Welcome to ShareYourAI (hereinafter referred to as "the Platform" or "we"). These Terms of Service (hereinafter referred to as "the Terms") constitute a legally binding agreement between you (hereinafter referred to as "User" or "you") and the Platform. By using the Platform, you agree to be bound by these Terms. If you do not agree, please do not use the Platform.
1. Definitions
In these Terms, the following expressions have the meanings set out below:
- "Service" refers to the AI knowledge assistant creation, management, and sharing platform provided by ShareYourAI, including but not limited to document uploading, AI conversations, share links, appearance editing, and API access.
- "User Content" refers to all files, documents, data, and other content you upload to the Platform, including but not limited to PDF, Word, Excel, plain text, Markdown, and HTML files.
- "AI Output" refers to the responses, summaries, and analysis results generated by the Platform's AI system based on your User Content and queries.
- "Knowledge Base" refers to the structured knowledge dataset formed after your User Content is processed by the Platform (including document parsing and vector embedding).
- "Share Page" refers to a page you create through the Platform that generates a public link, allowing visitors to interact with your AI assistant without registration.
- "Subscription Plan" refers to the service tiers offered by the Platform, including Free, Pro, and Business plans.
2. Acceptance and Modifications
By using the Platform, you acknowledge that you have read, understood, and agreed to all provisions of these Terms. The Platform reserves the right to modify these Terms at any time. Upon modification, we will notify you via email or in-platform notifications. If you continue to use the Service after modifications, you are deemed to have accepted the modified Terms. If you do not agree to the modified Terms, you should immediately stop using the Service.
3. Account and Registration
The Platform uses Google OAuth for authentication, requiring no separate registration process.
- Signing in with your Google account automatically creates a Platform account. The Platform will obtain your Google account name, email address, and profile picture.
- You are responsible for maintaining the security of your Google account. All activities conducted through your account are deemed to be your actions.
- Each user may only create one account. The Platform reserves the right to suspend or delete accounts found to be in violation.
- You warrant that the account information you provide is truthful and accurate.
4. Service Description
ShareYourAI is a RAG (Retrieval-Augmented Generation) knowledge management platform. Core features include:
- Document Upload and Knowledge Base Creation: Supports uploading documents in PDF, Word, Excel, CSV, TXT, Markdown, and HTML formats. The system automatically parses and creates a vectorized knowledge base.
- AI Conversations: Provides intelligent Q&A services powered by third-party large language models (currently OpenAI GPT and Google Gemini) based on your knowledge base.
- Share Links: Generates public share pages that allow visitors to interact with your AI assistant without registration.
- Smart Presentations: Transforms PDF documents into interactive presentations with AI conversation support (Pro plan and above).
- Appearance Editor: Customize the branding, colors, and layout of your share pages.
- API Access: Provides an OpenAI-compatible API interface to integrate AI capabilities into your applications (Pro plan and above).
- The Platform may add, modify, or discontinue features at any time, with reasonable notice to users.
5. Subscription Plans and Payment
5.1 Plan Description
The Platform offers three subscription plans: Free, Pro, and Business. Feature limitations and quotas for each plan are detailed on the Platform's pricing page, which forms part of these Terms.
5.2 Payment Processing
Paid plans are processed through PCI DSS compliant third-party payment service providers, and the Platform does not store your complete credit card numbers. Supported payment channels (credit card, ATM transfer, convenience-store codes, etc.), encryption, and protection details are described in the "Data Security" page (Payment Security section); the current payment service provider is listed in the "Privacy Policy" Section 4.1. We may add or change PCI DSS compliant payment service providers from time to time and will notify you via in-platform announcement or email before any change takes effect.
5.3 Billing and Renewal
Paid plans renew automatically on the subscription date according to the billing cycle you choose (monthly or yearly). The billing currency is automatically set based on your region upon first login (USD or TWD) and cannot be changed by the user; if the Platform later detects that the initial assignment does not match your actual region, it may correct the billing currency automatically.
5.4 Refund Policy
The Platform offers a 7-day self-service refund mechanism. Within 7 days of your most recent subscription charge, and provided that ALL of the following conditions are met, you may request a refund for that charge by selecting the corresponding record under "User Settings → Payment Management": (1) fewer than 7 days have passed since the charge; (2) your service usage for the current period remains below the Platform's threshold (i.e., you have not materially used the current period's quota); (3) the charge has not been refunded and has no refund request in progress; (4) you have not had a successful refund in the past 12 months (limited to once every 12 months). Refund requests are subject to review by the Platform (including automated eligibility checks and manual review) before any refund is issued; the Platform reserves the right to reject ineligible requests based on actual usage and anti-abuse considerations. Once a refund is completed, your plan will be changed to the Free plan immediately, and resources exceeding the Free plan's limits will be suspended but not deleted. Funds will be returned to your original payment method through the original payment service provider; the actual time to receive the funds depends on the payment service provider and your card-issuing bank (typically around 5 business days). In addition, unexpected charges caused by system errors, duplicate charges, or technical faults attributable to the Platform are not subject to the above conditions, and you may contact customer support for assistance. You may still cancel your subscription at any time, after which your plan will change to the Free plan at the end of the current billing cycle.
