Welcome to ShareYourAI (hereinafter referred to as "the Platform" or "we"). These Terms of Service (hereinafter referred to as "the Terms") constitute a legally binding agreement between you (hereinafter referred to as "User" or "you") and the Platform. By using the Platform, you agree to be bound by these Terms. If you do not agree, please do not use the Platform.
1. Definitions
In these Terms, the following expressions have the meanings set out below:
- "Service" refers to the AI knowledge assistant creation, management, and sharing platform provided by ShareYourAI, including but not limited to document uploading, AI conversations, share links, appearance editing, and API access.
- "User Content" refers to all files, documents, data, and other content you upload to the Platform, including but not limited to PDF, Word, Excel, plain text, Markdown, and HTML files.
- "AI Output" refers to the responses, summaries, and analysis results generated by the Platform's AI system based on your User Content and queries.
- "Knowledge Base" refers to the structured knowledge dataset formed after your User Content is processed by the Platform (including document parsing and vector embedding).
- "Share Page" refers to a page you create through the Platform that generates a public link, allowing visitors to interact with your AI assistant without registration.
- "Subscription Plan" refers to the service tiers offered by the Platform, including Free, Pro, and Business plans.
2. Acceptance and Modifications
By using the Platform, you acknowledge that you have read, understood, and agreed to all provisions of these Terms. The Platform reserves the right to modify these Terms at any time. Upon modification, we will notify you via email or in-platform notifications. If you continue to use the Service after modifications, you are deemed to have accepted the modified Terms. If you do not agree to the modified Terms, you should immediately stop using the Service.
3. Account and Registration
The Platform uses Google OAuth for authentication, requiring no separate registration process.
- Signing in with your Google account automatically creates a Platform account. The Platform will obtain your Google account name, email address, and profile picture.
- You are responsible for maintaining the security of your Google account. All activities conducted through your account are deemed to be your actions.
- Each user may only create one account. The Platform reserves the right to suspend or delete accounts found to be in violation.
- You warrant that the account information you provide is truthful and accurate.
4. Service Description
ShareYourAI is a RAG (Retrieval-Augmented Generation) knowledge management platform. Core features include:
- Document Upload and Knowledge Base Creation: Supports uploading documents in PDF, Word, Excel, CSV, TXT, Markdown, and HTML formats. The system automatically parses and creates a vectorized knowledge base.
- AI Conversations: Provides intelligent Q&A services powered by third-party large language models (currently OpenAI GPT and Google Gemini) based on your knowledge base.
- Share Links: Generates public share pages that allow visitors to interact with your AI assistant without registration.
- Smart Presentations: Transforms PDF documents into interactive presentations with AI conversation support (Pro plan and above).
- Appearance Editor: Customize the branding, colors, and layout of your share pages.
- API Access: Provides an OpenAI-compatible API interface to integrate AI capabilities into your applications (Pro plan and above).
- The Platform may add, modify, or discontinue features at any time, with reasonable notice to users.
5. Subscription Plans and Payment
5.1 Plan Description
The Platform offers three subscription plans: Free, Pro, and Business. Feature limitations and quotas for each plan are detailed on the Platform's pricing page, which forms part of these Terms.
5.2 Payment Processing
Payment services for paid plans are provided by TapPay, a PCI DSS compliant Taiwanese third-party payment service provider, and the Platform does not store your complete credit card numbers. Supported payment channels (credit card, ATM transfer, convenience-store codes, etc.), encryption, and protection details are described in the "Data Security" page (Payment Security section); the categories of data processed by the payment service provider are described in the "Privacy Policy" Section 4.1. We may add or change PCI DSS compliant payment service providers from time to time and will notify you via in-platform announcement or email before any change takes effect.
5.3 Billing and Renewal
Paid plans renew automatically through our payment service provider, TapPay, on the subscription date according to the billing cycle you choose (monthly or yearly). All paid plans and top-ups are currently priced and settled in New Taiwan Dollars (TWD); credit cards issued outside Taiwan are accepted, with the exchange rate and any foreign transaction fee determined by your card issuer. Upon first login, the Platform records your currency region (USD or TWD) based on your location, and this cannot be changed by the user; when USD billing becomes available, the Platform may apply the corresponding billing currency based on that record and will update these Terms before it takes effect.
5.4 Refund Policy
The Platform offers a 7-day self-service refund mechanism. Within 7 days of your most recent subscription charge, and provided that ALL of the following conditions are met, you may request a refund for that charge by selecting the corresponding record under "User Settings → Payment Management": (1) fewer than 7 days have passed since the charge; (2) your service usage for the current period remains below the Platform's threshold (i.e., you have not materially used the current period's quota); (3) the charge has not been refunded and has no refund request in progress; (4) you have not had a successful refund in the past 12 months (limited to once every 12 months). Refund requests are subject to review by the Platform (including automated eligibility checks and manual review) before any refund is issued; the Platform reserves the right to reject ineligible requests based on actual usage and anti-abuse considerations. Once a refund is completed, your plan will be changed to the Free plan immediately, and resources exceeding the Free plan's limits will be suspended but not deleted. While a refund request is in progress (under review, processing, or pending settlement), you may not change or re-subscribe to a plan; withdraw the request first if you need to make changes. If a new subscription charge (for example, an automatic renewal) has occurred before the refund is completed, the refund applies only to the original charge and your plan remains as paid for by the new charge. Funds will be returned to your original payment method through the original payment service provider (currently TapPay); the actual time to receive the funds depends on the payment service provider and your card-issuing bank (typically around 5 business days). In addition, unexpected charges caused by system errors, duplicate charges, or technical faults attributable to the Platform are not subject to the above conditions, and you may contact customer support for assistance. You may still cancel your subscription at any time, after which your plan will change to the Free plan at the end of the current billing cycle.
5.5 Plan Upgrades and Downgrades
Upgrades take effect immediately with instant access to new features. When upgrading, you pay the full price of the new plan, and a new billing cycle starts on the day of the upgrade; remaining days on the previous plan are not credited or appended to the new cycle. When upgrading between paid plans (e.g., from Pro to Business), unused visitor conversation credits from the previous plan's current period are automatically converted into top-up credits valid for 30 days upon completion of the upgrade (consumed only after the new plan's period credits are exhausted). This conversion applies only to upgrades between paid plans — first-time subscriptions from the free plan, recurring renewals, downgrades, and refunds are not eligible, and credits do not accumulate across periods. Downgrades take effect at the end of the current billing cycle. Resources exceeding the new plan's limits (AIs, share pages, API keys, etc.) will be suspended but not deleted. Upgrading back to the original plan will restore all suspended resources.
