Privacy policy

Member.Ask (“member.ask”, “we”, “us”) is an AI chat service that answers questions on our customers' websites from their own content. It is operated by Hiaitus Pty Ltd (ABN 54 689 502 832), trading as Member.Ask, Level 9, 50 Clarence Street, Sydney NSW 2000, Australia. This policy explains what personal information we handle, why, where it goes and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Questions or requests: contact@hiaitus.ai.

Who this policy covers

• Customers and their staff who sign in to the Member.Ask dashboard.
• Visitors to our customers' websites who use a Member.Ask chat widget. We handle their information on the customer's behalf; the customer's own privacy policy also applies.
• Visitors to this website, www.memberask.com.

What we collect

• Account details: name, email address, role, and the company and sites an account belongs to. Accounts are created by us or by a customer's administrator.
• Customer content: pages we crawl from a customer's website, documents a customer uploads, documents imported from a Google Drive folder the customer connects (see Google user data), trained answers (answers a customer's staff write to correct or replace what the assistant says) and settings.
• Chat conversations: what website visitors type into the widget, the answers, any rating a visitor gives an answer (for example thumbs up or down), and, if a visitor chooses to give them, their name and email address (for example to be contacted, or to talk to a person). The widget keeps a session identifier in the visitor's browser session storage so a conversation continues from page to page.
• Usage and technical information: daily counts of widget use per site, with no visitor identifiers; the websites a widget is installed on; and, in the dashboard, product analytics about which features are used, linked to the user's name, email address and role (see Analytics). Our hosting provider processes IP addresses to deliver the service and protect it from abuse.

How we use it

• To provide the service: index customer content, answer visitors' questions from it, hand conversations to a customer's staff, and send notification emails.
• To keep the service secure, prevent abuse and enforce usage limits.
• To understand which dashboard features are used and improve them.
• To communicate with customers about their account.

We do not sell personal information, and we do not use it for advertising.

Google user data

A customer can connect a Google Drive folder to a site so that the PDFs in it are imported into that site's knowledge base and kept up to date. This section describes exactly what that involves.

What we access

• We ask for the read-only Google Drive permission (https://www.googleapis.com/auth/drive.readonly). We never ask for permission to change, delete or share anything in your Drive.
• From the one folder you choose, we read the PDF files directly in it: their contents, names, links, last-modified times and checksums, and the folder's name. We do not read other files, other folders or subfolders.
• The email address and Drive account identifier of the Google account that gave permission, so we can show which account is connected and manage the connection.

How we use it

• To import the folder's PDFs into the site's knowledge base, and to check the folder regularly (hourly by default) so that new, changed and removed files are reflected. A file removed from the folder is deleted from Member.Ask at the next check.
• To answer questions from visitors to that customer's website. Answers may quote the documents, so anything in the connected folder may be shown to the public on that website. Connect only folders whose contents you are happy to publish.
• We use Google user data for nothing else.

How we store it

• A copy of each imported PDF is kept in our file storage, and its text, split into passages with their search embeddings, in our database. Both are hosted by Supabase in Sydney, Australia, encrypted in transit and at rest.
• The permission Google gives us (a refresh token) is stored encrypted and is used only by our servers to read the folder. It is never shown in the dashboard or sent to your browser. Short-lived access tokens are kept in memory only, for one check.

Who we share it with

• OpenAI, to create the search embeddings for imported text and, when it is the configured chat provider, to write answers from the relevant passages.
• Anthropic, when it is the configured chat provider, to write answers from the relevant passages.
• Under their API terms, neither uses this data to train its models. We do not use Google user data to train, or to develop or improve, any AI or machine-learning model.
• Visitors to the customer's website see answers drawn from the documents, as described above.
• Google user data is not shared with anyone else, including our analytics provider. It is never sold, used for advertising, or used to determine credit-worthiness.
• Our staff do not read your Google Drive documents, except at your request (for example to help with a support question), when necessary for security (for example to investigate abuse), or to comply with the law.

How long we keep it, and how to delete it

• Delete a document in the dashboard and its copy, text and embeddings are deleted immediately. It is not imported again unless the file changes in Drive.
• Disconnect Google Drive in the dashboard and we stop reading the folder, delete the stored permission, and revoke it with Google unless the same Google account is still connected to another of your sites. Documents already imported stay in the knowledge base until you delete them.
• You can also remove Member.Ask's access at any time from your Google Account at myaccount.google.com/permissions.
• When a customer account is closed, everything imported from Google Drive is deleted immediately, with the rest of the account's content.
• Deleted data remains in our encrypted database backups for up to 7 days, after which it is gone.

Limited Use

member.ask's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share personal information with

We use these service providers to run Member.Ask. Each handles personal information only to provide its service to us.

Some of these providers are in the United States, so personal information may be disclosed overseas. Customer content and conversations are stored in Sydney. To answer a question, the visitor's question and the relevant passages of customer content are sent to the AI provider in the United States. We also disclose information where the law requires it, and to a buyer of our business if it is sold (Google user data only with your prior consent).

Analytics

We use PostHog to understand how the dashboard is used and to find errors. PostHog holds:

• each dashboard user's account identifier, name, email address and role;
• the pages they view and the actions they take, such as creating a site or starting a crawl, with settings and counts but not the text of what they click;
• recordings of dashboard sessions, in which every piece of text and every form input is masked;
• page performance measurements, and error reports from the browser and our servers;
• for each AI answer, which model wrote it, how long it took and how many tokens it used, under a pseudonymous identifier, never the question, the answer or the documents used;
• daily counts of widget use and the websites it is installed on, per site, with no visitor identifiers;
• operational records from our servers, such as when a crawl is queued.

It holds no customer content (website pages, documents, conversations or leads) and no Google user data. Analytics data is kept for up to 12 months after an account is closed, then deleted. You can ask us to delete the analytics linked to you sooner (see Your choices and rights).

How long we keep personal information

• Customer content, conversations and leads are kept until the customer deletes them or closes their account; then they are deleted immediately.
• Analytics data is kept for up to 12 months after an account is closed (see Analytics).
• Notification emails we have sent are deleted 90 days after sending. An address that bounced or complained is kept on a suppression list so we do not email it again.
• Daily widget usage counts are kept for at most 7 days before being sent, without visitor identifiers, to our analytics provider.
• Database backups are kept for 7 days.

Security

Data is encrypted in transit and at rest. Each customer's data is separated from every other customer's by access rules enforced in the database, and access to our systems is limited to the people who need it.

Data breaches

If we become aware of unauthorised access to, or loss of, personal information we hold, we act quickly to contain it and assess the risk. We tell affected customers without undue delay and in any case within 72 hours. Where a breach is likely to result in serious harm, we notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Automated decisions

Member.Ask answers questions from a customer's own content. It does not make decisions about individuals that significantly affect their rights or interests.

Cookies and similar technologies

The dashboard uses cookies to keep you signed in, and our analytics provider stores an identifier in your browser to count usage. The chat widget uses browser session storage, which is cleared when the browser tab is closed.

Your choices and rights

You can ask to access or correct the personal information we hold about you, or ask us to delete it, by emailing contact@hiaitus.ai. If we hold it on behalf of one of our customers (for example a chat on their website), we may refer you to them. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Children

Member.Ask is a business service and is not directed at children under 13.

Changes to this policy

We will post any change here with a new effective date, and tell customers about significant changes. If we change how we use Google user data, we will ask for your consent again before using it in the new way.

See also our terms of service.