5.5 Plan Upgrades and Downgrades
Upgrades take effect immediately with instant access to new features. When upgrading, you pay the full price of the new plan, and a new billing cycle starts on the day of the upgrade; remaining days on the previous plan are not credited or appended to the new cycle. When upgrading between paid plans (e.g., from Pro to Business), unused visitor conversation credits from the previous plan's current period are automatically converted into top-up credits valid for 30 days upon completion of the upgrade (consumed only after the new plan's period credits are exhausted). This conversion applies only to upgrades between paid plans — first-time subscriptions from the free plan, recurring renewals, downgrades, and refunds are not eligible, and credits do not accumulate across periods. Downgrades take effect at the end of the current billing cycle. Resources exceeding the new plan's limits (AIs, share pages, API keys, etc.) will be suspended but not deleted. Upgrading back to the original plan will restore all suspended resources.
5.6 Auto Top-up
Paid-plan users may opt in to "Auto Top-up": when the account's visitor conversation credits (including any top-up balance) fall below the threshold you set, the Platform will automatically purchase the top-up pack you selected using the payment method bound to your subscription, up to the per-period limit you set (you may also choose no limit). Every automatic charge is invoiced and confirmed by email, and automatically purchased packs follow the same validity, consumption order, and refund rules as regular top-ups. If an automatic charge fails, the Platform pauses Auto Top-up and notifies you, and does not retry the charge; once your chosen limit is reached, no further charges are made, and the AI will stop replying to visitors when credits run out until you adjust the settings, top up manually, or the monthly quota resets. You may turn Auto Top-up off at any time under "Top-up"; doing so does not affect credits already purchased.
6. User Content and Intellectual Property
- Ownership: You retain all intellectual property rights to the User Content you upload. The Platform does not claim ownership of your User Content.
- Limited License: You grant the Platform a non-exclusive, worldwide, limited license to use, process, and store your User Content solely for the purpose of providing the Service (including but not limited to document parsing, vector embedding, AI retrieval, and response generation).
- AI Output: You may freely use AI-generated responses based on your knowledge base to the extent permitted by law. The Platform does not guarantee the accuracy, completeness, or suitability of AI Output.
- Legality Warranty: You warrant that the content you upload is legally owned by you or that you have obtained proper authorization, and that it does not infringe upon any third party's intellectual property rights, privacy rights, or other rights.
- Platform IP: The Platform's software, designs, trademarks, technology, and other intellectual property are owned by the Platform. You may not copy, modify, or distribute them without written authorization.
7. AI Service Special Terms
- Accuracy Disclaimer: AI-generated responses are produced based on the knowledge base documents you provide and may contain inaccurate or incomplete information. AI Output does not constitute professional advice (including but not limited to legal, medical, financial, or technical advice).
- Processing Method: Your content goes through document parsing, vector embedding, retrieval, and AI generation; the specific technical steps and data flow are described in the "Privacy Policy" Section 3.2.
- Third-Party AI Model: The Platform uses third-party AI models as its underlying AI service (currently OpenAI and Google Gemini; the specific models in use may change depending on the feature and service quality). Your queries and the relevant document fragments are sent to the provider's API while requests are processed and are subject to that provider's terms of service and privacy policy.
- No Model Training: The Platform will not use your User Content or conversation records to train AI models.
- Usage Responsibility: You should independently assess the suitability of AI Output and bear full responsibility for any decisions or actions taken based on AI Output.
8. AI Hallucination Risk and Pre-Publication Testing
Generative AI can produce content that sounds plausible but is factually wrong, commonly called an "AI hallucination". This section explains the nature of that risk, your duty to test before making your AI available to others, and the limits of the Platform's responsibility.
- Nature of hallucinations: Even when your knowledge base is accurate, the AI may still produce incorrect, outdated, or self-inferred content about specific facts such as numbers, dates, times, prices, addresses, contact details, plan contents, or legal provisions, and may improvise answers to questions your knowledge base does not cover. This is an inherent limitation of current generative AI technology and cannot be fully eliminated.
- Put specific facts in the knowledge base: Any specific fact you want the AI to answer accurately for visitors, including prices, opening hours, deadlines, quantities, specifications, addresses, phone numbers, and return or exchange conditions, must be written explicitly into your knowledge base documents and kept up to date when it changes. For anything not in the knowledge base, the AI can only guess or decline, and guessing is where hallucinations come from.
- Duty to test before publishing: Before you generate a share link, embed the AI on a website, connect it to LINE, or otherwise make your AI available to others, you must first test it in the Platform's "Chat Test" feature, covering the questions your audience asks most, sensitive or high-risk questions (for example amounts, legal, medical, or safety matters), and questions that require precise answers, and confirm that the answers meet your expectations. You should also spot-check periodically after publishing and re-test whenever you change the knowledge base or settings.
- In-app testing is not billed separately: Conversations in "Chat Test" do not count against your share link's visitor conversation quota and are not charged separately, but they remain subject to each plan's fair-use limits to prevent abuse.
- Tools the Platform provides: Features such as answer scope settings and "no data found" response templates can reduce the likelihood of hallucinations, but they are aids only and do not guarantee their elimination.
