Privacy Policy
Privacy, in plain language.
Last updated 19 October 2026
This policy explains what personal data Ansa collects, why, who we share it with, and the choices you have. It covers our website, dashboard, chat widget and hosted chat pages. Questions? Email privacy@ansa.chat.
- We never use your knowledge or your customers’ conversations to train AI models.
- Each business’s information is kept separate from every other business.
- We don’t sell personal data or use advertising trackers.
- You can delete a source, or your whole account, at any time.
1. Who we are
Ansa is operated by Kunolu Applications Inc. (“Ansa”, “we”, “us”), 36 Benson Avenue, Orangeville, Ontario L9W 6T5, Canada. Ansa lets businesses build an AI customer-support assistant from their own information and offer it to their customers through a chat widget on their website or a shareable chat page.
We handle personal data in two different roles, and this policy covers both.
Where we are the controller
We decide how and why personal data is used for your Ansa account, billing, support emails, and people who visit ansa.chat. For this data we are the “controller”, or the organisation responsible for it under your local law.
Where we act for a business
When a business uses Ansa, the knowledge it adds and the conversations its visitors have with its assistant belong to that business. The business is the controller, and we are its processor (or “service provider”). We process that data only on the business’s instructions and to provide Ansa to it. If you chatted with a business’s assistant, see section 3.
2. What we collect
Account data. Your email address, your name if you give it, your business name, and your password, which is stored only in hashed form by our sign-in provider. If you sign in with Google, we receive your basic Google profile: name, email address and profile picture (see section 6).
Billing data. Your plan, subscription status, billing email and payment history. Card payments are handled by a PCI-compliant payment processor. Ansa never sees or stores your full card number.
Knowledge content. The website pages you ask us to read, the documents you upload, and the text and question-and-answer pairs you add. We store the original files and the text we extract from them. This content can include personal data if you put it there.
Chat conversations. The questions visitors ask an assistant, its answers, which sources it used, any thumbs up or down, the channel (widget, chat page, WhatsApp or Slack) and the time. Visitors don’t need an account. A random identifier stored in the visitor’s browser groups their messages into one conversation. It isn’t linked to their name or email unless they type those into the chat.
WhatsApp messages. If a business connects its WhatsApp number to Ansa, we also process the messages its customers send to that number and the assistant’s replies. This includes the customer’s WhatsApp phone number, which we use only to send the reply. We delete the full number from our working records once a message has been answered, and in any case within 30 days. To link later messages into the same conversation we keep a one-way, keyed code derived from the number, and we show the business only a partly hidden version (for example +234 •••• 5678). We don’t use the customer’s WhatsApp profile name or photo, and we only read text: we don’t store photos, voice notes, locations or files.
Slack messages. If a business adds Ansa to its Slack workspace, we process the messages its team sends to Ansa there (messages that mention Ansa, and direct messages to it) and Ansa’s replies. We don’t receive or read other messages in that Slack workspace. We keep the sender’s Slack user ID and the message in our working records only until it has been answered, and in any case for no longer than 30 days. To link a conversation to its sender we keep only a one-way, keyed code derived from the Slack user ID, and we don’t store Slack names, email addresses or profile photos. The access key Slack issues for the business’s workspace is stored encrypted.
Usage data. Counts of answers and similar measures, used to apply plan limits and show you your usage.
Technical data. IP address, browser type and request details, used to keep the service secure, prevent abuse and enforce rate limits. We use IP addresses briefly for rate limiting and don’t store them with conversations. Our error logs don’t contain message content.
Support emails. What you send us when you get in touch, and our replies.
We don’t ask for sensitive data, such as health information, and we ask businesses not to add it to their knowledge.
3. If you chatted with a business’s assistant
The business whose assistant you used decides what happens to your conversation, and its own privacy notice applies. Ansa processes the conversation on that business’s behalf, to answer you and to let the business review it.
To access, correct or delete your conversation, please contact the business first. If you can’t reach them or need help, email privacy@ansa.chat. We will pass your request to the business and help it respond.
