Privacy Policy

This policy explains what landers.io (“we”, “us”), operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], collects and why. It covers two groups of people:

• Visitors — people who chat with an AI assistant on a campaign page (landers.io/c/…) or in a chat window embedded on a business's own website.
• Operators — the businesses that sign up, build campaigns and read the results.

1. If you chatted with an assistant (visitors)

The assistant is an AI, not a person. It works for the business whose campaign you are on (the “operator”) and talks about that business's offer. The operator can read your conversation.

What we collect

• Your messages and the assistant's replies — the full conversation, including buttons you tap.
• Answers you give — things the assistant asks about (for example a budget or a preference). If you type contact details such as an email address, we store them encrypted.
• How you arrived — the link parameters from the ad or link you clicked (for example utm_source or a click id), the referring page, and for an embedded chat the page it was embedded on.
• Device and rough location — your browser's user agent, device type (mobile or desktop) and country, which our network provider (Cloudflare) tells us.
• IP address — we keep only a one-way, salted hash of it with your chat, to limit abuse. Our network provider and server logs see the raw address while handling the request.
• Activity in the chat — when it opened, when you started typing, whether the tab was visible, how far you scrolled, and clicks on the offer button.
• Whether you signed up or bought — if you click through to the operator's offer, the link carries a random click id. When the operator's tracking system reports a sign-up or sale for that click id, we record it with its status and payout.

The chat keeps a session token in your browser's session storage so a page reload continues the same conversation. We set no advertising cookies.

Why

• to run the conversation and answer your questions;
• to give the operator the transcript, your answers and campaign statistics, and to tell which versions of a campaign work best (in aggregate);
• to prevent abuse and keep the service up;
• to account for the cost of each conversation.

Who is responsible

For a campaign's conversations the operator decides what the assistant does and what happens with the results; we process the data on the operator's behalf. The operator's own privacy policy applies too — some campaigns link it instead of this page from the chat's “Privacy” link.

2. AI model providers

Each reply is generated by a third-party large language model. To write a reply we send the provider the conversation so far and the campaign's instructions and knowledge. We currently use DeepSeek and OpenAI (OpenAI also as a fallback and for search over campaign knowledge), and an operator may choose other models we offer — for example from Google, xAI, Moonshot AI, or models routed through OpenRouter.

These providers run their own infrastructure, some outside the UK and EU (DeepSeek, for example, processes data in China). We use their paid APIs under their terms; please see their own privacy policies for how they handle API data. We do not train models of our own on your conversations.

3. Monitoring and other service providers

• Observability (Pydantic Logfire) — traces and logs of requests and agent runs, which can include message content, so we can find errors and slow replies.
• Hosting — [HOSTING PROVIDER AND REGION].
• Cloudflare — network, security and delivery of the pages and chat.
• Backblaze B2 — database backups, in a private bucket.
• Resend — email to operators (sign-in, invitations). Visitors get no email from us.

We don't sell personal data or share it for advertising.

4. How long we keep it

• Visitor conversations, answers and activity — until the operator deletes the campaign or their account, or until you ask us to delete them (section 5). There is no automatic expiry yet.
• Sign-up and sale records — kept for the operator's accounting. If you ask us to delete your data we keep the record but remove its link to you and the details of the original request.
• Logfire traces — about 30 days. Server logs — rotated, kept a few weeks at most. Backups — nightly copies are kept for up to 8 weeks, so deleted data leaves the backups within about 8 weeks.

5. Your rights and deleting your chat

Depending on where you live you may have the right to access, correct, delete or export your personal data, and to object to or restrict its use. To ask, email [PRIVACY CONTACT EMAIL] with:

• the page or website where you chatted,
• roughly when (date and time, with time zone),
• and if you can, the click id — a random code in the address of the offer page the chat sent you to — or a sentence you wrote in the chat.

We delete the conversation, your answers and the activity records, and reply within 30 days. You can also ask the operator, who can forward the request to us.

6. If you run campaigns (operators)

• Account data — name, email, a hashed password, your organization and team.
• Campaign content — prompts, offers, knowledge, settings and uploaded images.
• Usage — request logs, errors and AI spend per campaign, to run, secure and bill the service.

We keep operator data while the account is active. You are responsible for telling your visitors about the campaign (for example with your own privacy policy, which you can set as the chat's privacy link) and for the legal basis of what you ask them.

7. Security

Traffic is encrypted in transit (TLS). Contact details visitors type are encrypted in the database, IP addresses are stored only as hashes, and access to conversations is limited to the operator's team and to us for support and security. What we store in your browser is listed in our Cookie Policy.

8. Children

Campaign chats are not meant for children under 16, and some campaigns are limited to adults. We don't knowingly collect data from children; if you think a child has chatted with an assistant, contact us and we will delete it.

9. Changes

We will update the date above when this policy changes, and tell operators in the app or by email before a material change takes effect.

10. Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy questions and requests: [PRIVACY CONTACT EMAIL].