5.6 Auto Top-up
Paid-plan users may opt in to "Auto Top-up": when the account's visitor conversation credits (including any top-up balance) fall below the threshold you set, the Platform will automatically purchase the top-up pack you selected using the payment method bound to your subscription, up to the per-period limit you set (you may also choose no limit). Every automatic charge is invoiced and confirmed by email, and automatically purchased packs follow the same validity, consumption order, and refund rules as regular top-ups. If an automatic charge fails, the Platform pauses Auto Top-up and notifies you, and does not retry the charge; once your chosen limit is reached, no further charges are made, and the AI will stop replying to visitors when credits run out until you adjust the settings, top up manually, or the monthly quota resets. You may turn Auto Top-up off at any time under "Top-up"; doing so does not affect credits already purchased.
6. User Content and Intellectual Property
- Ownership: You retain all intellectual property rights to the User Content you upload. The Platform does not claim ownership of your User Content.
- Limited License: You grant the Platform a non-exclusive, worldwide, limited license to use, process, and store your User Content solely for the purpose of providing the Service (including but not limited to document parsing, vector embedding, AI retrieval, and response generation).
- AI Output: You may freely use AI-generated responses based on your knowledge base to the extent permitted by law. The Platform does not guarantee the accuracy, completeness, or suitability of AI Output.
- Legality Warranty: You warrant that the content you upload is legally owned by you or that you have obtained proper authorization, and that it does not infringe upon any third party's intellectual property rights, privacy rights, or other rights.
- Platform IP: The Platform's software, designs, trademarks, technology, and other intellectual property are owned by the Platform. You may not copy, modify, or distribute them without written authorization.
7. AI Service Special Terms
- Accuracy Disclaimer: AI-generated responses are produced based on the knowledge base documents you provide and may contain inaccurate or incomplete information. AI Output does not constitute professional advice (including but not limited to legal, medical, financial, or technical advice).
- Processing Method: Your content goes through document parsing, vector embedding, retrieval, and AI generation; the specific technical steps and data flow are described in the "Privacy Policy" Section 3.2.
- Third-Party AI Model: The Platform uses third-party AI models as its underlying AI service (currently OpenAI and Google Gemini; the specific models in use may change depending on the feature and service quality). Your queries and the relevant document fragments are sent to the provider's API while requests are processed and are subject to that provider's terms of service and privacy policy.
- No Model Training: The Platform will not use your User Content or conversation records to train AI models.
- Usage Responsibility: You should independently assess the suitability of AI Output and bear full responsibility for any decisions or actions taken based on AI Output.
- Connected apps: Pro and Business plan users may authorize an AI tool of their choice (via MCP) to create and adjust AIs on their behalf. Actions taken by that tool within the granted access are treated as your own actions, and resulting usage counts toward your normal limits. Only authorize apps you trust and disconnect them when no longer needed. The Platform is not responsible for the behavior or output of third-party AI tools or their providers' data handling.
8. AI Hallucination Risk and Pre-Publication Testing
Generative AI can produce content that sounds plausible but is factually wrong, commonly called an "AI hallucination". This section explains the nature of that risk, your duty to test before making your AI available to others, and the limits of the Platform's responsibility.
- Nature of hallucinations: Even when your knowledge base is accurate, the AI may still produce incorrect, outdated, or self-inferred content about specific facts such as numbers, dates, times, prices, addresses, contact details, plan contents, or legal provisions, and may improvise answers to questions your knowledge base does not cover. This is an inherent limitation of current generative AI technology and cannot be fully eliminated.
- Put specific facts in the knowledge base: Any specific fact you want the AI to answer accurately for visitors, including prices, opening hours, deadlines, quantities, specifications, addresses, phone numbers, and return or exchange conditions, must be written explicitly into your knowledge base documents and kept up to date when it changes. For anything not in the knowledge base, the AI can only guess or decline, and guessing is where hallucinations come from.
- Duty to test before publishing: Before you generate a share link, embed the AI on a website, connect it to LINE, or otherwise make your AI available to others, you must first test it in the Platform's "Chat Test" feature, covering the questions your audience asks most, sensitive or high-risk questions (for example amounts, legal, medical, or safety matters), and questions that require precise answers, and confirm that the answers meet your expectations. You should also spot-check periodically after publishing and re-test whenever you change the knowledge base or settings.
- In-app testing is not billed separately: Conversations in "Chat Test" do not count against your share link's visitor conversation quota and are not charged separately, but they remain subject to each plan's fair-use limits to prevent abuse.
- Tools the Platform provides: Features such as answer scope settings and "no data found" response templates can reduce the likelihood of hallucinations, but they are aids only and do not guarantee their elimination.
Disclaimer: AI answers are generated in real time by an AI model and are not written, reviewed, or endorsed by the Platform. The Platform accepts no liability for any loss, dispute, or liability caused to you or any third party (including your visitors and customers) by AI hallucinations or by incorrect or incomplete answers. You bear all consequences of making your AI available to others.
9. Acceptable Use Policy
When using the Platform, you must not:
- Upload any content that violates the laws of the Republic of China (Taiwan) or your local jurisdiction, including but not limited to content infringing intellectual property rights, pornography, violence, hate speech, or other illegal content.
- Use the Platform to distribute false information, fraudulent content, or malware.
- Reverse engineer, decompile, or attempt to hack or breach the Platform's systems.
- Use automated tools to mass crawl or scrape the Platform's data or content.
- Use AI assistants created through the Platform for illegal activities or actions that harm others' rights.
- Circumvent or attempt to circumvent the Platform's usage limits, quota controls, or security mechanisms.
- Impersonate any person or misrepresent your affiliation with any person or organization.
Upon discovering violations of the above rules, the Platform may immediately suspend or delete the relevant accounts and content without prior notice or refund.