Disclaimer: AI answers are generated in real time by an AI model and are not written, reviewed, or endorsed by the Platform. The Platform accepts no liability for any loss, dispute, or liability caused to you or any third party (including your visitors and customers) by AI hallucinations or by incorrect or incomplete answers. You bear all consequences of making your AI available to others.
9. Acceptable Use Policy
When using the Platform, you must not:
- Upload any content that violates the laws of the Republic of China (Taiwan) or your local jurisdiction, including but not limited to content infringing intellectual property rights, pornography, violence, hate speech, or other illegal content.
- Use the Platform to distribute false information, fraudulent content, or malware.
- Reverse engineer, decompile, or attempt to hack or breach the Platform's systems.
- Use automated tools to mass crawl or scrape the Platform's data or content.
- Use AI assistants created through the Platform for illegal activities or actions that harm others' rights.
- Circumvent or attempt to circumvent the Platform's usage limits, quota controls, or security mechanisms.
- Impersonate any person or misrepresent your affiliation with any person or organization.
Upon discovering violations of the above rules, the Platform may immediately suspend or delete the relevant accounts and content without prior notice or refund.
10. Brand URL and Brand Handle Policy
Brand handles (@handle) and page short URLs provided by the Service are a license to use granted by the platform, not a transfer or grant of property or trademark rights. By setting or using a brand handle, you agree to the following:
- Brand handles are allocated on a first-come, first-served basis, provided that such use must not infringe any third party's trademark, name, or other legal rights;
- Registering or using another party's trademark, business name, or a public figure's name in a manner likely to cause confusion or impersonation is prohibited, as is hoarding, offering for sale, or transferring brand handles for value;
- Certain well-known brand names are placed on a brand protection list and are only available to rights holders verified by the platform;
- Trademark or name rights holders may file a complaint with supporting documentation; where the platform determines bad-faith registration or impersonation, the brand handle may be reclaimed without compensation;
- Good-faith use of an identical name (e.g. your legal name or a long-operating business of the same name) must adopt a distinguishable variant (for example, a user surnamed McDonald may use mrmcdonald), rather than the exact form of a well-known trademark on its own; good-faith variants will generally not be reclaimed, and the platform will consider actual usage in each case;
- The platform reserves the final right to reclaim, suspend, or reassign any brand handle upon reasonable notice, in response to complaints, legal requirements, or as necessary to maintain service integrity;
- If a subscription downgrade or termination means you no longer qualify for the brand URL feature, your brand handle is reserved for 60 days from the loss of eligibility; restoring a qualifying plan within that period lets you keep it. Once the reservation period expires, the platform may release the handle and make it available for others to claim.
11. Third-Party Services
The Platform relies on third-party cloud services and SaaS providers for full functionality (covering authentication, AI models, payments, file storage, database, vector database, and similar). The complete current list of providers and the categories of data each one processes are described in the "Privacy Policy" Section 4.1. By using the Platform, you agree to the respective terms of service and privacy policies of those providers.
The Platform is not responsible for the availability, accuracy, or security of the above third-party services. The Platform bears no liability for impacts caused by third-party service interruptions or changes.
12. Disclaimers
- The Service is provided on an "as is" and "as available" basis. The Platform makes no express or implied warranties regarding uninterrupted service, error-free operation, security, or fitness for your particular purpose.
- The Platform does not guarantee the accuracy, completeness, reliability, or timeliness of AI Output. AI responses may contain errors or outdated information.
- The Platform does not guarantee that you will achieve any specific business objectives or results through the Service.
- The Platform bears no liability for service interruptions or losses caused by force majeure events, including natural disasters, war, government actions, cyberattacks, or other circumstances beyond reasonable control.
13. Limitation of Liability
To the maximum extent permitted by law:
- The Platform shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data loss, goodwill damage, or business interruption.
- The Platform's cumulative liability for any damages arising from the Service shall not exceed the total fees actually paid by you to the Platform in the 12 months preceding the event giving rise to the damage.
- The above limitations do not exclude any statutory rights that cannot be excluded under the laws of the Republic of China (Taiwan).
14. Indemnification
You agree to indemnify and hold harmless the Platform and its personnel and partners from any claims, damages, losses, or expenses (including reasonable attorney's fees) arising from:
- Your violation of any provision of these Terms.
- Your uploaded content infringing any third party's rights.
- Any illegal conduct in your use of the Service.
15. Term and Termination
- To delete your account, please contact us at [email protected] (self-service account deletion is not yet available). Upon account deletion, all your data (including AIs, knowledge documents, conversation records, and share pages) will be permanently removed. This action is irreversible.
- The Platform may suspend or terminate your account access for violation of these Terms or other reasonable grounds.
- After account termination, you must stop using the Service. Provisions regarding intellectual property, disclaimers, limitation of liability, and general terms shall survive termination.
- If the Platform decides to cease operations, we will notify users at least 30 days in advance and provide a reasonable data export period.
16. General Provisions
- Governing Law: These Terms shall be governed by and construed in accordance with the laws of the Republic of China (Taiwan).
- Jurisdiction: Any disputes arising from these Terms shall be submitted to the Taiwan Taipei District Court as the court of first instance.
