Privacy Policy

Who we are

The controller of the personal information described in this policy is Faizatech, a sole proprietorship registered in Bangladesh.

Registered address: Mirpur DOHS, Dhaka 1216, Bangladesh

Information We Collect

Personal information: When you contact us for support, purchase a subscription, subscribe to updates, or otherwise engage with Faizatech, we may collect personal information such as your name, email address, company name, product context, and relevant URLs. We use this information to respond to you, provide product access, and manage our relationship with you.

Usage data: We may automatically collect certain information about your usage of our website, such as IP address, device information, browser type, referring pages, and operating system. This information is used to analyze trends, administer the site, improve performance and security, and gather demographic information in aggregate.

Communications: If you email us or use contact forms, we retain the content of those messages and our responses as needed to provide support and improve our products.

How We Use Your Information

• Product delivery: To provide, operate, and improve our Webflow applications, licensing, and related documentation.
• Account and inquiries: To respond to questions, send administrative information, and manage subscriptions, billing, and support requests.
• Improve user experience: To understand how our site is used and to optimize content, performance, and accessibility.
• Legal compliance: To comply with applicable law, enforce our agreements, and protect rights, safety, and security.
• Marketing: With your explicit consent where required, we may send updates about Faizatech. You can opt out at any time using the unsubscribe link or by contacting us.

Cookies and Tracking

We may use cookies and similar technologies to enhance your browsing experience, remember preferences, measure traffic, and collect analytics. You can control cookies through your browser settings. Where required by law, we will obtain consent before using non-essential cookies.

Sharing Your Information

Third-party service providers: We may share personal information with trusted vendors who assist us in hosting, analytics, email delivery, payments, customer support, or other operational functions. These providers are authorized to use your information only as necessary to perform services for us and are subject to appropriate confidentiality and security obligations.

Merchant of record: Our applications are sold through Paddle, our external merchant of record, which is the seller of record for your order. When you buy from us, Paddle collects your billing details and payment information directly and processes them under its own privacy policy. We receive order and subscription details—such as your name, email address, country, plan, and order status—so we can provision your license, provide support, and handle refunds. We never receive your full card details.

Legal requirements: We may disclose personal information if required by law or in response to valid legal requests, such as subpoenas or court orders, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers: If Faizatech is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

AI Chatbot: Data Processed Inside the App

Our AI Chatbot application for Webflow processes content belonging to the site owner who installs it, and questions typed by visitors to that site. For this data the site owner is the controller and Faizatech is the processor: the owner chooses what content is trained and is responsible for telling their own visitors that an AI assistant is in use.

What the application processes

• Published page text, fetched over ordinary HTTP from the site owner's own published site, and only for the pages they select.
• Text extracted from files the site owner uploads (PDF, DOCX, CSV, HTML, MD, TXT). The original file is not retained.
• Questions typed by visitors into the chat widget. This is free text, so a visitor may enter personal information into it.
• A random conversation identifier. Our server creates it with the first answer, and the widget keeps it in the visitor's own browser. It carries no identity. It lets the visitor continue the same conversation, and it expires 48 hours after the last answer.
• A thumbs up or thumbs down that a visitor gives to an answer. We store only the vote, the answer it is about, the conversation it belongs to, the site, and the time. We do not store a comment, an IP address or a browser identifier with a vote.
• For each question and answer, we store the text, the time, the site, the conversation identifier, whether the answer came from the site's own content, and the links shown with the answer. We do not store the visitor's IP address, browser identifier or page address with a message.
• The identity of the person who installs the app, received from Webflow at sign-in, so that one site owner cannot reach another's data.

The application does not read Webflow CMS collections, forms, ecommerce data or site users; those permissions are not requested. It performs no advertising, analytics, tracking or fingerprinting on published sites, and we do not sell or share customer or visitor data.

Processors who receive this data

• Cloudflare Workers AI and Cloudflare AI Gateway: passages of the site owner's own content at training time, and a visitor's question together with the retrieved passages and recent turns of that conversation when generating an answer. Each call is stateless and nothing is stored with the provider by the application.
• OpenAI: the same data, and only as a fallback when Cloudflare is unavailable.
• Cloudflare R2: the extracted text of each trained page or file, so a source can be retrained without fetching or uploading it again.
• Railway: the database that holds embeddings, content metadata, conversation transcripts, answer votes and usage records.
• Our billing service: the site identifier and, for each AI call, its provider cost, model name and token counts. No question or answer text, no visitor data and no card details are sent.

Who can read stored conversations

The site owner can read the conversations and votes that we store for their site. They see them on the Conversations screen inside the app in Webflow. To open that screen, a person must sign in to the app for that site through Webflow, and the site must have an active license. The screen shows only the conversations that are not yet deleted (see "Retention and deletion").

No public page or public request returns a stored conversation. The chat widget does not download a conversation from our server.

Storage in the visitor's browser

The chat widget sets no cookies. It keeps two items in the local storage of the visitor's browser, for that site only:

• the conversation identifier, which expires 48 hours after the last answer;
• a copy of the recent conversation (at most 30 messages) and any votes the visitor gave, so that the conversation is still visible after a page reload. Each message in this copy expires 48 hours after it was written.