10. Brand URL and Brand Handle Policy
Brand handles (@handle) and page short URLs provided by the Service are a license to use granted by the platform, not a transfer or grant of property or trademark rights. By setting or using a brand handle, you agree to the following:
- Brand handles are allocated on a first-come, first-served basis, provided that such use must not infringe any third party's trademark, name, or other legal rights;
- Registering or using another party's trademark, business name, or a public figure's name in a manner likely to cause confusion or impersonation is prohibited, as is hoarding, offering for sale, or transferring brand handles for value;
- Certain well-known brand names are placed on a brand protection list and are only available to rights holders verified by the platform;
- Trademark or name rights holders may file a complaint with supporting documentation; where the platform determines bad-faith registration or impersonation, the brand handle may be reclaimed without compensation;
- Good-faith use of an identical name (e.g. your legal name or a long-operating business of the same name) must adopt a distinguishable variant (for example, a user surnamed McDonald may use mrmcdonald), rather than the exact form of a well-known trademark on its own; good-faith variants will generally not be reclaimed, and the platform will consider actual usage in each case;
- The platform reserves the final right to reclaim, suspend, or reassign any brand handle upon reasonable notice, in response to complaints, legal requirements, or as necessary to maintain service integrity;
- If a subscription downgrade or termination means you no longer qualify for the brand URL feature, your brand handle is reserved for 60 days from the loss of eligibility; restoring a qualifying plan within that period lets you keep it. Once the reservation period expires, the platform may release the handle and make it available for others to claim.
11. Third-Party Services
The Platform relies on third-party cloud services and SaaS providers for full functionality (covering authentication, AI models, payments (provided by TapPay), file storage, database, vector database, and similar). The complete current list of providers and the categories of data each one processes are described in the "Privacy Policy" Section 4.1. By using the Platform, you agree to the respective terms of service and privacy policies of those providers.
The Platform is not responsible for the availability, accuracy, or security of the above third-party services. The Platform bears no liability for impacts caused by third-party service interruptions or changes.
12. Disclaimers
- The Service is provided on an "as is" and "as available" basis. The Platform makes no express or implied warranties regarding uninterrupted service, error-free operation, security, or fitness for your particular purpose.
- The Platform does not guarantee the accuracy, completeness, reliability, or timeliness of AI Output. AI responses may contain errors or outdated information.
- The Platform does not guarantee that you will achieve any specific business objectives or results through the Service.
- The Platform bears no liability for service interruptions or losses caused by force majeure events, including natural disasters, war, government actions, cyberattacks, or other circumstances beyond reasonable control.
13. Limitation of Liability
To the maximum extent permitted by law:
- The Platform shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data loss, goodwill damage, or business interruption.
- The Platform's cumulative liability for any damages arising from the Service shall not exceed the total fees actually paid by you to the Platform in the 12 months preceding the event giving rise to the damage.
- The above limitations do not exclude any statutory rights that cannot be excluded under the laws of the Republic of China (Taiwan).
14. Indemnification
You agree to indemnify and hold harmless the Platform and its personnel and partners from any claims, damages, losses, or expenses (including reasonable attorney's fees) arising from:
- Your violation of any provision of these Terms.
- Your uploaded content infringing any third party's rights.
- Any illegal conduct in your use of the Service.
15. Term and Termination
- To delete your account, please contact us at [email protected] (self-service account deletion is not yet available). Upon account deletion, all your data (including AIs, knowledge documents, conversation records, and share pages) will be permanently removed. This action is irreversible.
- The Platform may suspend or terminate your account access for violation of these Terms or other reasonable grounds.
- After account termination, you must stop using the Service. Provisions regarding intellectual property, disclaimers, limitation of liability, and general terms shall survive termination.
- If the Platform decides to cease operations, we will notify users at least 30 days in advance and provide a reasonable data export period.
16. General Provisions
- Governing Law: These Terms shall be governed by and construed in accordance with the laws of the Republic of China (Taiwan).
- Jurisdiction: Any disputes arising from these Terms shall be submitted to the Taiwan Taipei District Court as the court of first instance.
- Severability: If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
- Entire Agreement: These Terms (together with the Privacy Policy and pricing page content) constitute the entire agreement between you and the Platform, superseding any prior oral or written agreements.
- No Waiver: The Platform's failure to exercise or delay in exercising any right under these Terms shall not be deemed a waiver of such right.
- Non-Transferability: You may not assign or transfer any rights or obligations under these Terms to any third party without the Platform's written consent.
ShareYourAI (hereinafter referred to as "the Platform" or "we") takes your privacy very seriously. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, as well as the rights available to you. This policy applies to all your interactions with the Platform's services.
1. Information We Collect
1.1 Information You Provide
- Account Information: Name, email address, and profile picture obtained through Google OAuth sign-in.
- Payment Information: Credit card and payment details processed through PCI DSS compliant payment service providers (currently TapPay) for paid subscriptions. The Platform only stores encrypted tokens returned by the processor along with the last four digits and card type; complete credit card numbers are never stored.
- User Settings: Preferences you configure on the Platform, including language settings, AI configurations, and appearance customizations.
- Feedback: Comments and issue descriptions submitted through the Platform's feedback feature.
- Beta access requests: The email address, name, applicant type, organization name (when applying on behalf of an organization), and use-case description you submit through the “Request an invite” form, used solely to review beta eligibility and send invite codes.
1.2 Content You Upload
- Knowledge Documents: Files you upload in PDF, Word, Excel, CSV, TXT, Markdown, HTML, and other supported formats.
- Conversation Content: Message records from your conversations with AI assistants.
- AI Configuration Data: Role names, instructions, and response templates you set for your AI assistants.
- Third-Party Integration Credentials: Access credentials (channel secret and access token) you provide when connecting a third-party messaging channel (such as a LINE Official Account). They are stored encrypted, used solely to send and receive messages on that channel on your AI's behalf, and deleted when you disconnect the integration.
- Google Calendar connection (optional feature): when you connect Google Calendar in your booking settings, we store the Google authorization credential (encrypted, used only on our servers), the email address of that Google account (to show which account is connected), and the list of calendars you choose to avoid. When you disconnect, the credential is deleted; to fully revoke access, you can also remove the Platform from your Google Account security settings.
1.3 Automatically Collected Information
- Device Information: Browser type, operating system, screen resolution.
- Usage Records: Login times, feature usage frequency, page view history.
- IP Address: Used for security verification and region determination.
