Privacy Policy

1. Who we are

app-in.io ("AppIn") provides AI-powered semantic search and chat (AI assistant) services — the API, dashboard, embeddable widgets, and product integrations such as AppIn Search for WooCommerce — operated by ISAP OÜ, Narva mnt 5, 10117 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia (registry code 16838751).

Privacy contact: [email protected]

Controller and processor roles

Our role under the GDPR depends on the data:

• ISAP OÜ as controller — for your account data, billing data, contact form submissions, and data collected on our marketing site. This policy describes that processing.
• ISAP OÜ as processor — for Customer Content: the catalogs, pages, and documents our customers index, and the search queries and chat messages submitted by end users on customers' sites. For that data, our customer is the controller and we process it on their behalf under our Data Processing Agreement. See also our GDPR overview.

2. What data we collect

Account data

When you register, we collect your name and email address, and — if you sign up with a password — the password is stored hashed. Self-serve plugin registration uses one-time email codes instead of a password. If you subscribe to a paid plan, payment processing is handled by Revolut — we do not store credit card numbers.

Indexed content (Customer Content)

Content you index through our API or plugins (pages, products, documents) is stored in our vector database for the purpose of providing search and chat functionality. This data belongs to you, is processed on your behalf under the DPA, and is isolated per site.

Query logs

We log API search queries, chat messages, and response metadata for the purpose of providing usage analytics and debugging. Search query logs are automatically deleted after 3 months.

Token usage logs

We record token and request usage per site to enforce plan quotas and calculate billing. These records are kept for as long as accounting and tax law requires (in Estonia, generally seven years), including after account closure.

Contact form

When you submit our contact form, we collect your name, email, company name (optional), message text, and IP address.

Technical data

We collect IP addresses, API key identifiers, and request metadata for security, rate limiting, and abuse prevention. When a browser loads our search or chat widget from cdn.app-in.io, standard HTTP metadata (IP address, user agent, referrer) is transmitted as part of the request.

WooCommerce plugin

If you use our WooCommerce plugin "AppIn Search", the following data flows to our service:

• Catalog data — on product create, update, stock change, or bulk sync, the plugin sends product fields to api.app-in.io: title, description, price, currency, image URL, stock status, SKU, categories, tags, rating, review count, brand, and attributes. When a product is trashed or unpublished, a delete request with the product ID is sent.
• Shopper searches — the search query text and the site's public key are sent to our API and ranked results are returned.
• Widget delivery — on storefront page load, the widget JavaScript is fetched from cdn.app-in.io; the shopper's browser transmits standard HTTP metadata (IP address, user agent, referrer).
• In-plugin registration — the store admin's email, store name, store URL, and admin language are sent to create the account, and a one-time verification code is emailed.

No shopper personal data is sent by design — only catalog data, search query text, and standard HTTP metadata. Store owners should update their own privacy notice to disclose their use of AppIn.

3. How we use your data

• To provide and maintain the search and chat services
• To process your API requests and return search results and chat responses
• To display usage analytics in your dashboard
• To calculate quota usage and billing
• To send transactional emails (account verification, notifications)
• To respond to your contact form inquiries
• To enforce rate limits and prevent abuse
• To comply with legal obligations

We do not use your data for advertising or profiling, and we never use customer data to train AI models.

4. Legal basis (GDPR)

• Contract performance — processing your account, indexed content, and queries to deliver the service you signed up for
• Legitimate interest — security logging, rate limiting, abuse prevention, error monitoring, service improvement, and responding to inquiries you send us via the contact form
• Consent — analytics and marketing cookies on our marketing site
• Legal obligation — tax and accounting requirements

5. Data processing and third parties

Embedding and search

Your content is vectorized and ranked using self-hosted ML models running on our own EU infrastructure. Content does not leave our servers for embedding, vector search, or reranking operations.