The widget does not show or use an expired item, and it deletes the item from the browser the next time it reads it. The "Start a new chat" button in the chat window deletes both items immediately. The widget sends each question to our server once, when the visitor sends it. It does not upload the browser copy.

The widget also keeps one flag in session storage when the visitor closes the greeting bubble. The flag contains no identifier, and the browser deletes it when the visitor closes the tab.

Retention and deletion

• We delete each visitor question and each answer 48 hours after it was written. An hourly job does the deletion, so a message can stay up to one hour longer.
• We delete each vote when we delete the answer it is about, and in any case 48 hours after the vote was given.
• Trained content, embeddings and stored text stay until the site owner deletes the source or disconnects the site.
• The site owner can disconnect a site from the Privacy screen inside the app. Disconnecting deletes everything we hold for that site: trained pages and files, the content behind them, embeddings, stored conversations, votes, usage records, credit records and settings. It also removes the chatbot from the Webflow site, revokes our access to the Webflow account, and releases the license. Use this control for an erasure request.
• Webflow does not tell us when an owner uninstalls the app. When we find that Webflow no longer accepts our access to a site, we record the date. If the owner does not connect the site again within 30 days, we delete everything we hold for that site, the same as a disconnect. We cannot remove the chatbot script from the published site without access, so the owner must remove it in Webflow.

Multistep Form: Data Processed Inside the App

Our Multistep Form application for Webflow turns a form on the site owner's Webflow site into a multi-step form. When the owner sets a form to store its submissions with Multistep Form, the application processes what visitors enter into that form. For that data the site owner is the controller and Faizatech is the processor: the owner decides what the form asks and is responsible for telling their own visitors how their answers are used.

What the application processes

• The identity of the person who installs the app (their Webflow account email and name), received from Webflow at sign-in, and an encrypted Webflow access token, so that one site owner cannot reach another's data.
• The site's name, its license status and the license key used to activate it, stored encrypted.
• Saved form configurations, including any webhook URLs the site owner adds.
• For forms set to Multistep Form submissions only: the values visitors submit, form variables (which can include URL query parameters) and, for file fields, only the file name, size and type. File contents are never uploaded.
• Password, one-time-code and payment-card fields are never collected. They are recognised by field type, autocomplete and name, such as card number, CVV or card expiry.
• CAPTCHA tokens (reCAPTCHA, hCaptcha, Cloudflare Turnstile) are never collected or stored.

For forms left in Webflow submit mode, submissions go to Webflow and the application never sees them. For forms set to Multistep Form submissions, a submission the application cannot take (our servers are unreachable or failing, or the license has lapsed) goes through Webflow's own form submit instead, so Webflow receives it. The application does not read Webflow CMS collections, Webflow form submissions, ecommerce data or site users; those permissions are not requested. It performs no advertising, analytics, tracking or fingerprinting on published sites, and we do not sell or share customer or visitor data.

Processors and recipients

• Railway: the database holding form configurations, stored submissions and account records.
• Cloudflare R2: serves the form script the site loads. The script sends no personal data there.
• Webhook URLs the site owner adds: submissions and webhook-action variables, sent from our servers and signed so the owner can verify them, only for forms set to Multistep Form submissions. Visitors' browsers never call those URLs.
• Our licensing service: the site identifier and license key, to check the license. License payments are handled by Paddle.

Storage in visitors' browsers

The form script sets no cookies. When the site owner turns on "Save progress", a visitor's answers are kept in that browser's session storage until the form is submitted or the tab is closed, so the visitor can continue where they left off. Password and payment-card fields and CAPTCHA tokens are never saved there.

Retention and deletion

• Stored submissions are deleted automatically 90 days after they are received. The site owner can delete one submission, or all of a form's submissions, sooner in the app's Data tab; deleting a form also deletes its submissions.
• A webhook delivery that keeps failing is kept for at most one hour after its last attempt, then deleted. Deleting a form, or disconnecting the site, also removes its deliveries still waiting to be sent.
• Disconnecting a site, from the Privacy & data screen inside the application, removes the form script from the Webflow site, erases the forms, submissions and settings held for that site, releases the license, and revokes our access to the Webflow account unless another of the owner's sites that uses Multistep Form still needs it. This is the control to use for an erasure request.
• Webflow does not tell us when an owner uninstalls the app. The application checks once a day whether its Webflow access still works; once it does not, and the site is not reconnected within 30 days, everything held for the site is deleted automatically. Webflow does not remove the form script on uninstall, so the application shows the owner how to remove it from the site's custom code.

Data Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission over the Internet is completely secure; we encourage you to use strong passwords and protect your account credentials.

Data retention: We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer period is required or permitted by law. When no longer needed, we delete or anonymize information in accordance with our retention practices.

Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information, or to object to certain processing. To exercise these rights, contact us using the details below. We will respond in line with applicable law.

Children's Privacy

Our website and products are not directed to children under 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will take steps to delete it.

International Transfers

If you access our products from outside the country where Faizatech operates, your information may be transferred to and processed in countries that may have different data protection laws. We take steps designed to ensure appropriate safeguards where required.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The revised version will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at contact@faizatech.com or via our Contact page.