- Severability: If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
- Entire Agreement: These Terms (together with the Privacy Policy and pricing page content) constitute the entire agreement between you and the Platform, superseding any prior oral or written agreements.
- No Waiver: The Platform's failure to exercise or delay in exercising any right under these Terms shall not be deemed a waiver of such right.
- Non-Transferability: You may not assign or transfer any rights or obligations under these Terms to any third party without the Platform's written consent.
ShareYourAI (hereinafter referred to as "the Platform" or "we") takes your privacy very seriously. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, as well as the rights available to you. This policy applies to all your interactions with the Platform's services.
1. Information We Collect
1.1 Information You Provide
- Account Information: Name, email address, and profile picture obtained through Google OAuth sign-in.
- Payment Information: Credit card and payment details processed through PCI DSS compliant payment service providers (currently TapPay) for paid subscriptions. The Platform only stores encrypted tokens returned by the processor along with the last four digits and card type; complete credit card numbers are never stored.
- User Settings: Preferences you configure on the Platform, including language settings, AI configurations, and appearance customizations.
- Feedback: Comments and issue descriptions submitted through the Platform's feedback feature.
- Beta access requests: The email address, name, applicant type, organization name (when applying on behalf of an organization), and use-case description you submit through the “Request an invite” form, used solely to review beta eligibility and send invite codes.
1.2 Content You Upload
- Knowledge Documents: Files you upload in PDF, Word, Excel, CSV, TXT, Markdown, HTML, and other supported formats.
- Conversation Content: Message records from your conversations with AI assistants.
- AI Configuration Data: Role names, instructions, and response templates you set for your AI assistants.
- Third-Party Integration Credentials: Access credentials (channel secret and access token) you provide when connecting a third-party messaging channel (such as a LINE Official Account). They are stored encrypted, used solely to send and receive messages on that channel on your AI's behalf, and deleted when you disconnect the integration.
1.3 Automatically Collected Information
- Device Information: Browser type, operating system, screen resolution.
- Usage Records: Login times, feature usage frequency, page view history.
- IP Address: Used for security verification and region determination.
- Cookies and Similar Technologies: Used to maintain login sessions and preference settings (see Section 5 for details).
1.4 Information Provided by Visitors
- Conversation Content: Messages exchanged when visitors interact with an AI assistant through share pages, the website assistant, or a third-party messaging channel (such as a LINE Official Account) connected by the AI's owner. When interacting through a third-party channel, we also receive the pseudonymous user identifier issued by that platform (such as a LINE user ID), used to keep the same visitor's conversation context; we do not use it to obtain the visitor's name or profile on that platform.
- Contact Details: Name, company, contact information (phone, email), preferred contact time, related URLs, and request descriptions that visitors voluntarily leave during the contact flow. This information is relayed to the AI's owner (see Section 12). If the owner enables the booking confirmation feature, the email address a visitor leaves during the booking flow is also used to send the visitor booking status notifications (submission confirmation, booking outcome, a pre-appointment reminder, or a reminder to contact the owner directly); these are fixed-format transactional emails, and visitors can stop receiving them at any time via the link in the email.
- Conversation Images: Images visitors upload during conversations (see Section 12 for how they are handled).
2. Purpose of Data Collection
In accordance with Article 8 of the Personal Data Protection Act of the Republic of China (Taiwan), we inform you of the specific purposes for collecting your personal data:
- Service Provision: Account creation and management, AI knowledge base construction and conversation services, share link functionality.
- Payment Processing: Subscription billing and invoice management.
- Security Protection: Preventing unauthorized access, detecting anomalous behavior, protecting the Platform and user safety.
- Service Improvement: Analyzing usage trends, improving features and user experience.
- Customer Communications: Sending service notifications, billing notices, important updates, and feature changes.
- Legal Compliance: Fulfilling obligations required by the laws of the Republic of China (Taiwan), including tax reporting and compliance with court orders.
3. How We Use Your Information
3.1 Service Provision
We use your account information for authentication and account management, and use your uploaded documents to build knowledge bases and provide AI conversation services.
3.2 AI Processing Workflow
Your uploaded documents undergo the following processing workflow:
- Document Parsing: The system parses document content into text.
- Chunking: Text content is split into appropriately sized segments.
- Vector Embedding: Each segment is converted into mathematical vectors through embedding models and stored in the Qdrant vector database.
- Retrieval and Generation: When users ask questions, the system retrieves the most relevant vector segments, which are sent along with the query to a third-party AI model provider's API (currently OpenAI or Google Gemini) for response generation.
Please note: Data sent to third-party AI providers (OpenAI, Google) is governed by the respective provider's privacy policy. We only send the data needed to process that specific request.
3.3 Analytics and Improvement
We may use de-identified aggregate data to analyze service usage trends and improve features and user experience. We do not use your personal conversation content for marketing or advertising purposes.
4. Information Sharing and Disclosure
We do not sell your personal data. We only share your information in the following circumstances:
4.1 Third-Party Service Providers
We use the following third-party services, which may process some of your information:
- Google (OAuth authentication, Gemini AI and embedding models) — Processes your account information, conversation queries, and document vectorization.
- OpenAI (GPT models) — Processes your conversation queries, the relevant knowledge fragments, and images uploaded in conversations to generate AI responses.
