the Service allows.

#Who this applies to

This policy applies to three groups of people, and we try to be clear about which is which throughout.

  • Marketing-site visitors. People who visit taichuweb.ai to read about the product. We collect very little here — see “Cookies and tracking” below.
  • Customers. Account holders who use the TaiChu Web AI service at chat.taichuweb.ai, admin.taichuweb.ai, and related subdomains to manage a website.
  • Visitors to customer websites. People who interact with the optional chatbot widget that customers may embed on their own sites. For those interactions, we act as a processor on behalf of the customer, who is the controller. The customer’s own privacy policy governs the relationship with their visitors; this document covers only what we do as their processor.

#What we collect

We collect only what we need to operate the Service. Categories below describe data tied to Customers unless noted otherwise.

  • Account data. Email address, name, and account preferences. If you subscribe to a paid tier, billing information is collected and held by Stripe; we receive metadata such as the last four digits of your card, billing country, and subscription status, but we do not store full card numbers.
  • Service usage data. Records of which pages you visited, when, what edits you made, and AI token usage. These are stored as usage_logs in our database and retained for 90 days.
  • Customer site content. The websites you bring to manage. We store the source code and assets in a per-customer GitHub repository under our control on your behalf. This backup is retained until you delete it.
  • Chat conversations with the AI. Text of the conversations between you and the AI assistant, retained until you delete the conversation or close your account.
  • Visitor chatbot conversations. When customers enable the widget, the conversations between their site visitors and the widget. We process these as a processor for the customer; retention follows the customer’s settings.
  • Third-party analytics integrations (optional). When you connect your Google Analytics 4 or Google Search Console account, we use OAuth to access your own data on your behalf. For Google Analytics: if you do not yet have a GA4 property, we create and configure one GA4 property and web data stream for you so you can start collecting analytics (analytics.edit); otherwise we read your existing metrics for display in our dashboard (analytics.readonly). For Search Console: we read, and where you ask us to, manage your verified sites’ data (webmasters.readonly, webmasters). We act only on the account and properties you connect, do not access other Google products, and do not share this data with third parties. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from Settings, which revokes our access and deletes the stored OAuth tokens.
  • Marketing-site analytics. Cloudflare Web Analytics on taichuweb.ai. This is cookie-less and IP-anonymized, and tells us aggregate page-view counts, not individual visitor identities.

#How we use it

In short: to provide the Service, bill for it, support you, prevent abuse, and improve it within the limits below.

Specifically, we use personal information to:

  • Provide and maintain the Service, including authenticating you, generating AI edits, deploying changes, and storing backups
  • Bill for Subscriptions through Stripe and send receipts
  • Send transactional email (account verification, password reset, billing notices, security alerts) through Resend
  • Provide customer support when you contact us
  • Detect, investigate, and prevent abuse, fraud, and violations of the Terms of Service
  • Improve the Service (debugging, performance, feature development), using the smallest scope of data needed

Heads up: We do not use your chat content or site content to train AI models. Customer conversations are sent to Anthropic for real-time inference. Anthropic retains API inputs and outputs for up to 30 days for trust and safety monitoring, and does not use them to train their models, per Anthropic’s commercial terms.

#Subprocessors

We use the following subprocessors to operate the Service. Each is bound by a data-processing agreement with us.

  • Cloudflare, Inc. — hosting, CDN, Pages deployments, Workers runtime, R2 storage, Web Analytics. Data: account data, site content, usage logs, traffic metadata. Privacy Policy
  • Supabase, Inc. — authentication, PostgreSQL database, Row-Level Security. Data: account data, chat history, usage logs. Privacy Policy
  • Stripe, Inc. — payment processing. Data: name, email, billing address, payment-method details (held by Stripe; not by us). Privacy Policy
  • Anthropic, PBC — AI model inference (Claude API). Data: chat messages and relevant site context, processed real-time per zero-retention agreement. Privacy Policy
  • Resend, Inc. — transactional email delivery. Data: email address, message content. Privacy Policy
  • GitHub, Inc. — per-customer site source code backups. Data: site content, commit metadata. Privacy Policy
  • Upstash, Inc. — Redis for rate limiting and chat session state. Data: ephemeral session keys, request metadata. Privacy Policy
  • Google LLC — Google Analytics Data API, Google Analytics Admin API, Search Console API, and OAuth (when you connect your GA4 or GSC account). Data: your own GA4/GSC data, accessed on your behalf; for Google Analytics we may also create and configure a GA4 property for you if you have none. Privacy Policy
  • Amazon Web Services, Inc. — AWS Bedrock, used as the primary inference path for Claude models. Data: chat messages and relevant site context. Privacy Policy