If you messaged a business on WhatsApp, your messages also pass through WhatsApp, which is run by Meta, under the business’s own agreement with Meta and WhatsApp’s own terms and privacy policy.
If you asked Ansa a question in your organisation’s Slack workspace, the business that added Ansa there decides what happens to that conversation. Your messages and Ansa’s replies also pass through Slack, which is run by Salesforce, under the business’s own agreement with Slack.
4. How we use data, and our legal bases
Where we are the controller, we use personal data for the purposes below. Each has a legal basis under data-protection law, such as Article 6 of the GDPR.
- To provide Ansa: creating your account, signing you in, storing your knowledge, answering your customers, showing you conversations and usage, and taking payments. Basis: our contract with you.
- To keep Ansa secure and working: preventing abuse and fraud, rate limiting, and fixing problems. Basis: our legitimate interest in running a safe, reliable service.
- To improve Ansa: using aggregate measures, such as how many questions go unanswered, to make the product better. Basis: our legitimate interests. This never involves training AI models on your content or conversations.
- To talk to you: service and billing messages, replies to support requests, and notice of important changes. Basis: our contract with you and our legitimate interests.
- To meet legal duties: tax and accounting records, and responding to lawful requests. Basis: legal obligation.
- Anything that needs your consent: we will ask first, and you can withdraw consent at any time. Basis: consent.
Where we act for a business, we use its knowledge and its visitors’ conversations only to provide Ansa to that business, following its instructions and our data processing terms.
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 13). We don’t make decisions about people based solely on automated processing that have legal or similarly significant effects on them.
5. AI processing
Ansa never uses your knowledge or your customers’ conversations to train AI models. Not ours, not anyone else’s.
When a visitor asks a question, Ansa finds the most relevant passages in that business’s knowledge and sends the question and those passages to an AI model provider, which writes the answer. Knowledge is also sent to the provider when it’s added, to prepare it for search. Our AI model providers process this data for us under contractual terms that prohibit them from using it to train their models. This AI processing takes place in the European Union.
AI model providers may keep requests for a limited period, as their terms allow, to detect and prevent abuse of their services. They may not use that data for other purposes of their own.
Each business’s knowledge is kept separate. An assistant answers only from its own business’s knowledge and never sees another business’s information. Ansa treats web pages, documents and visitors’ messages as information, never as instructions that can change how an assistant behaves.
AI answers can be wrong. Each business is responsible for reviewing its assistant and for telling visitors they are chatting with AI where the law requires. Ansa assistants identify themselves as AI assistants.
6. Google user data
You can create an Ansa account and sign in with your Google account. When you do:
- What we access. Only your basic Google profile: your name, email address and profile picture. We don’t access your Gmail, Drive, Calendar, contacts or any other Google data.
- How we use it. Only to create your Ansa account, sign you in, and show your name and picture in your account.
- Sharing. We don’t sell Google user data or share it with anyone, except the service providers that run sign-in and host your account for us, and where the law requires.
- No advertising, no AI training. We never use Google user data for advertising or to train AI models.
- Disconnecting and deleting. You can remove Ansa’s access at any time in your Google Account, under “Third-party apps and services”. To delete the data we received, delete your workspace in Settings, or email privacy@ansa.chat.
Ansa’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
8. International transfers
Our main hosting, databases and AI processing are in the European Union. Kunolu Applications Inc. is based in Canada, and some of our service providers, including network security and email providers, may process data in other countries, including the United States. WhatsApp messages are handled by Meta, which may process them outside the EEA, including in the United States, under its own transfer safeguards. The same applies to Slack messages, which are handled by Slack.
Where personal data is transferred outside the European Economic Area, the UK or Switzerland, we rely on safeguards such as adequacy decisions (the European Commission recognises Canada as providing adequate protection for commercial organisations) and the European Commission’s Standard Contractual Clauses, with the UK Addendum where relevant. Where other laws, such as those of Nigeria, Kenya or South Africa, restrict transfers, we rely on the equivalent safeguards those laws recognise. You can ask us for more information about these safeguards.