- TapPay (payment processing) — Processes your credit card and multi-channel payment information, including charges and refunds. TapPay is a PCI DSS-compliant Taiwanese payment service provider. We may add or change payment service providers from time to time and will notify you before any change.
- Cloudflare R2 (file storage) — Stores your uploaded original documents.
- Supabase / AWS (database) — Stores your account data, conversation records, and related settings. The database is located in the AWS Tokyo, Japan region.
- Qdrant Cloud (vector database) — Stores vectorized embedding data from your documents.
- Resend (email delivery) — Sends notification emails on our behalf (billing receipts, security verification codes, visitor contact notifications, booking status notifications, etc.); email content may include relevant account information or visitor contact details.
- Replicate (AI image generation and background removal) — Processes the text prompts and reference images you provide when using AI image generation features.
- Pexels (stock media search) — Processes the search keywords you enter in the media library in order to return matching free stock images.
4.2 Legal Requirements
When required by law or by judicial authority orders, we may need to disclose your information, including but not limited to responding to court subpoenas, search warrants, or government investigations.
4.3 Business Transfers
In the event of a merger, acquisition, or asset sale of the Platform, your information may be transferred as part of the transaction. We will notify you before the transfer and ensure the receiving party maintains privacy protection standards equivalent to this policy.
4.4 With Your Consent
Outside the circumstances described above, we will seek your explicit consent before sharing your personal data.
5. Cookies and Tracking Technologies
The Platform uses three categories of cookies and similar technologies — strictly necessary, functional, and first-party analytics — to keep you signed in, remember preferences, and improve the service. We do not run advertising trackers and do not integrate third-party advertising analytics.
For the full list of cookie categories, retention periods, third-party cookies, and management options, please refer to the "Cookie Policy" page.
6. Data Storage and Security
Your data is stored with cloud providers in the Asia-Pacific region (Supabase / AWS, Cloudflare R2, Qdrant Cloud) and protected by multiple layers including transport encryption, at-rest encryption, strict access control, and tenant isolation. The full description of infrastructure, encryption algorithms, application-layer defences, AI safety measures, payment security, and vulnerability reporting is provided on the "Data Security" page.
In the event of a personal data breach, we will notify affected individuals by appropriate means in accordance with the Personal Data Protection Act of the Republic of China (Taiwan) and take necessary remedial measures.
7. International Data Transfers
To provide the Service, some of your data may be transferred to regions outside the Republic of China (Taiwan) for processing and storage (including Japan, the United States, and other cloud service regions). We ensure these transfers comply with applicable data protection laws and require data recipients to provide adequate security protection measures.
8. Data Retention
We retain your data according to the following principles:
- Account Data: Retained for as long as your account exists. The Platform does not currently auto-delete accounts due to inactivity nor impose a maximum account lifetime. When an account is deleted (at your request or by us as permitted under these Terms), the related personal data is removed from the database immediately.
- User Content (knowledge documents, conversation records): Retained for as long as your account exists. Knowledge documents, and your own conversations in Chat Test, can be deleted within the platform at any time. Conversations generated by visitors through share pages cannot currently be deleted individually, but deleting the AI removes all of its conversation records along with it. When an account is deleted, all related user content is removed with it.
- External API conversation logs: conversations made via the OpenAI-compatible external API follow the same retention rule as visitor conversations — they are retained for as long as your account exists, cannot currently be deleted individually, and are removed when you delete the AI or your account.
- Website assistant anonymous sessions: sessions created when a visitor interacts with the homepage assistant (session identifier, device fingerprint hash, IP address, browser and language information, and an AI-generated behavior summary) expire after 24 hours; session data expired for more than 7 days is deleted by a daily scheduled job. These sessions are never linked to your account.
- Payment Records: In accordance with the tax laws and business accounting regulations of the Republic of China (Taiwan), billing records may be retained for up to 7 years after account deletion.
- Usage Records and Analytics Data: De-identified aggregate data may be retained for longer periods for service improvement purposes.
- Backup Data: Data in system backups will be removed during the next backup rotation cycle.
9. Your Rights
In accordance with Article 3 of the Personal Data Protection Act of the Republic of China (Taiwan), you have the following rights regarding your personal data:
- Access and Review: You have the right to query and review your personal data held by the Platform.
- Request Copies: You have the right to request copies of your personal data.
- Supplement or Correct: You have the right to supplement or correct incomplete or inaccurate personal data.
- Request Cessation: You have the right to request the Platform to stop collecting, processing, or using your personal data.
- Request Deletion: You have the right to request deletion of your personal data. Please contact us at [email protected] for assistance (self-service account deletion is not yet available).
How to Exercise Your Rights: Please contact us at
[email protected]. We will respond within 30 days of receiving your request. In accordance with the Personal Data Protection Act, the Platform may charge necessary costs.
10. Children's Privacy
The Platform does not target its services to children under the age of 16. We do not knowingly collect personal data from children under 16. If we discover that we have inadvertently collected personal data from a child, we will promptly delete it. If you believe we may have collected data from a child, please contact us.