- Cookies and Similar Technologies: Used to maintain login sessions and preference settings (see Section 5 for details).
1.4 Information Provided by Visitors
- Conversation Content: Messages exchanged when visitors interact with an AI assistant through share pages, the website assistant, or a third-party messaging channel (such as a LINE Official Account) connected by the AI's owner. When interacting through a third-party channel, we also receive the pseudonymous user identifier issued by that platform (such as a LINE user ID), used to keep the same visitor's conversation context; we do not use it to obtain the visitor's name or profile on that platform.
- Contact Details: Name, company, contact information (phone, email), preferred contact time, related URLs, and request descriptions that visitors voluntarily leave during the contact flow, plus any additional details the owner has set up an AI skill to ask for (such as budget, number of people, or a listing of interest), along with the names of the link cards the AI showed the visitor in that conversation. This information is relayed to the AI's owner after the visitor confirms and submits it (see Section 12). If the owner enables the booking confirmation feature, the email address a visitor leaves during the booking flow is also used to send the visitor booking status notifications (submission confirmation, booking outcome, a pre-appointment reminder, or a reminder to contact the owner directly); these are fixed-format transactional emails, and visitors can stop receiving them at any time via the link in the email. If the owner sets a sign-up limit in an AI skill, the system records the status of each sign-up (confirmed, waitlisted, or cancelled) and uses hashed values of the contact details and of any sign-up details the owner chose for recognizing the same person (such as a member number) to tell whether the same person signs up twice (these details are not stored again in plain text); when a waitlisted visitor is moved to a confirmed spot (by the owner, or automatically when someone cancels), the system notifies that visitor with a fixed-format email (which can also be opted out of via the link in the email). While the owner keeps the sign-up open, visitors can ask the AI to change or cancel a sign-up they submitted in the same conversation; the change takes effect only after the visitor confirms and submits it. Once the owner closes the sign-up, submitted sign-ups stay on the owner's list, and visitors should contact the owner directly to change or cancel. Sign-up records are deleted together with the related contact submission or skill. If the owner has connected Google Calendar, bookings the owner accepts are written to the owner's own Google Calendar, including the AI name, the visitor's name, the booking number, the time slot, party size or branch, the contact details the visitor left, a summary of the request and the owner's reply — but not the conversation itself. Once written, the event is kept by Google under the owner's account, and the owner can edit or delete it in Google Calendar.
- Conversation Images: Images visitors upload during conversations (see Section 12 for how they are handled).
2. Purpose of Data Collection
In accordance with Article 8 of the Personal Data Protection Act of the Republic of China (Taiwan), we inform you of the specific purposes for collecting your personal data:
- Service Provision: Account creation and management, AI knowledge base construction and conversation services, share link functionality.
- Payment Processing: Subscription billing and invoice management.
- Security Protection: Preventing unauthorized access, detecting anomalous behavior, protecting the Platform and user safety.
- Service Improvement: Analyzing usage trends, improving features and user experience.
- Customer Communications: Sending service notifications, billing notices, important updates, and feature changes.
- Legal Compliance: Fulfilling obligations required by the laws of the Republic of China (Taiwan), including tax reporting and compliance with court orders.
3. How We Use Your Information
3.1 Service Provision
We use your account information for authentication and account management, and use your uploaded documents to build knowledge bases and provide AI conversation services.
3.2 AI Processing Workflow
Your uploaded documents undergo the following processing workflow:
- Document Parsing: The system parses document content into text.
- Chunking: Text content is split into appropriately sized segments.
- Vector Embedding: Each segment is converted into mathematical vectors through embedding models and stored in the Qdrant vector database.
- Retrieval and Generation: When users ask questions, the system retrieves the most relevant vector segments, which are sent along with the query to a third-party AI model provider's API (currently OpenAI or Google Gemini) for response generation.
Please note: Data sent to third-party AI providers (OpenAI, Google) is governed by the respective provider's privacy policy. We only send the data needed to process that specific request.
3.3 Analytics and Improvement
We may use de-identified aggregate data to analyze service usage trends and improve features and user experience. We do not use your personal conversation content for marketing or advertising purposes.
4. Information Sharing and Disclosure
We do not sell your personal data. We only share your information in the following circumstances:
4.1 Third-Party Service Providers
We use the following third-party services, which may process some of your information:
- Google (OAuth authentication, Gemini AI and embedding models; and Google Calendar when you connect it yourself) — Processes your account information, conversation queries, and document vectorization; when Google Calendar is connected, also processes the booking details written to your calendar and the free/busy lookups.
- OpenAI (GPT models) — Processes your conversation queries, the relevant knowledge fragments, and images uploaded in conversations to generate AI responses.
- TapPay (payment processing) — Processes your credit card and multi-channel payment information, including charges and refunds. TapPay is a PCI DSS-compliant Taiwanese payment service provider. We may add or change payment service providers from time to time and will notify you before any change.
- Cloudflare R2 (file storage) — Stores your uploaded original documents.
- Supabase / AWS (database) — Stores your account data, conversation records, and related settings. The database is located in the AWS Tokyo, Japan region.
- Qdrant Cloud (vector database) — Stores vectorized embedding data from your documents.
- Resend (email delivery) — Sends notification emails on our behalf (billing receipts, security verification codes, visitor contact notifications, booking status notifications, etc.); email content may include relevant account information or visitor contact details.
- Pexels (stock media search) — Processes the search keywords you enter in the media library in order to return matching free stock images.
4.2 Legal Requirements
When required by law or by judicial authority orders, we may need to disclose your information, including but not limited to responding to court subpoenas, search warrants, or government investigations.
4.3 Business Transfers
In the event of a merger, acquisition, or asset sale of the Platform, your information may be transferred as part of the transaction. We will notify you before the transfer and ensure the receiving party maintains privacy protection standards equivalent to this policy.
4.4 With Your Consent
Outside the circumstances described above, we will seek your explicit consent before sharing your personal data. For example, Pro and Business plan users can authorize an AI tool of their choice (such as Claude or Cursor connected via MCP) in User Settings → Connected apps to create and adjust AIs on their behalf. The authorization screen shows the app's name and source and requires you to press Allow; once authorized, the content that tool reads or writes at your direction (AI settings, knowledge, design, skills, test conversation results, etc.) is sent to that tool for processing and is subject to its provider's terms and privacy policy. You can disconnect at any time, effective immediately.
