Privacy policy

1. Who we are

Lambbi is operated by [Company name], [postal address] ("we"). Contact: [contact email].

For account holders, Studio users and waitlist members, we decide how personal data is used (we are the controller). For the conversations visitors have with a business's assistant, the business decides, and we process that data on its behalf and on its instructions (we are its processor).

2. In short

• We collect what we need to run the Service: your account details, your assistants, their conversations, your payments, your alert settings, and for the Studio and the API a record of each charged use (its kind, length, cost, time and the key used) and a one-way fingerprint (hash) of each API key, never the key itself.
• Conversations are stored as text so the business can read them. The audio of calls is not recorded.
• We do not sell personal data, show advertising or use analytics or tracking tools.
• We do not train our models on your content or on conversations.
• Some providers that help us run the Service are outside Haiti, including in the United States and in China (section 8).

3. Businesses with an account

• Account: the email address and phone number you sign in with, your name and picture if you sign in with Google, and the date you joined. Sign-in codes are sent and checked by Bird (MessageBird), which receives the email address or phone number for that purpose.
• Business and assistants: your business name, your assistants' names, greetings, instructions, knowledge, appearance and logo, the websites where they may appear, and their settings.
• Your own AI key, if you add one: stored encrypted (AES-256-GCM), used only by your assistant, and never shown again.
• Credit and payments: your balance, the amount and status of each top-up, and for MonCash the transaction number and the phone number MonCash reports for the payer, or for a card the Stripe payment number and the email address given to Stripe. Payment itself happens on MonCash's or Stripe's page; we never see your MonCash PIN or your card number. We give Stripe your account email address to fill in its form.
• Alerts: the email address and WhatsApp number you choose to receive alerts, and which alerts were sent.

Purpose and basis: providing the Service under our contract with you, keeping accounting records as the law requires, and preventing abuse.

4. Visitors who talk to an assistant

When you talk to a business's assistant, on its website or through its link:

• Your voice is streamed live through LiveKit to our assistant service, then turned into text by Oswald on Modal. The audio is processed in memory and not recorded.
• What you say (as heard and as corrected), what you type, the assistant's answers, the time, the length of the conversation and the website it took place on are stored, so the business can read the conversation in its dashboard.
• To answer you, the conversation and the business's knowledge are sent to the AI provider the business uses: Lambbi AI, provided by DeepSeek, or the business's own OpenAI or DeepSeek account. The answer is read aloud by Fatiman on Modal.
• The conversation text is sent to TypeSafe (Jev) to tag it, for example as an order or a complaint, so the business can be alerted. An alert by email or WhatsApp, sent through Bird, may include the last words of the conversation.
• If the business connected its own systems (Tools), the details needed to answer you, such as an order number, are sent to them, and the call is noted with the conversation.
• Your IP address is used for a few minutes to apply limits, and is seen by LiveKit when your browser connects to the call.

The business that placed the assistant is responsible for these conversations: please read its privacy notice, and contact it to access or delete your conversation. We help the business answer such requests. Do not share sensitive information, such as health, payment card or identity document details, with an assistant.

5. The Studio

When you use the Studio to read text aloud or to transcribe a recording, our server sends the text or audio to Modal, which runs the models. It is processed in memory to produce the result, which is returned to you, and is not stored.

Your Studio history (clips, transcripts and recordings) is kept only in your own browser (IndexedDB). It is not sent to us. You can delete it with "Clear all" or by clearing this site's data in your browser.

6. The waitlist

If you join the API waitlist, we keep your email address, the use you chose, the note you wrote (if any) and the time you signed up, to tell you when the API opens and to understand what people need. The basis is your consent, which you can withdraw at any time by writing to us.

7. Who receives data

Only the providers we need to run the Service, acting on our instructions and only for the purposes above:

• [hosting provider]: hosting of the website and dashboard;
• [database provider]: storage of accounts, assistants and conversations;
• LiveKit (LiveKit, Inc., United States): live audio of calls;
• Modal (Modal Labs, Inc., United States): speech recognition and voice generation;
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): answers written by Lambbi AI and correction of what was heard;
• OpenAI or DeepSeek, when a business connects its own account: answers for that business's assistant, under the business's own agreement with that provider;
• TypeSafe: tagging of conversations (Jev);
• Bird (MessageBird): one-time sign-in codes by email, WhatsApp or SMS, and alert emails and WhatsApp messages;
• MonCash (Digicel Haiti): payments for credit;
• Stripe (Stripe, Inc., United States): card payments for credit;
• Google: sign-in, only if you choose "Continue with Google".

We do not sell personal data. We disclose data to authorities only when the law requires it.

8. Where data is processed

Our database and website are hosted in [hosting region]. LiveKit, Modal, OpenAI and Stripe process data in the United States, Bird in the United States and the European Union, and DeepSeek in China. Data therefore crosses borders to be processed. We limit what each provider receives to what it needs, and rely on their contractual commitments to protect it.

9. How long we keep data

• Account, assistants and knowledge: as long as your account is open, then deleted within [number] days of closing it, except what the law requires us to keep.
• Conversations: until the business deletes the assistant or closes its account.
• Payment records: for the period required by Haitian accounting and tax law.
• IP addresses used for limits: in memory, for at most one hour.
• Waitlist: until you ask us to delete it or the waitlist closes.

10. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to receive a copy of it, to object to its use or to withdraw consent. Account holders can download a copy of their data, or delete their account, from the Account page of the dashboard, or write to [contact email] and we will answer within 30 days. Visitors should first contact the business whose assistant they used; if you cannot reach it, write to us and we will forward your request. You may also complain to your data protection authority.

11. Automated processing

Answers, corrections of what was heard and conversation tags are produced automatically. They help the business serve its customers faster but do not produce legal or similarly significant decisions about you. A person at the business can always read the conversation and follow up.

12. Children

Accounts are for adults acting for a business. The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child's data has reached us, write to us and we will delete it.

13. Security

The site and calls are encrypted in transit (HTTPS and secure WebSockets). Each business can reach only its own data, AI keys are stored encrypted, and sign-in uses one-time codes or Google instead of passwords. No system is perfectly secure; if a breach affects your data, we will inform you and the authorities as the law requires.

14. Changes

We will update this policy when what we do with data changes. The date at the top shows the latest version. For important changes, we will tell account holders by email.