11. Google API Usage Disclosure
The Platform uses Google OAuth for authentication. Regarding the use of Google user data, we declare the following:
- Sign-in: we obtain the Google data necessary for account verification (name, email, profile picture) through Google OAuth.
- Live cloud documents (optional feature): if you enable Live Cloud Documents, we additionally request the Google Drive drive.file scope. This scope is limited to the individual files you actively choose through the Google file picker; we cannot browse or access any other content in your Drive. The file content retrieved is used solely to sync that file as a knowledge source for your AI. You may remove the link at any time within the platform, or revoke access from your Google Account security settings.
- We do not use Google user data obtained through the API for AI model training or marketing purposes, and we do not sell it to third parties.
- The Platform's access to, use of, and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.
12. AI Data Processing Notice
- Model Training: We do not use your User Content, conversation records, or personal data to train AI models. Your data is used solely to provide AI conversation services to you.
- Scope of data sent: the knowledge content sent to third-party AI services (OpenAI, Google Gemini) follows one of two paths depending on the size of your knowledge base. For larger knowledge bases, only the passages retrieved for that specific question are sent. For smaller knowledge bases, the knowledge content is sent in full to improve answer accuracy, and the citations shown in the conversation are marked "fully studied". In both cases the data is transmitted only while your request is being processed, and is not retained or used for training.
- Visitor Data: Conversations of visitors who interact with your AI assistant through share links are recorded and can be viewed in your conversation logs. Visitors are informed of this before use. If a visitor voluntarily leaves contact details (such as name, phone, email, or related URLs) or attached images during the contact flow, this information is stored and relayed to the AI's owner by email together with a summary of the request. When the owner enables the booking confirmation feature, the system also sends the visitor fixed-format booking status emails, which the visitor can opt out of via the link in the email. If the owner requires an email to enter a share page, the email a visitor provides and verifies for that purpose is stored on that page's guest list and shown to the owner for approving, suspending, and managing usage; when the owner approves, the system notifies the visitor with a fixed-format email.
- Conversation Images: Images uploaded during conversations are sent to third-party AI services (OpenAI or Google Gemini) for content understanding. The Platform keeps only the AI-generated text description as conversation context and does not store the original images, except for images voluntarily provided by visitors during the contact flow, which are stored and relayed to the AI's owner.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. For significant changes, we will notify you via email or in-platform notifications. The modified policy takes effect upon publication. If you continue to use the Service after a policy change, you are deemed to have accepted the modified policy. We recommend reviewing this policy periodically.
This Cookie Policy explains how ShareYourAI ("the Platform") uses cookies and similar technologies when you use our website, applications, and shared pages. It should be read alongside our Privacy Policy.
1. What Are Cookies
Cookies are small text files that your browser stores on your device when you visit a website. They allow a site to remember your actions and preferences (such as login state and language choice) so you don't have to re-enter them on every visit. In addition to cookies, we also use similar browser-side technologies such as localStorage and sessionStorage; this policy refers to all of them collectively as "cookies".
2. Why We Use Cookies
We use cookies for the following purposes:
- Maintain your signed-in state so you don't have to re-enter your password
- Identify visitor sessions on shared pages so conversations stay continuous
- Remember your language preference, UI settings, and other customisations
- Protect the platform and users from CSRF, cross-site, and similar attacks
- Understand overall platform usage so we can improve features and reliability
3. Categories of Cookies We Use
Based on purpose and necessity, we group cookies into three categories. The examples below cover the main cookies currently in use; specific names and contents may change as the product evolves.
3.1 Strictly Necessary Cookies (cannot be disabled)
These cookies are required for the platform to operate. Without them the service would not function, so under applicable law they do not require your consent:
- Authentication token (HttpOnly, Secure, SameSite=Lax): identifies you as a signed-in member, valid for ~4 hours
- Refresh token (HttpOnly, Secure): silently extends your sign-in session, valid for ~14 days
- Google sign-in transaction cookie (HttpOnly, Secure, SameSite=Lax): confirms that the browser completing Google sign-in is the one that started it, so nobody can hand you a sign-in that lands you in their account; valid for 10 minutes and cleared once sign-in finishes
- Website assistant visitor ID: keeps a visitor's conversation continuous across pages and reloads, valid for ~24 hours
- Shared page visitor session ID: used for usage quota counting and abuse protection, valid for ~7 days
- Shared page password verification: avoids re-entering the password each time a password-protected shared page is opened, valid for ~7 days
- Shared page privacy notice acknowledgement: records that a visitor has been shown the privacy notice so it does not reappear, valid for ~30 days (see Section 4 "Consent Model" below)
3.2 Functional Cookies
These cookies remember your preferences and improve the user experience. Disabling them does not affect core functionality:
- Language preference: remembers your locale (zh-TW / en) so it is applied automatically next time
- UI state: such as sidebar open/closed state, recently used features, etc.
- Browser localStorage: used for draft autosave inside the editor and similar local-only features
3.3 Analytics Cookies
We run our own first-party analytics to understand how the platform is used so we can spot friction and improve the experience:
- Event ID: links a single user's actions into a behavioural flow (hashed or anonymised)
- Page time and interaction events: clicks, scrolls, form submissions, etc.