9. How long we keep data
- Account and workspace data: while your account is open. When you delete your workspace in Settings, we immediately delete your account, assistant, settings, knowledge, uploaded files, conversations and usage records.
- Knowledge: until you delete the source or your account. Deleting a source removes its text and any uploaded file.
- Chat conversations: until the business deletes its account, or asks us to delete specific conversations.
- WhatsApp working records (the sender’s number and message, used to send a reply): deleted once answered, and automatically within 30 days.
- Slack working records (the sender’s Slack user ID and message, used to send a reply): deleted once answered, and automatically within 30 days. The Slack connection itself is deleted when the business disconnects Slack, removes Ansa in Slack, or deletes the assistant or its account.
- Billing records: as long as tax and accounting laws require, generally up to seven years. Our payment processor also keeps records under its own legal duties.
- Technical logs: up to 30 days, unless we need them longer to investigate a specific security incident.
- Support emails: up to 24 months after the conversation ends, unless we need them for a legal claim.
- Visitor identifier: stays in the visitor’s browser until they clear their browser storage.
Deleted data may remain for a short time in our providers’ backup and recovery systems, normally no more than 30 days, before it is permanently removed.
11. Security
We protect personal data with technical and organisational measures suited to the risk, including encryption in transit and at rest, access controls that keep each business’s data separate, limited staff access, and monitoring for abuse. No service can be perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
12. Children
Ansa is a service for businesses and is not directed at children under 16. We don’t knowingly collect their personal data. If you believe a child has given us personal data, email privacy@ansa.chat and we will delete it.
13. Your rights
Depending on where you live, you have some or all of these rights over your personal data:
- to know what we hold and get a copy, including in a portable format;
- to have inaccurate data corrected;
- to have data deleted;
- to object to, or ask us to restrict, how we use it;
- to withdraw consent where we rely on consent;
- not to be treated differently for using these rights.
How to use them. Email privacy@ansa.chat. You can also delete your knowledge, or your whole workspace, yourself in the dashboard. We may need to confirm your identity first. We reply within one month, or sooner if your local law requires. Where your law allows, you can use an authorised agent. If your request is about a conversation with a business’s assistant, see section 3.
Complaints. Please tell us first so we can try to put it right. You also have the right to complain to a data-protection authority: in the EEA, the supervisory authority where you live or work; in the UK, the Information Commissioner’s Office; in Canada, the Office of the Privacy Commissioner of Canada; in Nigeria, the Nigeria Data Protection Commission; in Kenya, the Office of the Data Protection Commissioner; and in South Africa, the Information Regulator.
Regional notes
EEA, UK and Switzerland (GDPR and UK GDPR). Our legal bases are listed in section 4. You can object at any time to processing based on legitimate interests.
California (CCPA/CPRA). In the last 12 months we collected the categories of personal information described in section 2 (identifiers, commercial information, internet activity and the content of communications) for the purposes in section 4. We do not sell or share personal information, and we don’t use sensitive personal information to infer characteristics about you. You have the rights to know, delete and correct, and to non-discrimination.
Canada (PIPEDA and provincial laws). You can access and correct your personal information and withdraw consent, subject to legal and contractual limits. Our Privacy Officer is accountable for our compliance and can be reached at privacy@ansa.chat.
Nigeria (NDPA 2023), Kenya (Data Protection Act 2019) and South Africa (POPIA). You have the rights described above, including to object to processing and to complain to your national regulator.
14. Changes to this policy
We will update this page when our practices change, along with the “Last updated” date. If a change is significant, we will email account holders before it takes effect.
15. Contact us
Privacy questions and requests: privacy@ansa.chat. Anything else: hello@ansa.chat.
Kunolu Applications Inc., 36 Benson Avenue, Orangeville, Ontario L9W 6T5, Canada.
See also our Terms of Service.