Privacy Notice

1. What we collect

• Sign-in details: the email address you give us, and the one-time links we send to it.
• Telegram identity: your Telegram user id and the bot your account is bound to. We need this to connect your chat to the right agent.
• Chat with your agent: the messages you send, the replies you get, and the tool calls and results in between.
• Your sandbox: the files you upload, the files your agent creates, and the commands it runs.
• Usage records: how many credits each action used, timestamps, the plan attached to you, and error records.
• Feasibility check requests: if you use the form at aight.to/check, the email, optional name, and what you write about your business, your tools, the job you want automated, your build budget, and your reply language, plus the country your request came from.
• Basic technical records: IP address and request information our servers log when you use the website or the service.

2. Why we collect it

• To create your account, send your sign-in link, and connect your agent to your Telegram chat.
• To run your agent, keep its memory and files, and carry out the tasks you ask for.
• To meter credits, bill paid plans, and prevent trial abuse.
• To answer a feasibility check request. A person on our team reads it and replies by email. We do not add you to the waitlist or send you promotional email because you asked for a check.
• To support you when something goes wrong, and to investigate abuse or a security issue.
• To recommend aight plans, features, and add-ons to you. We may look at your chat with your agent and how you use aight to decide what to offer, and send you those offers in your chat, by email, or in the product. You get these by default when you sign up; you can opt out by email at any time, see section 6.
• To meet legal, tax, and accounting duties, and to enforce our Terms and Acceptable Use Policy.

We do not sell your personal data, and we do not use it to show you advertising for other companies' products.

3. Who processes it

We use a small number of providers to run aight. They process data for us under their own terms, described below. We name them because the law requires us to disclose who processes your data. Naming a provider does not mean it endorses aight or works with us beyond supplying its service.

• Model provider — Tencent Cloud (Tencent Cloud International, Singapore). Your prompts, files, and the context your agent sends are processed by a language model served through Tencent Cloud's model service in Singapore to generate replies. The model is licensed by Tencent Cloud from a third-party model developer. Tencent Cloud processes that content under its service terms; unless we tell you that a written arrangement says otherwise, treat anything you send to your agent as content the provider may retain for the period its terms allow.
• Hosting provider — Tencent Cloud. Our control service and tenant servers, including your sandbox, run on Tencent Cloud infrastructure in Singapore.
• Email provider — Tencent Cloud Simple Email Service (Singapore). It delivers your sign-in link and service email, and sees your email address and the content of those messages.
• Chat platform — Telegram. You talk to your agent through Telegram, so your messages pass through Telegram's systems under Telegram's own terms and privacy policy before they reach us.
• Support tool — Lark (Lark Technologies Pte. Ltd., Singapore). Messages you post in the community group's #help topic, with your Telegram first name and username, are copied into our staff workspace on Lark so the team can answer them. Lark stores them under its own terms, possibly outside Singapore. Your private chat with your agent is never sent to Lark.
• Connected account provider — Google (Google LLC, United States). If you connect your Google account, Google sees that aight asked for read-only access to your Gmail and Calendar, and handles that request under Google's own terms and privacy policy. See section 3a.
• Inbound mail routing — Cloudflare (Cloudflare, Inc., United States). If you turn on email forwarding, mail sent to your private aight forwarding address passes through Cloudflare's email routing on its way to our servers. Cloudflare carries it and does not keep it for us. See section 3b.

We may also disclose data if the law requires it, if we need to protect someone's safety or our rights, or as part of a sale or reorganisation of the business, in which case we will tell you.

3a. Your Google account

This section applies only if you choose to connect your Google account. It is optional, and you can use aight without it. Connecting is a paid-plan feature that gives you a daily digest of your mail and calendar.

When you connect, you allow aight to do three things:

• read your Gmail messages;
• read your Google Calendar;
• see your Google account email.

That access is read-only. We never send, delete, label or change anything in your Google account.

Your agent reads your recent mail and upcoming events to write your digest and to answer you when you ask about them. We use this data only to give you that feature. We do not use it for advertising, and we do not sell it.

Text from your mail that your agent reads is processed by our model provider named in section 3 to write your digest, under the same terms, and is not used to train models.

How long it lasts: we keep the connection until you disconnect; digest text stays in your chat history like any other message.

To disconnect, open the Connections command from your bot's menu, then tap Disconnect. You can also remove aight in your Google account's security settings, or email admin@aight.to. When you disconnect, we revoke our access with Google and delete the stored connection and your daily digest.

If your plan ends, we revoke our access with Google and delete the stored connection.

aight's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3b. Forwarded email

This section applies only if you turn on email forwarding. It is optional, a paid-plan feature, and an alternative to connecting Google: you give your mail provider a private aight address and choose which mail it forwards there, and your agent uses that mail for your digest.