5. Cookies and Tracking Technologies
The Platform uses three categories of cookies and similar technologies — strictly necessary, functional, and first-party analytics — to keep you signed in, remember preferences, and improve the service. We do not run advertising trackers and do not integrate third-party advertising analytics.
For the full list of cookie categories, retention periods, third-party cookies, and management options, please refer to the "Cookie Policy" page.
6. Data Storage and Security
Your data is stored with cloud providers in the Asia-Pacific region (Supabase / AWS, Cloudflare R2, Qdrant Cloud) and protected by multiple layers including transport encryption, at-rest encryption, strict access control, and tenant isolation. The full description of infrastructure, encryption algorithms, application-layer defences, AI safety measures, payment security, and vulnerability reporting is provided on the "Data Security" page.
In the event of a personal data breach, we will notify affected individuals by appropriate means in accordance with the Personal Data Protection Act of the Republic of China (Taiwan) and take necessary remedial measures.
7. International Data Transfers
To provide the Service, some of your data may be transferred to regions outside the Republic of China (Taiwan) for processing and storage (including Japan, the United States, and other cloud service regions). We ensure these transfers comply with applicable data protection laws and require data recipients to provide adequate security protection measures.
8. Data Retention
We retain your data according to the following principles:
- Account Data: Kept for as long as your account exists; we do not delete accounts for inactivity or set a maximum lifetime. When an account is deleted (at your request, or by us under these Terms), its personal data is removed from the database immediately.
- User Content (knowledge documents, conversation records): Kept for as long as your account exists. You can delete knowledge documents and conversations on the Chat Test page at any time; test conversations in the side test panel on other pages are not kept in your conversation list and are deleted automatically after 7 days; visitor conversations from share pages cannot currently be deleted one by one, but are removed when you delete the AI. Deleting your account removes all of it.
- External API conversation logs (OpenAI-compatible API): Same as visitor conversations — kept while your account exists, cannot currently be deleted one by one, removed when you delete the AI or your account.
- Website assistant sessions: Visitors' anonymous sessions (session identifier, device fingerprint hash, IP address, browser and language, AI-generated behavior summary) are not linked to any account, expire after 24 hours and are deleted 7 days after expiry. When you use the assistant signed in, the session is linked to your account (also expiring after 24 hours) so that, when you ask, the assistant can look up your plan, quotas, each AI's setup progress and skill status, share-link status and lead counts (never your email, payment details, API keys or visitors' personal data); lookup results are kept only as part of the conversation, not stored separately. They are removed when your account is deleted.
- Payment Records: Under the tax and business accounting laws of the Republic of China (Taiwan), billing records may be kept for up to 7 years after account deletion.
- Usage Records and Analytics Data: De-identified aggregate data may be kept longer to improve the service.
- Unsupported requests from "Write it with AI": We keep an AI-written summary of what you wanted, why it isn't possible yet and the closest alternative, to decide which features to add. It may include names from your description, so we do not treat it as de-identified; it is kept for at most 180 days and removed when your account is deleted.
- Files visitors upload through AI skills: Files set to "send to the owner" are kept with the submission for 30 days; "AI only" files keep only their extracted text for 30 days. Skills that collect contact details with files attached hold the original for 24 hours: files the visitor checks and sends on the confirmation card go to the owner (kept 30 days from upload, with download links in the email); unchecked originals are deleted when the hold ends. The upload card tells visitors in advance that they confirm before anything goes to the owner.
- Files created by AI skills: Files the AI makes for a visitor (PDF, Word, Excel, etc.), with their source and first-page preview, are stored on Cloudflare R2 and in our database. Anyone with the download link can download them for 7 days, after which they are deleted automatically; records such as file name and creation time are kept for 45 days to count monthly usage. Everything is deleted immediately when you delete the AI or your account. These files go only to that visitor — not to the owner, and not into the knowledge base. Reference files the owner uploads are used only to create a layout and are not stored; the first page of a PDF is kept as an image in that AI's appearance assets as the layout's original for the AI to compare against, and the owner can delete it at any time.
- "Instant alert" AI skill: The visitor's question and own words (up to 300 characters) are emailed to the owner and to recipients who agreed via a confirmation email (every email lets them stop). If the owner links LINE or one LINE group, they are also sent through that AI's LINE Official Account (every group member can see and reply; in the group the account only handles linking and replies that quote a question, and does not store other group conversation or pass it to the AI). The first reply goes to the visitor (visitors on LINE receive it from the same Official Account), and the reply page shows who replied. Questions, visitors' words and replies are kept for 30 days; recipients' addresses and consent/unsubscribe records are kept until the AI is deleted; everything is deleted immediately when you delete the AI or your account.
- Backup Data: Data in backups is removed at the next backup rotation.
- Connected apps (MCP): Authorization records (app name, source URL, authorization and last-used times) are kept for 90 days after you disconnect, for security auditing and to recognize stolen old credentials, and deleted immediately if you delete your account; access credentials are stored only as hashes and deleted 7 days after expiry; a log of each operation (name, target AI, success or failure, duration — no content) is kept for 90 days for security auditing and troubleshooting.
- Google Calendar connection: the authorization credential is kept until you disconnect, revoke access in your Google Account, or delete your account; after disconnecting, only a connection record (the Google account email that was connected and the connection status) remains until your account is deleted; the sync record for each booking (which calendar event belongs to which booking, and its sync status) is kept until that booking is deleted. After you disconnect, we no longer write to or check your calendar. Events already written to Google Calendar belong to your Google account; we do not delete them, and you can manage them in Google Calendar.
9. Your Rights
In accordance with Article 3 of the Personal Data Protection Act of the Republic of China (Taiwan), you have the following rights regarding your personal data:
- Access and Review: You have the right to query and review your personal data held by the Platform.
- Request Copies: You have the right to request copies of your personal data.
- Supplement or Correct: You have the right to supplement or correct incomplete or inaccurate personal data.
- Request Cessation: You have the right to request the Platform to stop collecting, processing, or using your personal data.
- Request Deletion: You have the right to request deletion of your personal data. Please contact us at [email protected] for assistance (self-service account deletion is not yet available).