LLM features

AI features (search query parsing, chat responses, content cleanup, and index-time synonym enrichment of product titles) send text to third-party LLM providers. When you use our platform keys, requests are processed by one of our platform LLM providers — currently Google (Gemini API), OpenAI, Anthropic, or Mistral AI (or Azure OpenAI where configured for a site) — depending on the feature and site configuration. We add or replace platform LLM providers only through the sub-processor change process in our DPA (notice with a 30-day objection window). If you configure your own API key (BYOK — supported providers: OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral), requests go directly to your chosen provider under that provider's terms, and the provider is engaged by you rather than acting as our sub-processor. BYOK keys are stored encrypted and used only to serve your sites.

Messaging channels

Customers may connect the chat assistant to messaging channels (Telegram, WhatsApp, Facebook Messenger). Conversations on a connected channel also pass through that channel operator's platform under its own terms and privacy policy; we receive and process the messages to provide the chat service on the customer's behalf.

Infrastructure and service providers

• Hetzner (Germany/Finland, EU) — cloud hosting of all application data; our databases and vector store run on our own servers
• Cloudflare — DNS, CDN, DDoS protection, and delivery of the widget JavaScript from cdn.app-in.io; requests to our marketing site, API, and dashboard are proxied through Cloudflare
• Sentry — error monitoring on our servers and in the search widget; error reports may include request metadata
• Google (Tag Manager / Analytics) — marketing-site analytics, only after you opt in via the cookie banner (see the Cookies section below)
• Revolut — payment processing; Revolut acts as an independent controller for payment data, and we do not store card numbers
• Transactional email — verification codes and notifications are sent from our own self-hosted mail server; no third-party email service processes this data

Where these providers process personal data outside the EU/EEA, transfers are safeguarded by the European Commission's Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework; you can request copies of the applicable safeguards at [email protected]. A full list of sub-processors for Customer Content, including the transfer mechanism per provider, is maintained in our DPA and summarized on our GDPR page.

6. Data retention

• Indexed content — retained while your account and site are active; removed when you delete content via API, delete a site, or delete your account
• Search query logs — automatically deleted after 3 months
• Chat sessions — expire, are soft-deleted 2 months after expiry, and are permanently deleted 6 months after soft-deletion
• Token usage logs — retained as billing records for as long as accounting and tax law requires (in Estonia, generally seven years), including after account closure
• Account data — retained while your account is active; deleted upon account deletion request
• Unverified accounts — accounts that never verify their email are soft-deleted 15 days after registration (after email warnings) and permanently deleted 30 days later
• Contact messages — retained for up to 12 months

7. Data isolation and security

• Your content is isolated in dedicated vector collections — per site, or per shared data source where several of your sites share one catalog
• Secret API keys are SHA-256 hashed in the database; public keys are site identifiers safe to expose in browsers
• BYOK LLM API keys are encrypted at rest
• All connections use HTTPS/TLS
• Access is restricted by API key authentication, per-plan rate limiting, and least-privilege admin access

8. Your rights (GDPR)

As an EU-based company, we comply with GDPR. You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Portability — receive your data in a structured format
• Restriction — restrict processing of your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond within one month.

If you are an end user of a website that uses AppIn, the website operator is the controller of your queries and chat messages — please direct requests to them; we will assist them as their processor.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or your local EU supervisory authority.

9. Cookies

Our marketing site (app-in.io) uses Google Tag Manager with Google Consent Mode v2. By default, all consent signals are set to denied — no analytics or marketing cookies are set until you opt in via the cookie consent banner. You can change or withdraw your choice at any time through the banner settings.

When you opt in, Google (Google Ireland Ltd / Google LLC, US) receives your IP address and device and usage data through Google Tag Manager and Google Analytics; transfers to the US rely on the EU–US Data Privacy Framework. See Google's own privacy policy for details.

The application dashboard (my.app-in.io) uses session cookies strictly necessary for authentication only. We do not use third-party advertising cookies anywhere.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email to registered users. The "last updated" date at the top of this page reflects the most recent revision.