Privacy Policy

In plain English: This policy explains what personal data Ethere collects, why Ethere collects it, how Ethere uses and protects it, and the rights you have over it. Ethere only collects what is needed to run the Service, does not sell your data, and you can contact Ethere at any time to access, correct, or delete your data. If you are a website visitor using a widget on a customer's site, that customer (the site owner) is responsible for your data, and you should contact them first.

1. Data Controller

The data controller for the processing of personal data described in this Privacy Policy is Ethere, operated by Ethere MB, a small partnership (mažoji bendrija) registered in the Republic of Lithuania, with its registered office at Girulių g. 10, LT-12112 Vilnius, Lithuania, and company registration number 308129929. Ethere MB is not registered for VAT. For any privacy-related questions or requests, contact Ethere at privacy@ethere.cloud. Ethere has not appointed a Data Protection Officer (DPO) because, based on its current processing activities and its assessment under Article 37 of the GDPR, Ethere does not consider that appointment to be mandatory; data-protection queries should be directed to privacy@ethere.cloud. This policy describes how Ethere collects, uses, stores, shares, and protects personal data in connection with the Service, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the national implementing laws of the European Union and of Lithuania, together with, where applicable, the data-protection laws of other jurisdictions to which Ethere is subject.

2. Controller and Processor Roles

Ethere acts in different roles depending on the personal data involved. For the account, billing, and technical data described in this policy that relates to you as a customer, Ethere is the data controller. However, where Ethere processes personal data through the widget solely on your documented instructions and on your behalf, you are the data controller and Ethere acts as a data processor, in accordance with Article 28 of the GDPR and the Data Processing Agreement published at ethere.cloud/dpa. The role follows from who determines the purposes and means of that processing, not from whose website the widget runs on. As a result, End Users should contact you (the site owner) to exercise their data-protection rights in respect of data collected through the widget on your website. You are responsible for providing your End Users with the required privacy notices and for obtaining any necessary consents, as set out in the Terms of Service.

3. Data Ethere Collects

Ethere collects the following categories of personal data: (a) account information, such as your name, email address, and account credentials required for registration and authentication; (b) billing and subscription information, such as your plan, payment status, and, where provided, transaction references (Ethere does not store your full card details); (c) content you upload to the Service, including knowledge-base entries, documents, and widget configuration; (d) chat and conversation data exchanged between your visitors and the widget; (e) technical data, such as IP address, browser type, device information, and how you interact with the Service. For the widget, this includes the page path on which a conversation happens and the referrer host — never the query string or full URL — and first-party engagement analytics: a randomly generated visitor identifier (a single token, not a compiled profile) and the events "widget loaded", "widget opened", "teaser clicked", and "suggested question clicked". The identifier does not directly identify the visitor by name or contact details, but it may constitute personal data where it can be associated with information relating to an identifiable individual: it is a single random token, not a compiled profile. These analytics are collected without cookies, without fingerprinting, and without any attempt to identify a visitor by name, are not combined with other identifiers, and are automatically deleted after 30 days; (f) records of any consent you give; (g) leads — where you enable lead capture on your widget, the widget collects the visitor's name, email address, and their question, which are stored in the Service for follow-up; and (h) security and operational data, such as authentication and security events (for example, IP address, user agent, and event metadata) and rate-limiting data, which Ethere uses to protect the Service against abuse; and (i) messages you send through the public contact form — your name, email address, and the message itself — which Ethere uses to answer your enquiry. Ethere collects personal data directly from you when you provide it and from the administrators of the organization you belong to, automatically when you use the Service, from your website visitors through the widget on your behalf, from its payment provider (subscription and payment status), and from the e-commerce platform you connect (for example, products, orders, and customers).