How to Exercise Your Rights: Please contact us at
[email protected]. We will respond within 30 days of receiving your request. In accordance with the Personal Data Protection Act, the Platform may charge necessary costs.
10. Children's Privacy
The Platform does not target its services to children under the age of 16. We do not knowingly collect personal data from children under 16. If we discover that we have inadvertently collected personal data from a child, we will promptly delete it. If you believe we may have collected data from a child, please contact us.
11. Google API Usage Disclosure
The Platform uses Google OAuth for authentication, and offers optional Google Drive and Google Calendar features that you can choose to enable. Regarding the use of Google user data, we declare the following:
- Sign-in: we obtain the Google data necessary for account verification (name, email, profile picture) through Google OAuth.
- Live cloud documents (optional feature): if you enable Live Cloud Documents, we additionally request the Google Drive drive.file scope. This scope is limited to the individual files you actively choose through the Google file picker; we cannot browse or access any other content in your Drive. The file content retrieved is used solely to sync that file as a knowledge source for your AI. You may remove the link at any time within the platform, or revoke access from your Google Account security settings.
- Google Calendar (optional feature): if you connect Google Calendar in your booking settings, we request these scopes: create and manage calendars created by the Platform (calendar.app.created — we create one "ShareYourAI bookings" calendar in your account and only add, move and delete booking events on that calendar); read your calendar list (calendar.calendarlist.readonly — used only to let you choose which calendars to avoid); and check free/busy times (calendar.freebusy and calendar.events.freebusy — we only learn whether the chosen calendars are busy or free at a given time, never the titles, details or attendees of your events). We cannot read or change events on your other calendars. You can disconnect at any time in your booking settings, or revoke access from your Google Account security settings.
- We do not use Google user data obtained through the API for AI model training or marketing purposes, and we do not sell it to third parties.
- The Platform's access to, use of, and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.
12. AI Data Processing Notice
- Model Training: We do not use your User Content, conversation records, or personal data to train AI models. Your data is used solely to provide AI conversation services to you.
- Scope of data sent: the knowledge content sent to third-party AI services (OpenAI, Google Gemini) follows one of two paths depending on the size of your knowledge base. For larger knowledge bases, only the passages retrieved for that specific question are sent. For smaller knowledge bases, the knowledge content is sent in full to improve answer accuracy, and the citations shown in the conversation are marked "fully studied". In both cases the data is transmitted only while your request is being processed, and is not retained or used for training.
- Visitor Data: Conversations of visitors who interact with your AI assistant through share links are recorded and can be viewed in your conversation logs. Visitors are informed of this before use. If a visitor voluntarily leaves contact details (such as name, phone, email, or related URLs) or attached images during the contact flow, this information (including any additional details the owner has set up an AI skill to ask for, and the names of link cards viewed in that conversation) is stored and relayed to the AI's owner together with a summary of the request — by an immediate email, in a daily digest email, or only in the owner's contact list export, depending on the owner's notification setting. When the owner enables the booking confirmation feature, the system also sends the visitor fixed-format booking status emails, which the visitor can opt out of via the link in the email. If the owner requires an email to enter a share page, the email a visitor provides and verifies for that purpose is stored on that page's guest list and shown to the owner for approving, suspending, and managing usage; when the owner approves, the system notifies the visitor with a fixed-format email. If you set a sign-up limit in an AI skill, the system takes a spot or adds the visitor to the waitlist when they submit their contact details, and does not accept them when it is full or past the deadline; when a waitlisted visitor is moved to a confirmed spot (by you, or automatically when someone cancels), the system notifies that visitor with a fixed-format email (if they left an email); while you keep the sign-up open, visitors can ask the AI to change or cancel their own sign-up, which takes effect once they confirm and submit it; once you close it, visitors can no longer change or cancel through the AI, and you handle any such requests yourself. If you turn on the "Instant alert" skill for an AI, when a visitor asks something a person needs to decide, the question as summarized by the AI and the visitor's own words are sent to your email (and your linked LINE or LINE group) and to other recipients you designate who have agreed to receive them, and the first reply is passed on to that visitor; you should only designate people involved in your business who can reply on your behalf; if you link a LINE group, every member of the group sees visitors' questions, and you are responsible for managing who is in the group.
- Conversation Images: Images uploaded during conversations are sent to third-party AI services (OpenAI or Google Gemini) for content understanding. The Platform keeps only the AI-generated text description as conversation context and does not store the original images, except for images voluntarily provided by visitors during the contact flow, which are stored and relayed to the AI's owner.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For significant changes, we will notify you via email or in-platform notifications. The modified policy takes effect upon publication. If you continue to use the Service after a policy change, you are deemed to have accepted the modified policy. We recommend reviewing this policy periodically.
This Cookie Policy explains how ShareYourAI ("the Platform") uses cookies and similar technologies when you use our website, applications, and shared pages. It should be read alongside our Privacy Policy.
1. What Are Cookies
Cookies are small text files that your browser stores on your device when you visit a website. They allow a site to remember your actions and preferences (such as login state and language choice) so you don't have to re-enter them on every visit. In addition to cookies, we also use similar browser-side technologies such as localStorage and sessionStorage; this policy refers to all of them collectively as "cookies".
2. Why We Use Cookies
We use cookies for the following purposes:
- Maintain your signed-in state so you don't have to re-enter your password
- Identify visitor sessions on shared pages so conversations stay continuous
- Remember your language preference, UI settings, and other customisations
- Protect the platform and users from CSRF, cross-site, and similar attacks
- Understand overall platform usage so we can improve features and reliability
3. Categories of Cookies We Use
Based on purpose and necessity, we group cookies into three categories. The examples below cover the main cookies currently in use; specific names and contents may change as the product evolves.
