Privacy Policy

Achilles Systems LLP provides the Achilles platform. Contact details are in Section 14.

We handle personal data in two different roles:

1. (a)As the data fiduciary (the party that decides why and how personal data is processed) for information about the people who visit our website, create accounts and use the console on behalf of a customer. This policy applies to that data.
2. (b)As a data processor for personal data that our customers put into the Services about their own customers and users, for example the messages an end user sends to a customer’s agent. We process that data only on the customer’s instructions. The customer’s own privacy notice applies to it, and Section 6 applies to us.

Information you give us:

1. (a)Account information: your name, work email address, and a password, which we store only as a salted hash.
2. (b)Workspace information: the name of your workspace, the people you invite and their roles, and the settings you choose.
3. (c)Messages you send us, such as support requests or a request to talk to us about a plan.
4. (d)Billing information for paid plans. Payment details are collected and processed by our payment service provider. We do not store full payment-card numbers.

Information we collect automatically:

1. (a)Usage information: which features you use, counts of messages and other plan usage, and your plan.
2. (b)Technical information: IP address, browser and device type, and log data such as the time and result of requests. We use this to run the Services, protect accounts and investigate abuse.
3. (c)Security signals at sign-up, such as whether an email address belongs to a temporary-mail provider and, where enabled, the result of a bot check.

Customer content, which our customers control:

1. (a)Agent definitions and settings, knowledge-base documents, conversations between end users and agents, traces of how an agent reached an answer, and connection details for the customer’s databases and APIs. Connection credentials are stored encrypted.

We do not knowingly collect sensitive personal data from you directly. A customer may choose to put such data into its own agents. That is the customer’s responsibility under Section 6.

We use the information about you and your account to:

1. (a)provide, operate and secure the Services, including signing you in, verifying your email address and applying the limits of your plan;
2. (b)send you messages that are part of the Services: verification emails, invitations, password resets, security notices, and alerts about your usage and plan;
3. (c)detect and prevent abuse, fraud and unauthorised access, including attempts to create accounts in bulk or to avoid plan limits;
4. (d)provide support and respond to your requests;
5. (e)understand how the Services are used, using aggregated or de-identified information, so that we can fix problems and improve them;
6. (f)send you information about the Services, where the law allows and with an option to stop; and
7. (g)comply with legal obligations and enforce our terms.

We rely on your consent where the law requires it, and otherwise on the uses that the law recognises as legitimate, such as performing our agreement with you, securing the Services, and meeting legal obligations. Where we rely on consent you can withdraw it at any time, as Section 10 explains.

We do not sell personal data. We do not use personal data for advertising.

We share personal data only with the following, and only as needed:

1. (a)Service providers that help us run the Services: cloud hosting and infrastructure, email delivery, bot and abuse protection, payment processing, and customer-support tools. They may use the data only to provide their service to us.
2. (b)AI model providers. When an agent runs on model credentials that we provide, the content of the conversation is sent to the model provider that processes it, under the commercial terms we hold with that provider. When a customer connects its own model credentials, the content goes to the provider the customer chose, under the customer’s terms with it.
3. (c)Speech and messaging providers, such as speech-to-text and text-to-speech services and messaging platforms like WhatsApp and Instagram, when a customer enables those channels.
4. (d)The customer whose workspace you belong to, which can see information about its users and their activity in the workspace.
5. (e)Professional advisers, and authorities where we are required to by law or need to protect rights, safety or the security of the Services.
6. (f)A successor, if we are involved in a merger, acquisition or sale of assets, subject to the commitments in this policy.

We will give you a list of our material sub-processors on request.

We do not use customer content, including conversations, documents or agent definitions, to train or fine-tune any AI model.

Agents work by sending the relevant conversation, instructions and retrieved information to an AI model so that it can produce a response. That processing is what the Services do. It happens through the providers described in Section 4.

We store conversations and traces within the customer’s workspace so that the customer can review, debug and audit its agents. Customers decide what their agents can access.

If you are talking to an agent that a business has built with Achilles, that business is responsible for how your personal data is collected and used, and its privacy notice applies. We process the data for the business, on its instructions.

To exercise your rights over that data, please contact the business directly. If you contact us instead, we will pass your request on to the relevant customer where we can identify it, and tell you that we have done so.

An agent should tell you that it is an AI system where the law requires it. If you are unsure, ask the business.

We and our service providers may process personal data in India and in other countries. Where we transfer personal data across borders, we do so in line with the law that applies, and we require our providers to protect it appropriately.

We keep account information while your account is active and for as long afterwards as we need it to meet legal, accounting and dispute-resolution requirements, and to protect against fraud and abuse.

Security and audit logs about key management are kept for a period that depends on the plan, from 7 days on the Free plan up to 400 days on the Enterprise plan.

Customer content is kept while the workspace is active so that the Services work. Customers can delete content in the console. After a workspace is closed we delete or anonymise its content within a reasonable period, except for copies in routine backups that are overwritten in the ordinary course and information we must keep by law.

When we no longer need personal data, we delete it or de-identify it.

We use technical and organisational measures that are appropriate to the risk. These include encrypting stored credentials, keeping each workspace’s data separate from other workspaces, controlling access by role, and keeping audit records of sensitive actions.

No method of transmission or storage is completely secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

Depending on where you are, you may have the right to:

1. (a)get a summary of the personal data we hold about you and how we process it;
2. (b)have inaccurate or incomplete data corrected or updated;
3. (c)have your personal data erased, unless we need to keep it for a legal purpose;
4. (d)withdraw consent you have given, which does not affect processing done before you withdrew it;
5. (e)nominate another person to exercise your rights if you die or become unable to;
6. (f)object to or restrict certain processing, and receive your data in a portable format, where the law of your country gives you that right; and
7. (g)make a complaint to the data-protection authority in your country.

To exercise a right, or to raise a concern, write to systemsachilles@gmail.com. We may need to verify your identity first. We will respond within the time the law requires.

Grievance redressal. Concerns about how we handle personal data can be sent to our Grievance Officer at systemsachilles@gmail.com. We will acknowledge your complaint and respond within the time the applicable law requires. If you are not satisfied, you may complain to the Data Protection Board of India or to the authority in your own country.

The console stores a session token in your browser so that you stay signed in, and may store small preferences, such as which workspace you last opened. This storage is essential to the Services. Signing out removes the session token.

The chat widget that a customer places on its own website may store a random identifier in the visitor’s browser so that a conversation can continue. That website’s own notice describes its other cookies.

Our marketing website does not currently use advertising or analytics cookies. If that changes, we will update this policy and ask for consent where the law requires it.

The Services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the Services or the law change. We will post the new version with a new effective date and, for a material change, tell account owners by email or in the console before it takes effect.

Achilles Systems LLP. Email: systemsachilles@gmail.com.