Privacy & Security

1. We use PostgreSQL with encryption to securely store your account and agent configuration data.
2. All communication between our Next.js frontend and Django backend is encrypted over HTTPS.
3. Authentication is handled securely, and your passwords are never stored in plain text.

When you connect a third-party service such as your Shopify store, we only request the permissions required to provide data for your conversational agents. We never sell or share your data with third parties.

Files and data connected to your agents are processed securely. We do not use your content to train external models or for advertising.

Companin uses artificial intelligence to power conversational agents. We want to be transparent about how AI is involved in processing your data:

• Responses delivered through the agent are AI-generated and may not always be accurate, complete, or appropriate. You should not rely on them as professional, legal, medical, or financial advice.
• To generate responses, messages and conversation context may be sent to our third-party AI model provider (OpenAI). This provider processes data under its own published terms, security commitments, and applicable data-processing agreements.
• Conversations and interactions with the agent may be logged and stored so that we can operate the Service, monitor quality, investigate abuse or security incidents, and improve performance.

The data you connect is used solely to power the conversational agents you create and integrate on your websites. This includes providing context for agents to answer queries, generate responses, and perform tasks based on your connected data and knowledge stores.

We do not sell your data or use it for advertising purposes.

All information is stored securely in PostgreSQL databases with encryption. Communication is encrypted via HTTPS. Passwords are hashed. Access is limited to authorized processes.

For a full overview of our technical and organizational security measures, visit our Security page.

We retain personal data only for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Conversation logs and account data are subject to retention windows that can be configured from your account, and you may request earlier deletion at any time. When personal data is no longer required, we delete or anonymize it.

You control your data. Disconnect integrations anytime. Request deletion of your account, agents, and data.

• Right to deletion — Request deletion of your account, agents, and associated data at any time from your settings or by contacting us.
• Right to data export — Request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent — Where we rely on your consent (for example, optional analytics or marketing communications), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right of access and correction — Request access to the personal data we hold about you and ask us to correct anything inaccurate or incomplete.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection laws, you have additional rights under the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent regulations. These include the right to access, correct, delete, restrict processing of, object to processing of, and port your personal data, as well as the right to lodge a complaint with your local data protection authority. We process personal data on lawful bases such as performance of a contract, your consent, compliance with legal obligations, or our legitimate interests, as applicable.

Organizations requiring a formal Data Processing Agreement can review our Data Processing Agreement (DPA).

We use cookies for login sessions and platform usage analytics. Disable in browser settings if preferred.

We may update this policy. Significant changes will be notified via email or in-app notice.