3.1 Strictly Necessary Cookies (cannot be disabled)
These cookies are required for the platform to operate. Without them the service would not function, so under applicable law they do not require your consent:
- Authentication token (HttpOnly, Secure, SameSite=Lax): identifies you as a signed-in member, valid for ~4 hours
- Refresh token (HttpOnly, Secure): silently extends your sign-in session, valid for ~14 days
- Google sign-in transaction cookie (HttpOnly, Secure, SameSite=Lax): confirms that the browser completing Google sign-in is the one that started it, so nobody can hand you a sign-in that lands you in their account; valid for 10 minutes and cleared once sign-in finishes
- Website assistant visitor ID: keeps a visitor's conversation continuous across pages and reloads, valid for ~24 hours
- Shared page visitor session ID: used for usage quota counting and abuse protection, valid for ~7 days
- Shared page password verification: avoids re-entering the password each time a password-protected shared page is opened, valid for ~7 days
- Shared page privacy notice acknowledgement: records that a visitor has been shown the privacy notice so it does not reappear, valid for ~30 days (see Section 4 "Consent Model" below)
3.2 Functional Cookies
These cookies remember your preferences and improve the user experience. Disabling them does not affect core functionality:
- Language preference: remembers your locale (zh-TW / en) so it is applied automatically next time
- UI state: such as sidebar open/closed state, recently used features, etc.
- Browser localStorage: used for draft autosave inside the editor and similar local-only features
3.3 Analytics Cookies
We run our own first-party analytics to understand how the platform is used so we can spot friction and improve the experience:
- Event ID: links a single user's actions into a behavioural flow (hashed or anonymised)
- Page time and interaction events: clicks, scrolls, form submissions, etc.
- Technical environment: aggregated stats about browsers, OS, screen size, and similar information
We do not use third-party advertising trackers such as Google Analytics or Meta Pixel, and we never sell or share your browsing behaviour.
4. Consent Model (Implied Consent)
We currently operate under an implied-consent model. The model works as follows:
- We only use strictly necessary and functional cookies, and we do not run advertising trackers or third-party analytics scripts such as Google Analytics
- When a visitor first opens a shared page, a Cookie and Privacy notice banner appears at the bottom of the screen with links to the Cookie Policy and Privacy Policy; continued use constitutes consent to the full contents of both policies
- By continuing to use the service (signing in, starting a conversation, browsing a shared page) you are deemed to understand and accept the cookie practices described in this policy
- If you disagree with our cookie practices, please disable cookies in your browser as described in Section 7, or stop using the service
- If laws or our service evolve to require it, we will switch to an explicit-consent model and notify you accordingly
5. Third-Party Cookies
Some features rely on third-party providers that may set their own cookies. We do not directly control these cookies and recommend reviewing the relevant providers' privacy policies:
- Google OAuth: short-lived authentication cookies during the Google sign-in flow, or when you connect a Google service (such as Live Cloud Documents or Google Calendar)
- TapPay: secure cookies set by the payment processor during the payment flow, including 3D Secure verification
- Cloudflare: security and performance cookies as part of CDN and DDoS protection
- Font services (Google Fonts): some public pages request web fonts from Google's font service. It does not set cookies, but your IP address is disclosed to that service when fonts are loaded.
6. Cookie Duration
Depending on purpose, cookies fall into two categories:
- Session cookies: only valid while the browser tab is open and cleared when the browser closes
- Persistent cookies: stored on your device for a defined period, after which they expire automatically. Examples: auth token ~4 hours, refresh token ~14 days, language preference ~1 year
7. Managing or Disabling Cookies
You can manage cookies at any time using the following methods:
7.1 Browser settings
All major browsers let you view, delete, or block cookies. Refer to your browser's documentation for the exact path:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Preferences → Privacy
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Edge: Settings → Cookies and site permissions
7.2 In-platform options
Signing out of your account clears the auth-related cookies. To delete your account along with all backend data, please contact us at [email protected] (self-service account deletion is not yet available).
7.3 What happens if you disable cookies
If you disable strictly necessary cookies, you will be unable to sign in or complete payments. Disabling functional or analytics cookies will mean some preferences are not remembered, but core functionality remains intact.
8. Do Not Track Signals
There is no industry-wide standard for honouring browser Do Not Track (DNT) signals, so the platform does not respond to DNT automatically. However, we do not use third-party advertising trackers, so your browsing behaviour is not shared with advertisers.
9. Changes to This Policy
This Cookie Policy may change as our service evolves or as regulations require. We will notify you of material changes via in-platform notice or email. Refer to the date at the top of this page for the latest update.
We treat security as part of the product, not as an afterthought. This page describes the technical and operational measures ShareYourAI uses to protect your account, knowledge content, and payment information.
1. Security Principles
Our security design follows five core principles:
- Least privilege: every component can access only the minimum data needed for its task
- Defence in depth: protections are applied at the transport, application, and data layers so a single failure is not catastrophic
- Secure by default: new features ship with the strictest settings and require an explicit choice to relax them
- Tenant isolation: a multi-tenant architecture strictly separates data between users
- Continuous verification: every request re-checks identity and permissions instead of relying on a single sign-in
2. Infrastructure & Hosting
We host on cloud providers with internationally recognised security certifications, with servers located in Asia-Pacific regions for compliance and low latency:
2.1 Application servers
The service runs on Google Cloud Run (asia-northeast1, Tokyo). Google operates the underlying physical and virtual infrastructure under ISO 27001, SOC 2, and PCI DSS standards.
2.2 Relational database
Account data, subscription records, and conversation history are stored on Supabase (PostgreSQL on AWS Tokyo) with automatic daily backups retained for 7 days and stored separately from the database.
2.3 File storage
Uploaded documents, images, and avatars are stored in Cloudflare R2 object storage. Files are renamed using UUIDs, namespaced by user ID, and accessed via signed URLs.
2.4 Vector database
Document embeddings are stored in Qdrant Cloud. Each user has a dedicated Qdrant Collection named by user ID; cross-user queries are blocked at the database layer.
3. Encryption
3.1 In transit
All network traffic to and from the platform — browser, API, webhook — is forced over HTTPS / TLS 1.2+. We send HSTS headers to prevent downgrade attacks, and Cloudflare provides DDoS protection and edge encryption.
3.2 At rest
Cloud providers automatically encrypt all data at the storage layer:
- Supabase / AWS: AES-256 encryption for all database files and backups
- Cloudflare R2: AES-256 at-rest encryption for every object
- Qdrant Cloud: disk-level encryption
3.3 Sensitive material
Card and binding tokens are additionally AES-CBC encrypted before they reach our database. Passwords (such as share-page password protection) are stored using an industry-standard slow hash (bcrypt) and cannot be reversed. API keys are kept only as SHA-256 hashes — once lost they can only be regenerated, never recovered. Long-term authorization credentials obtained when you connect Google services such as Google Calendar are likewise encrypted before they reach our database, used only on our servers, never sent to the browser, and deleted when you disconnect.