• What we keep: for each forwarded message, the sender, recipient, subject, date, the text of the message (up to about 16,000 characters) and the names of any attachments. It is stored encrypted on our servers in Singapore.
• What we do not keep: attachments themselves, and the original message as it arrived. We read what we need from it and discard the rest.
• How long: 7 days from when it arrives, then it is deleted automatically. Digest text your agent writes from it stays in your chat history like any other message.
• Who reads it: your agent reads it to write your digest and to answer you when you ask about it. Text your agent reads is processed by our model provider named in section 3, under the same terms. We do not use it for advertising, and we do not sell it.
• Your address: only you should know it. Anyone who has it can send mail to it, and that mail reaches your digest. You can get a new address at any time; the old one stops working at once.
• Gmail confirmation: when you add the address in Gmail, Gmail sends a confirmation message to it. We pass the confirmation code to you in your Telegram chat and keep that message for at most one day.
• Mail we refuse: mail for an address that does not exist is refused when it arrives. If a member forwards more than 300 messages in a day, the extra ones are discarded unread.

To stop, open the Connections command from your bot's menu, tap Email forwarding, then Stop forwarding, and turn off forwarding in your mail provider's settings. When you stop, or your plan ends, we delete your address and every forwarded message we hold.

4. Sending data outside your country

aight's servers are in Singapore. Our model, hosting, and email providers process data in Singapore. Telegram processes data on its own infrastructure outside Singapore. Lark may store copies of your #help posts outside Singapore. Google LLC, in the United States, receives only the read-only access request and your consent if you connect Google; the mail and calendar text it returns is processed in Singapore as section 3 describes. If you turn on email forwarding, forwarded mail passes through Cloudflare's network, which may route it through other countries, before it is stored in Singapore. If you use aight from another country, your data is transferred to and processed in those locations, where privacy laws may differ from the laws where you live.

By creating an account and using aight, you consent to those transfers and to the processing, including the delegation of processing to Tencent Cloud, Telegram, Lark, and, if you turn on email forwarding, Cloudflare, as described above. If you do not consent, do not use aight.

5. How long we keep it

• Chat, files, and sandbox: for your trial or paid period, then 14 days after it ends. After the 14-day keep we remove your agent and its files from our live systems; a backup copy is kept for up to 30 more days for recovery, then deleted. The deletion cannot be undone after that.
• Metering and billing records: up to 24 months, so we can reconcile usage, handle refunds and disputes, and meet accounting duties.
• Your email address: until you ask us to delete it, or as long as we need it to give you the service.
• Feasibility check requests: up to 12 months after we answer, so we can follow up if you go ahead, then deleted. Ask us at any time to delete yours sooner.
• Forwarded email: 7 days from arrival, then deleted; immediately when you stop forwarding or your plan ends. See section 3b.
• Server logs: a short period for security and troubleshooting, then deleted or aggregated.

Some records may be kept longer where the law requires it. When a retention period ends, we delete or anonymise the data.

Content already sent to the model provider is kept under its own terms; our deletion does not reach those copies.

6. Your choices

• Delete your data: email admin@aight.to from the address on your account at any time and ask us to delete your account and its data. We remove it from live systems; a backup copy is kept up to 30 days, then deleted. We confirm when it is done. Deletion cannot be undone.
• Export your data: email the same address and ask for a copy of your account data, chat, and files. We provide it in a common format within a reasonable time.
• Stop promotional messages: email admin@aight.to from the address on your account and ask us to stop. We stop within 10 business days. We still send messages you need to use the service, such as sign-in links, billing, and credit alerts.
• Ask a question or correct something: email us and tell us what is wrong. We correct details we hold about you.

If you are in a jurisdiction with a privacy regulator, you may also have the right to complain to that regulator. We would rather you came to us first.

Content already sent to the model provider is kept under its own terms; our deletion does not reach those copies.

7. Children

aight is only for people aged 18 and over. We do not knowingly collect or keep personal data of anyone under 18, and we do not knowingly collect data of children under 14. If you believe a child has given us data, email admin@aight.to and we delete it.

8. Security

Each member gets an isolated sandbox. Your bot token is stored encrypted, and the provider key that powers your agent never reaches your sandbox. Access to member data inside aight is limited to the people who need it for support, safety, operations, and recommending aight products to you. No system is perfect, so use a strong email account and do not put secrets in your chat that you would not want processed by our providers.

9. AI-generated output

Your agent's replies are generated by AI, not written or checked by a person. They may be wrong or incomplete. This notice covers the data that goes into and comes out of that process; it does not make the output factual. Always check output before you rely on it.

10. Changes to this notice

We may update this notice. When we do, we change the version and the date at the top of this page. If the change is material, we tell you by email or in the product before it takes effect.

11. Contact

Privacy questions, deletion requests, and export requests: admin@aight.to. We answer from that address only.