4. Legal Bases for Processing

Ethere is processing personal data on the following legal bases under Article 6 of the GDPR: (a) performance of a contract — to provide the Service you requested and to fulfil Ethere's obligations under the Terms of Service; (b) compliance with a legal obligation — to meet statutory obligations such as tax and record-keeping; (c) legitimate interests — to operate, secure, and improve the Service, prevent fraud, and respond to customer support, provided Ethere's interests are not overridden by your interests and fundamental rights; and (d) consent — where you have given informed and specific consent (for example, for any optional marketing communications), which you may withdraw at any time; withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and the only consent-based processing Ethere carries out today is optional marketing (which Ethere does not currently send) and any non-essential cookie technology (none is currently set, as the Cookie Policy explains). In outline: account creation, authentication, and the operation of the AI service rely on performance of the contract; billing and tax records rely on the contract together with a legal obligation; security logging, fraud prevention, and product analytics rely on Ethere's legitimate interests; optional marketing relies on consent; and personal data processed through the widget on a customer's website is processed on that customer's documented instructions where Ethere acts as processor. Where Ethere relies on consent, Ethere will seek your explicit consent in advance and keep records of it in accordance with the Cookie Policy. The provision of your personal data is a contractual requirement necessary to enter into and perform the contract (the Terms of Service); if you do not provide the required personal data, Ethere may be unable to provide the Service to you.

5. Purposes of Processing

Ethere processes personal data for the following purposes: to provide, operate, and maintain the Service; to authenticate your account and keep you signed in; to process payments and manage your subscription; to deliver important service updates and respond to support requests; to measure widget engagement in aggregate (for example, how many visitors open the assistant, without identifying them); to improve, secure, and protect the Service and its users — that is, to fix defects, keep the Service available and reliable, refine prompts and retrieval quality, and detect abuse; to send marketing communications only where you have separately opted in (Ethere does not currently send marketing communications); and to comply with legal and regulatory obligations. Ethere keeps these purposes separate: service improvement covers operating, securing, and refining the Service; model improvement would cover training or fine-tuning models; and your Content is not used for model improvement — Ethere does not use your Content or your End Users' personal data to train general-purpose or foundation models unless you have expressly agreed otherwise in writing, as set out in the Terms of Service.

6. Cookies and Similar Technologies

Ethere uses cookies and similar technologies as described in Ethere's Cookie Policy. Strictly necessary cookies (for example, those required to keep you signed in and to protect forms against cross-site request forgery) are used without consent because they are essential to make the Service work; the same applies to functional preference cookies and technologies (such as your language and appearance settings), which are set only where you actively choose those preferences. Ethere does not currently use analytics or marketing cookies. Should Ethere introduce non-essential cookies (such as analytics or marketing) in the future, Ethere will only use them where you have given your consent, which you may give or decline, and may withdraw at any time. Please see the Cookie Policy for details of the specific cookies Ethere uses and how to manage them.

7. Sharing, Processors, and Third-Party Services

Ethere does not sell your personal data. Ethere may share personal data only where necessary: (a) with trusted processors who help Ethere operate the Service, under written agreements (Article 28 of the GDPR) that require them to process data only on Ethere's instructions and to protect it; where a provider acts as an independent controller for its own purpose, that role is identified below. Ethere's current processors are: Mistral AI — messages, prompts, and knowledge content are transmitted to Mistral AI when the Service generates AI responses or embeddings, so Ethere can answer shoppers' questions; Resend — delivery of transactional email (account verification, password reset, two-factor authentication, and notifications); Stripe — payment processing, subscription billing, and invoicing (payment details are entered into Stripe's own components, and Ethere never stores full card details); and Hetzner — hosting and infrastructure for Ethere's servers, located within the European Union. Ethere also uses Cloudflare, Inc. — content delivery, the web application firewall, bot management, and the Turnstile anti-abuse check on Ethere's public forms; Cloudflare's processing of the signals used for the Turnstile check is described in Cloudflare's Turnstile Privacy Addendum at cloudflare.com/en-gb/turnstile-privacy-policy. For that check Cloudflare also acts as an independent controller when it uses the signals to improve its own bot detection, relying on its legitimate interests; the rest of its processing for Ethere is carried out on Ethere's instructions. PostgreSQL and Redis run on Ethere's own servers inside that hosting infrastructure and are part of the Service, not third-party processors; the contact-form delivery queue is held there for at most seven days; and optional error monitoring (Sentry) is not enabled on the production Service. Where you connect a store, Ethere accesses data in that store (for example, products, orders, and customers) through the platform's authorized API — Shopify or WooCommerce — to answer end-user questions; this access is limited to the permissions you grant, and stored credentials are encrypted. (b) Ethere may share personal data with others where you have authorized Ethere to do so or where it is directly relevant to providing the Service to you; (c) where required by law, or to comply with a court order, regulator, or legal obligation; and (d) in connection with a merger, acquisition, or sale of assets, where Ethere will notify you and, where required, seek consent. Ethere engages subprocessors subject to the requirements of Article 28 of the GDPR and the Data Processing Agreement, and remains responsible for their performance. A current list of Ethere's processors and sub-processors, with what each one does and where it processes data, is published at ethere.cloud/subprocessors. The Service may contain links to third-party websites or services that are not operated by Ethere; Ethere is not responsible for the privacy practices of those third parties, and Ethere encourages you to review their privacy policies.

8. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), Ethere will ensure that appropriate safeguards are in place, such as the European Commission's adequacy decisions, standard contractual clauses, the EU-U.S. Data Privacy Framework (and the Swiss-U.S. Data Privacy Framework, where applicable), or equivalent mechanisms, and that you retain enforceable data-subject rights and effective remedies. The processors that can touch personal data, the location in which each one processes it, and the transfer mechanism that applies are listed on the Subprocessors page, which is kept up to date. You may request a copy of the safeguards in place by contacting Ethere.

9. Data Retention

Ethere retains personal data only for as long as necessary for the purposes for which it was collected, to operate the Service, and to comply with legal, tax, and accounting requirements. Retention periods are applied automatically. In particular:

• account, billing, and organization data — retained while your account is active and deleted or anonymized when you delete your account, subject to any legal retention requirements;
• conversations and messages — deleted 7 days after the last activity in them, and deleted immediately when you delete your account or the relevant widget data;
• leads and knowledge content — retained while the widget that holds them exists, and deleted when you delete that widget or the organization. They belong to the organization rather than to one person: a member who deletes their own account leaves them in place for the team, and an owner who takes the organization with them removes them with it;
• widget engagement analytics — the randomly generated visitor identifier and the funnel events are deleted after 30 days; the daily aggregate totals derived from them (which contain no identifier) are kept for 12 months;
• security-event logs — 180 days;
• server and application logs — reverse-proxy access logs, which record IP addresses, are kept for 14 days; the system journal, which holds application and audit output, is retained for up to 90 days and capped at 2 GB, and email addresses in application log lines are masked so that a log line cannot carry a readable address;
• webhook delivery records from a connected platform (Shopify, WooCommerce, or Stripe) — 30 days;
• login attempts and failed logins — 30 days;
• notifications — 30 days after they are read (unread notifications are kept because they are part of your active interface state);
• feedback you send Ethere through the Service — 180 days;
• device and session records for your account — the records of devices other than your current session are deleted 30 days after they are last seen;
• invitations you send or receive — deleted 7 days after the invitation expires;
• accounts that never verify their email address — deleted 24 hours after the verification window closes;
• accounts with no active subscription and no activity — scheduled for deletion 7 days after the last activity and deleted at the next nightly sweep after a further day of grace; subscribing before then cancels the deletion, and for an account that has not already been warned, signing in clears the schedule too, except where Ethere has to keep the account to satisfy a legal obligation or an active security hold, and except where the account belongs to an organization of more than one member that Ethere has previously billed, which Ethere keeps while the team may return; a subscription whose payment is still being retried is not treated as ended, for up to 30 days after the payment first fails; the payment provider retains the transaction record of any past subscription under its own legal retention, so a cancelled subscription's invoices are not lost;
• organization activity history — the record of who invited a teammate, changed a role, or updated the organization's settings — deleted 365 days after the event;
• knowledge suggestions that have already been reviewed — deleted 180 days after they are created; suggestions still awaiting review are kept until they are reviewed;
• trusted-device records for two-factor authentication — 30 days from the date they are issued;
• messages sent through the public contact form — delivered to Ethere by email and held in a short-lived delivery queue for at most 7 days;
• consent records — kept for as long as the account exists, so that the consent given can be demonstrated while the processing it evidences continues; they are deleted with the account;
• the suppression list that prevents delivery to an address that has hard-bounced or been marked as spam — kept until the address is removed;
• cancellation records for deleted accounts — the record that a deleted account's subscription was cancelled, kept for 90 days after the cancellation is confirmed so that it can be proved, and deleted after that; a cancellation that is still outstanding is kept until it is confirmed;
• rate-limiting data — transient, typically minutes.

When you delete your account or request deletion, Ethere will delete or anonymize your personal data unless Ethere is required to retain it by law. Where personal data is no longer necessary, Ethere will erase or anonymize it in accordance with this policy. Deleted data may remain in the encrypted disaster-recovery backups described in the Terms of Service until those backups are overwritten on their normal rotation — weekly full backups are retained for four weeks and daily incremental backups for one week — after which it is no longer recoverable. Backup data is restored only where necessary for disaster recovery or where the law requires it.