4. Authentication & Access Control
We support multiple authentication methods and require identity verification for every API call:
- Google OAuth 2.0: sign-in goes through Google's official flow; we never see your Google password
- Two-factor authentication (2FA): users can enable TOTP-based 2FA in their account settings; it is mandatory on the admin console
- JWT tokens: short-lived access tokens paired with longer-lived refresh tokens; expired tokens require re-authentication
- HttpOnly cookies: all auth tokens are stored in HttpOnly + Secure + SameSite cookies, unreadable by frontend JavaScript to defend against XSS theft
- Granular API key permissions: each key can be limited to specific endpoints and quotas, and revoked at any time
- Connected apps (MCP): OAuth authorization with mandatory PKCE; short-lived, rotating access credentials stored only as hashes; access is limited to creating and adjusting AIs — no payments, plan or account changes, and no deleting or replacing anything you created or uploaded on the website (images the app uploads itself are cleaned up when replaced or no longer used); authorization, plan and account status are re-checked on every operation, and you can disconnect at any time in User Settings → Connected apps
5. Tenant Isolation
The platform is a multi-tenant SaaS. We isolate data between users in several layers:
- Database: every query is filtered by user ID, with ownership re-checked at the service layer
- Vector database: each user has a dedicated Qdrant Collection; cross-collection queries do not exist
- Object storage: R2 paths are prefixed with the user ID and gated by signed URLs
- Shared links: each link uses a cryptographically random token bound to its quota and GDPR consent record
6. Application-Layer Defences
Inside the application logic we apply several active defences:
- SQL injection: all database queries use parameterised statements (asyncpg $1, $2 style); string concatenation is forbidden
- XSS middleware: requests are scanned at the entry point for common XSS patterns and user content is sanitised again in the frontend before rendering
- CSRF protection: auth cookies use SameSite=Lax; sensitive actions require Origin verification
- Content Security Policy: scripts, styles, fonts, and outbound connections are restricted by allowlists
- Layered rate limiting: applied by endpoint sensitivity across session, API key, and visitor fingerprint layers to prevent brute force and abuse
- Input validation: every user input passes Pydantic schema and safe-string checks before reaching the service layer
- File uploads: limited by MIME type, size, and image dimensions, then renamed and stored in object storage
7. AI & Data Processing Safety
AI is core to our service, so we apply specific protections to the AI pipeline:
- Prompt isolation: system instructions and user input are kept strictly separate; user input cannot override core safety rules
- Hallucination guardrail: when an AI's answer scope is set to Focused Mode, the system checks each answer against the confidence of the retrieved knowledge before sending it; answers that are not grounded in your knowledge base are replaced with an honest "not found" response.
- Knowledge boundary: the AI treats the knowledge you provide as its primary source. In Focused Mode it answers only within your knowledge base and its role, and politely declines unfamiliar topics; in other modes it may range wider, but factual answers still come from your knowledge base.
- Conversation health monitor: multi-turn conversations are monitored for semantic drift, and the conversation is steered back to the AI's role when it wanders. This does not apply in Unrestricted mode, which is designed for the AI to chat about any topic.
- No model training: your conversations and uploaded files are never used to train our or any third party's AI models
- LLM timeouts: every AI call has a strict timeout and falls back safely instead of waiting indefinitely
8. Payment Security
We never directly handle full card data. All card processing is done by PCI DSS compliant payment processors:
- Currently we use TapPay: a PCI DSS certified Taiwanese payment service provider, supporting 3D Secure verification, card binding / merchant-initiated charges (Pay by Prime / Pay by Token), transmitting card data via one-time Prime tokens and using Card Tokens for merchant-initiated charges
- We only store encrypted tokens returned by the processor and never see the full PAN
- Refunds, invoices, and reconciliation are integrated through the backend; sensitive payment fields are never exposed to the browser
- We may add or change PCI DSS compliant payment service providers from time to time and will notify you via in-platform announcement or email before any change takes effect
9. Monitoring & Incident Response
We continuously monitor the running system and have a defined process for handling incidents:
- Audit logs: admin actions, sign-in events, and payment transactions are logged and retained for review
- Error tracking: application exceptions are reported in real time through a third-party error-tracking service and handled by our engineering staff
- Performance monitoring: API response time, database query latency, and AI service timeout rate are continuously tracked
- Patch management: vulnerabilities are triaged by CVE severity, with critical issues prioritised and patched as quickly as possible
- Breach notification: in the event of a personal data breach, we will notify the relevant authority and affected individuals within a reasonable time, in line with Taiwan's Personal Data Protection Act and the GDPR
10. What You Can Do
Security is a shared responsibility. You can help protect your account by:
- Enabling two-factor authentication on your Google account
- Avoiding signed-in sessions on public devices and signing out when finished
- Reviewing your API keys regularly and revoking those you no longer use
- Setting passwords on shared links, or specifying which websites can embed them, to prevent uncontrolled redistribution
11. Safe Upload Practices
Content uploaded to your knowledge base may be referenced by the AI during conversations. If you create a public shared link, visitors can indirectly access uploaded content through chat. Please follow these principles:
- Do not upload documents containing personal sensitive information: copies of national ID, NHI card, credit cards (front/back), passport, bank statements, payslips, etc.
- Do not upload unfamiliar or unverified documents: they may contain malicious content or third-party personal data, creating legal and reputational risk
- Do not upload third-party data without authorization: employee records, customer lists, internal documents from partners without consent
- Do not upload trade secrets or NDA-bound content: tender documents, draft contracts, unpublished financials, etc.
- Shared links are public — anyone with the link can interact with the AI, and the AI may reference uploaded content in its responses
- For any private, sensitive, or non-public document, always set a password when creating a shared link; we recommend upgrading to Pro or higher for password protection, or upgrading to the Business plan for Email-restricted access (only the people you specify can view), and redact or remove sensitive fields before uploading
- This platform applies detection and masking to highly sensitive personal data (such as national ID numbers and payment card numbers) in AI conversations, but managing source content is still the most effective safeguard
If you are uncertain whether a document is appropriate to upload, please consult your organization's compliance or information security team.
12. Vulnerability Reporting