- Technical environment: aggregated stats about browsers, OS, screen size, and similar information
We do not use third-party advertising trackers such as Google Analytics or Meta Pixel, and we never sell or share your browsing behaviour.
4. Consent Model (Implied Consent)
We currently operate under an implied-consent model. The model works as follows:
- We only use strictly necessary and functional cookies, and we do not run advertising trackers or third-party analytics scripts such as Google Analytics
- When a visitor first opens a shared page, a Cookie and Privacy notice banner appears at the bottom of the screen with links to the Cookie Policy and Privacy Policy; continued use constitutes consent to the full contents of both policies
- By continuing to use the service (signing in, starting a conversation, browsing a shared page) you are deemed to understand and accept the cookie practices described in this policy
- If you disagree with our cookie practices, please disable cookies in your browser as described in Section 7, or stop using the service
- If laws or our service evolve to require it, we will switch to an explicit-consent model and notify you accordingly
5. Third-Party Cookies
Some features rely on third-party providers that may set their own cookies. We do not directly control these cookies and recommend reviewing the relevant providers' privacy policies:
- Google OAuth: short-lived authentication cookies during the Google sign-in flow
- TapPay: secure cookies set by the payment processor during the payment flow, including 3D Secure verification
- Cloudflare: security and performance cookies as part of CDN and DDoS protection
- Font services (Google Fonts): some public pages request web fonts from Google's font service. It does not set cookies, but your IP address is disclosed to that service when fonts are loaded.
6. Cookie Duration
Depending on purpose, cookies fall into two categories:
- Session cookies: only valid while the browser tab is open and cleared when the browser closes
- Persistent cookies: stored on your device for a defined period, after which they expire automatically. Examples: auth token ~4 hours, refresh token ~14 days, language preference ~1 year
7. Managing or Disabling Cookies
You can manage cookies at any time using the following methods:
7.1 Browser settings
All major browsers let you view, delete, or block cookies. Refer to your browser's documentation for the exact path:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Preferences → Privacy
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Edge: Settings → Cookies and site permissions
7.2 In-platform options
Signing out of your account clears the auth-related cookies. To delete your account along with all backend data, please contact us at [email protected] (self-service account deletion is not yet available).
7.3 What happens if you disable cookies
If you disable strictly necessary cookies, you will be unable to sign in or complete payments. Disabling functional or analytics cookies will mean some preferences are not remembered, but core functionality remains intact.
8. Do Not Track Signals
There is no industry-wide standard for honouring browser Do Not Track (DNT) signals, so the platform does not respond to DNT automatically. However, we do not use third-party advertising trackers, so your browsing behaviour is not shared with advertisers.
9. Changes to This Policy
This Cookie Policy may change as our service evolves or as regulations require. We will notify you of material changes via in-platform notice or email. Refer to the date at the top of this page for the latest update.
We treat security as part of the product, not as an afterthought. This page describes the technical and operational measures ShareYourAI uses to protect your account, knowledge content, and payment information.
1. Security Principles
Our security design follows five core principles:
- Least privilege: every component can access only the minimum data needed for its task
- Defence in depth: protections are applied at the transport, application, and data layers so a single failure is not catastrophic
- Secure by default: new features ship with the strictest settings and require an explicit choice to relax them
- Tenant isolation: a multi-tenant architecture strictly separates data between users
- Continuous verification: every request re-checks identity and permissions instead of relying on a single sign-in
2. Infrastructure & Hosting
We host on cloud providers with internationally recognised security certifications, with servers located in Asia-Pacific regions for compliance and low latency:
2.1 Application servers
The service runs on Google Cloud Run (asia-northeast1, Tokyo). Google operates the underlying physical and virtual infrastructure under ISO 27001, SOC 2, and PCI DSS standards.
2.2 Relational database
Account data, subscription records, and conversation history are stored on Supabase (PostgreSQL on AWS Tokyo) with automatic daily backups retained for 7 days and stored separately from the database.
2.3 File storage
Uploaded documents, images, and avatars are stored in Cloudflare R2 object storage. Files are renamed using UUIDs, namespaced by user ID, and accessed via signed URLs.
2.4 Vector database
Document embeddings are stored in Qdrant Cloud. Each user has a dedicated Qdrant Collection named by user ID; cross-user queries are blocked at the database layer.
3. Encryption
3.1 In transit
All network traffic to and from the platform — browser, API, webhook — is forced over HTTPS / TLS 1.2+. We send HSTS headers to prevent downgrade attacks, and Cloudflare provides DDoS protection and edge encryption.
3.2 At rest
Cloud providers automatically encrypt all data at the storage layer:
- Supabase / AWS: AES-256 encryption for all database files and backups
- Cloudflare R2: AES-256 at-rest encryption for every object
- Qdrant Cloud: disk-level encryption
3.3 Sensitive material
Card and binding tokens are additionally AES-CBC encrypted before they reach our database. Passwords (such as share-page password protection) are stored using an industry-standard slow hash (bcrypt) and cannot be reversed. API keys are kept only as SHA-256 hashes — once lost they can only be regenerated, never recovered.
