Privacy policy

About this policy

HigherOps operates HigherChat, a website chat and visitor engagement service. This policy explains how we handle information for our website, waitlist, app, and customer website widgets. For visitor data collected on a customer website, that customer determines how HigherChat is configured and why the data is collected. Read that website’s privacy notice as well as this policy.

Information we collect

• Account information: your email address, Google name and profile information when you choose Google sign-in, workspace memberships, roles, invitations, and authentication records. You can also sign in using an emailed code. HigherChat does not ask for your Google password or access to Gmail, Drive, or Calendar.
• Waitlist details: the name, work email, company and optional note you submit, with submission and consent times. We use these details to review your request and contact you about HigherChat access. Joining does not create an account or automatically approve your domain.
• Workspace content: website settings, approved and draft knowledge, imported content, assistant instructions, model connection settings, and lead delivery destinations.
• Visitor conversations and leads: chat messages, assistant responses, contact details visitors choose to provide or submit through configured forms, and related page and conversation context.
• Visitor activity: when enabled by a customer, visitor and session identifiers, page visits, clicks, section engagement, time on pages, referral context, browser information, and IP-related information used for security or configured company identification.
• Operational information: model usage, delivery attempts, error and security logs, and records needed to operate and troubleshoot the service.

How we use information

We use information to authenticate users, enforce workspace permissions and approved-domain signup rules, provide grounded chat responses, show conversations and visitor activity, deliver leads to the destinations a customer configures, review waitlist requests, and keep the service reliable and secure. We do not sell workspace or visitor data. We do not use customer content to train our own models.

Who receives information

Authorized workspace members can access information according to their role. HigherOps personnel may access data to operate, secure, and support the service or meet legal obligations. Customers are responsible for the people they invite and the destinations they configure.

• Supabase provides the database and authentication service. Google provides optional account authentication. Google Workspace handles configured sign-in email delivery.
• Vercel hosts the application and processes requests and operational logs.
• OpenRouter and the selected model provider receive the conversation, published knowledge and other prompt context needed to generate a response. Draft knowledge is excluded from the published knowledge corpus. Provider processing is governed by their applicable terms and settings.
• Resend processes configured lead-notification email. Customer-selected email recipients, Slack destinations or webhook services receive the lead information routed to them.
• When IP-based company identification is enabled, IPinfo receives the visitor IP address to look up company information. Other configured integrations receive the information needed for their feature. Contact the website operator or HigherOps for details about a particular installation.

Cookies, browser storage and analytics

The app uses cookies for sign-in sessions and temporary authentication state. Website widgets may use browser storage for visitor identifiers, chat state, session information and consent preferences. Visitor tracking depends on the website’s configuration and consent controls. Website operators must obtain any required consent before enabling tracking. HigherChat’s configured analytics events do not include visitor names, email addresses or message text; this does not prevent those details from being stored in the conversation or lead records needed to provide the service.

Security and international processing

We use authentication, server-side workspace access controls and encryption for stored model credentials. No system can guarantee absolute security. Our hosting and service providers may process information outside your province or country, where different laws may apply. Contact us if you need information about the locations and contractual arrangements relevant to your workspace.

Retention and deletion

We retain account, workspace, conversation, lead and waitlist records as needed to provide the service, handle access requests, maintain security and meet applicable obligations. These records are not all subject to one automatic deletion period. Visitor event pruning is configured for records older than 90 days and visitors inactive for 90 days; this does not delete separate conversation or lead records. Provider logs and backups may persist under the relevant provider’s retention practices.

To request access, correction, export or deletion of your account or waitlist details, contact info@higherops.io. For information collected on a customer website, contact that website’s operator first; we can help route your request. A workspace owner can contact us about workspace data. We may verify your identity or authority before acting, and legal or security requirements may limit a request.

Your choices and changes

You can choose email-code sign-in instead of Google, revoke HigherChat’s Google connection in your Google account, ask to leave the waitlist, and use the applicable website’s consent controls. Revoking a Google connection does not itself delete a HigherChat account. Depending on your location, you may have additional rights to object to or restrict processing or complain to a privacy authority.

We will update this page when our practices change and seek additional consent when required for a new purpose. The date above identifies this version.

Contact

For privacy questions or requests, email info@higherops.io.