We will update this list when we add or change subprocessors and provide reasonable notice for material changes.

#Cookies and tracking

We try to keep tracking minimal.

  • Marketing site (taichuweb.ai). Cloudflare Web Analytics. No cookies. No third-party advertising or retargeting trackers.
  • Application (chat.taichuweb.ai, admin.taichuweb.ai). Necessary session cookies set by Supabase for authentication. These are first-party, HttpOnly, and Secure.
  • No advertising cookies. We do not run ads, build advertising profiles, or share data with ad networks.
  • Customer websites (your visitors). When you (the Customer) enable optional Google Analytics 4 on your TaiChu-managed site, GA4 cookies may be set on your visitors’ devices. You, as the operator of your website, are the controller for those cookies; we provide the integration as a processor on your behalf. Cloudflare Web Analytics is enabled by default on all TaiChu-managed sites and uses no cookies.

#Data retention

In summary: usage logs 90 days, backups and chat until you delete them, account data for 30 days after closure.

  • Usage logs: 90 days from creation, then deleted on a rolling basis.
  • Customer site backups (GitHub): retained until you delete the repository or close your account.
  • Chat history: retained until you delete the conversation or close your account.
  • Account data: retained while your account is active; deleted within 30 days after account closure, subject to a reasonable extension for backups, log integrity, fraud prevention, and legal-retention obligations. Note: certain billing and tax records (invoices, payment confirmations) are retained for the period required by applicable tax and financial-record-keeping law (typically 7 years in the United States).

Heads up: When you close your account, we delete your account data within 30 days, except for limited backup or compliance retention required by law.

#Your rights

Depending on where you live, you have rights over your personal information. We honor the following rights for all Customers, regardless of jurisdiction:

  • Access — request a copy of the personal information we hold about you.
  • Correction — ask us to correct inaccurate information.
  • Deletion — ask us to delete your account and associated data.
  • Portability — request a structured JSON export of your account data, chat history, and site content.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

EEA, UK, and Swiss residents. You have additional rights under the GDPR and equivalent laws, including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. Our legal bases for processing are contract performance, legitimate interests (security, abuse prevention, product improvement), and consent where required.

California residents. Under the CCPA/CPRA, you have the right to know what personal information we collect, the right to delete, the right to correct, and the right to opt out of “sale” or “sharing” of personal information. We do not sell or share personal information for cross-context behavioral advertising.

#Children’s privacy

The Service is not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. By creating an account, you confirm that you are at least 16 years old. If we become aware that an account has been created by a person under 16, we will delete the account and any associated data.

#International data transfers

We operate primarily in the United States and use subprocessors located in the United States and the European Union. When personal information is transferred from the EEA, UK, or Switzerland to a country that has not been deemed adequate by the European Commission, we rely on appropriate safeguards such as Standard Contractual Clauses and supplementary measures where necessary.

#Security

We maintain reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include:

  • TLS encryption for data in transit
  • Encryption at rest where supported by our infrastructure
  • Row-Level Security in our database to enforce per-customer isolation
  • Restricted production access on a need-to-know basis with multi-factor authentication

No security program is perfect, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and any required authorities in accordance with applicable law.

#Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email and through a banner in the dashboard at least 14 days before the changes take effect, unless a shorter period is required by law. The “Last updated” date at the top of this page reflects the most recent version.

#Contact

For privacy questions, data-subject requests, or complaints, contact us at:

The First IT LLC (d/b/a TaiChu Web AI) Email: [email protected]