Privacy & Data Handling

What we process

When a visitor chats with a bot, we store the messages, any leads they submit, and aggregate analytics (e.g. feedback ratings and topic summaries) so the bot owner can review and improve the experience. We do not sell personal data, and the bot answers only from its owner's configured knowledge — it is not used to train third-party models.

Public website analytics and signup requests

On Loqara's public website, Vercel Web Analytics and Google Analytics measure page visits and actions such as opening or submitting the Get Started form. We keep these analytics off authenticated, owner, embedded-widget, and demo screens.

To understand which public page first led to a signup, the browser stores a first-touch record in local storage for up to 90 days. It contains the landing pathname, the external referrer with its query and fragment removed, and explicit UTM campaign fields. We do not retain search-query text (including utm_term), arbitrary landing-page parameters, or advertising click IDs in that record. If you submit the Get Started form, the same bounded attribution fields are saved with your signup request.

Data retention

Bot owners choose a retention window in their settings. When set, conversations (and their messages) older than that window are automatically and permanently deleted by a daily job. Owners can also export or erase their data on demand at any time. Public-site first-touch data expires from the browser after 90 days. Signup requests are retained until they are converted into an account or deleted by Loqara.

Subprocessors

• Supabase — Database, authentication, and file storage (data hosted in the EU region).
• OpenAI — Language model responses, embeddings, and conversation analysis.
• ElevenLabs — Real-time voice agent (speech-to-text, the conversation LLM, and text-to-speech).
• Vercel — Application hosting, content delivery, and privacy-focused public-site analytics.
• Google Analytics — Delayed public-site page and conversion measurement.

Security

Data is encrypted in transit. Each organization's data is isolated at the database level with row-level security, and embeddable widgets can be restricted to an allowlist of domains. Server-only secrets are never exposed to the browser.

Your rights

Bot owners can export and delete their organization's data from the in-app Settings. For access, correction, or erasure requests relating to a specific conversation, contact the operator of the website where you used the chat. For a Loqara website signup or public-site analytics request, contact Loqara directly using the address below.

Contact

Questions about privacy or this page? Email hello@loqara.com.