10. Your Rights

Under the GDPR and applicable national law, you have the right to: (a) access your personal data; (b) rectify inaccurate or incomplete personal data; (c) erase your personal data ("right to be forgotten"); (d) restrict processing of your personal data; (e) data portability — receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller; (f) object to processing based on legitimate interests or for direct marketing; (g) not be subject to decisions based solely on automated processing that produce legal or similarly significant effects; and (h) withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal. To exercise these rights, contact Ethere at privacy@ethere.cloud. Ethere may ask you to verify your identity before responding. Ethere will respond to verified requests within one (1) month, which may be extended by a further two (2) months where necessary, and Ethere will inform you of any such extension. Requests are generally free of charge, but Ethere may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive. Where you object to processing for direct marketing, Ethere will stop processing your personal data for that purpose without delay. If you are an End User whose data was processed through a customer's widget on that customer's website, Ethere may direct your request to that customer where the customer is the controller of that processing.

11. Security, Records, and Breach Notification

Ethere implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. Those measures are described on the Security page and include TLS for data in transit, column-level encryption of stored credentials and secrets, AES-256 encryption of backups held on separate infrastructure, row-level security that isolates each account's and organization's data, least-privilege access controls, documented operational procedures, and an auditable change process. While Ethere takes reasonable measures to protect your data, no method of transmission or storage is completely secure, and Ethere cannot guarantee absolute security. Ethere maintains records of its processing activities in accordance with Article 30 of the GDPR and conducts Data Protection Impact Assessments (DPIAs) where required by Article 35 of the GDPR. In the event of a personal data breach: where Ethere is the controller, Ethere will assess whether notification to a supervisory authority is required and, where it is, will make that notification without undue delay and within the period required by Article 33 of the GDPR, and will communicate the breach to affected data subjects where required by Article 34 of the GDPR; and where Ethere is the processor, Ethere will notify the relevant customer as controller without undue delay after becoming aware of the breach, in accordance with Article 33(2) of the GDPR and the Data Processing Agreement.

12. Automated Decision-Making

Ethere uses artificial intelligence to generate responses to questions. This processing does not produce legal or similarly significant effects on individuals, and Ethere does not make decisions about individuals based solely on automated processing within the meaning of Article 22 of the GDPR. If Ethere were to introduce automated decision-making that produces legal or similarly significant effects, it would provide meaningful information about the logic involved and the significance and envisaged consequences, and would implement appropriate safeguards in accordance with Article 22. In accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689), the widget is designed so that End Users are informed that they are interacting with an artificial intelligence system and not a human. As described in Section 6 of the Terms of Service, Ethere does not use your Content to train or fine-tune general-purpose or foundation models; Ethere may use service telemetry, and aggregated or de-identified information that cannot reasonably identify you or your End Users, to run, secure, and improve the Service.

13. Children

The Service is not directed to children, and it is not offered or designed as a child-directed service. Because the widget runs on customer-controlled websites, a site that sells to families or minors may incidentally involve a minor in a conversation; where the customer is the controller of that processing, the customer is responsible for the child-directed notices, consents, and safeguards that apply. Ethere does not knowingly collect personal data from children. If Ethere becomes aware that Ethere has collected personal data from a child without verifiable parental consent, Ethere will take steps to delete it. If you believe a child has provided Ethere with personal data, contact Ethere at privacy@ethere.cloud.

14. Changes to This Policy

Ethere may update this Privacy Policy from time to time to reflect changes in the law, the Service, or business practices. When Ethere makes material changes, Ethere will update the "Last updated" date and provide notice within the Service or by email. Ethere encourages you to review this Privacy Policy periodically.

15. Contact Ethere and Supervisory Authorities

For questions about this Privacy Policy or to exercise your rights, contact Ethere at privacy@ethere.cloud. If you are not satisfied with Ethere's response, you have the right to lodge a complaint with a data-protection supervisory authority. Ethere is established in Lithuania, so the lead supervisory authority for its processing is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI); depending on your circumstances, you may also complain to another competent supervisory authority, such as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), the Latvian Data State Inspectorate (Datu valsts inspekcija, DVI), or the authority of the country in which you live or work.