Pilot privacy information · 4 November 2026

Your business records stay private.

This notice describes the current pilot application. Before a paid service starts, the written agreement must identify the legal operator and the privacy obligations for your country.

What the application stores

Account email, a salted password hash, a hashed recovery code and session records; your business draft and published versions; visitor names, contact details, messages and preferred appointment dates; owner notes and statuses; pilot acceptance and cancellation times; and an operator’s activation evidence reference. We do not collect card numbers through this application.

How it is used

We use these records to authenticate access, save and publish your approved website, receive enquiries, prepare a daily summary, operate the service and handle support. The daily pilot brief is a deterministic summary of your records, not a claim that an AI model reviewed them.

The separate website studio may use Cloudflare Workers AI to help draft business content you submit. Check generated content before publishing and avoid entering sensitive information. The pilot workflow does not authorize automated customer email.

Public and private information

Only content you explicitly publish is intended to be public. Enquiries and owner notes require an authenticated owner account. Authorized operators may access records for support and service operation. Cloudflare provides the application’s hosting and storage infrastructure. This notice does not assert a particular data residency or legal compliance certification.

Private draft recovery

The studio keeps an unfinished business draft in session storage in the current browser tab for up to 24 hours so you can recover it after refreshing. Save it to your account for durable storage. You can discard the tab copy; signing out clears your account’s tab copies. Passwords, recovery codes and customer enquiry records are not included in draft recovery.

Setup review briefs

You can download a plain-text brief made from saved website fields and the kit reference. It excludes account credential fields, conversation history, customer enquiry records and owner notes. Review the brief before sharing. An email-draft link opens your own mail application; you decide whether to send the message or attach the brief. Preparing a brief does not create an order or start a paid service.

Cookies and operational records

A secure, HttpOnly session cookie keeps you signed in. Private API responses are marked no-store. Platform logs may record request and error information for security and reliability. The application does not require Google or Gmail access.

Access, export and deletion

Use Your service to export the kit, requests and notes. Cancellation removes public availability while retaining private records for export. Contact support@aishakhatib.com to request correction or deletion. We verify account authority before acting. A timed deletion process and complete backup retention schedule must be confirmed before any promise of automatic deletion.

Keep your recovery code secure. Do not submit highly sensitive personal information through public enquiry forms. If you suspect unauthorized access, contact support promptly.