4. Authentication & Access Control
We support multiple authentication methods and require identity verification for every API call:
- Google OAuth 2.0: sign-in goes through Google's official flow; we never see your Google password
- Two-factor authentication (2FA): users can enable TOTP-based 2FA in their account settings; it is mandatory on the admin console
- JWT tokens: short-lived access tokens paired with longer-lived refresh tokens; expired tokens require re-authentication
- HttpOnly cookies: all auth tokens are stored in HttpOnly + Secure + SameSite cookies, unreadable by frontend JavaScript to defend against XSS theft
- Granular API key permissions: each key can be limited to specific endpoints and quotas, and revoked at any time
5. Tenant Isolation
The platform is a multi-tenant SaaS. We isolate data between users in several layers:
- Database: every query is filtered by user ID, with ownership re-checked at the service layer
- Vector database: each user has a dedicated Qdrant Collection; cross-collection queries do not exist
- Object storage: R2 paths are prefixed with the user ID and gated by signed URLs
- Shared links: each link uses a cryptographically random token bound to its quota and GDPR consent record
6. Application-Layer Defences
Inside the application logic we apply several active defences:
- SQL injection: all database queries use parameterised statements (asyncpg $1, $2 style); string concatenation is forbidden
- XSS middleware: requests are scanned at the entry point for common XSS patterns and user content is sanitised again in the frontend before rendering
- CSRF protection: auth cookies use SameSite=Lax; sensitive actions require Origin verification
- Content Security Policy: scripts, styles, fonts, and outbound connections are restricted by allowlists
- Layered rate limiting: applied by endpoint sensitivity across session, API key, and visitor fingerprint layers to prevent brute force and abuse
- Input validation: every user input passes Pydantic schema and safe-string checks before reaching the service layer
- File uploads: limited by MIME type, size, and image dimensions, then renamed and stored in object storage
7. AI & Data Processing Safety
AI is core to our service, so we apply specific protections to the AI pipeline:
- Prompt isolation: system instructions and user input are kept strictly separate; user input cannot override core safety rules
- Hallucination guardrail: when an AI's answer scope is set to Focused Mode, the system checks each answer against the confidence of the retrieved knowledge before sending it; answers that are not grounded in your knowledge base are replaced with an honest "not found" response.
- Knowledge boundary: the AI treats the knowledge you provide as its primary source. In Focused Mode it answers only within your knowledge base and its role, and politely declines unfamiliar topics; in other modes it may range wider, but factual answers still come from your knowledge base.
- Conversation health monitor: multi-turn conversations are monitored for semantic drift, and the conversation is steered back to the AI's role when it wanders. This does not apply in Unrestricted mode, which is designed for the AI to chat about any topic.
- No model training: your conversations and uploaded files are never used to train our or any third party's AI models
- LLM timeouts: every AI call has a strict timeout and falls back safely instead of waiting indefinitely
8. Payment Security
We never directly handle full card data. All card processing is done by PCI DSS compliant payment processors:
- Currently we use TapPay: a PCI DSS certified Taiwanese payment service provider, supporting 3D Secure verification, card binding / merchant-initiated charges (Pay by Prime / Pay by Token), transmitting card data via one-time Prime tokens and using Card Tokens for merchant-initiated charges
- We only store encrypted tokens returned by the processor and never see the full PAN
- Refunds, invoices, and reconciliation are integrated through the backend; sensitive payment fields are never exposed to the browser
- We may add or change PCI DSS compliant payment service providers from time to time and will notify you via in-platform announcement or email before any change takes effect
9. Monitoring & Incident Response
We continuously monitor the running system and have a defined process for handling incidents:
- Audit logs: admin actions, sign-in events, and payment transactions are logged and retained for review
- Error tracking: application exceptions are reported in real time through a third-party error-tracking service and handled by our engineering staff
- Performance monitoring: API response time, database query latency, and AI service timeout rate are continuously tracked
- Patch management: vulnerabilities are triaged by CVE severity, with critical issues prioritised and patched as quickly as possible
- Breach notification: in the event of a personal data breach, we will notify the relevant authority and affected individuals within a reasonable time, in line with Taiwan's Personal Data Protection Act and the GDPR
10. What You Can Do
Security is a shared responsibility. You can help protect your account by:
- Enabling two-factor authentication on your Google account
- Avoiding signed-in sessions on public devices and signing out when finished
- Reviewing your API keys regularly and revoking those you no longer use
- Setting passwords on shared links, or specifying which websites can embed them, to prevent uncontrolled redistribution
11. Safe Upload Practices
Content uploaded to your knowledge base may be referenced by the AI during conversations. If you create a public shared link, visitors can indirectly access uploaded content through chat. Please follow these principles:
- Do not upload documents containing personal sensitive information: copies of national ID, NHI card, credit cards (front/back), passport, bank statements, payslips, etc.
- Do not upload unfamiliar or unverified documents: they may contain malicious content or third-party personal data, creating legal and reputational risk
- Do not upload third-party data without authorization: employee records, customer lists, internal documents from partners without consent
- Do not upload trade secrets or NDA-bound content: tender documents, draft contracts, unpublished financials, etc.
- Shared links are public — anyone with the link can interact with the AI, and the AI may reference uploaded content in its responses
- For any private, sensitive, or non-public document, always set a password when creating a shared link; we recommend upgrading to Pro or higher for password protection, or upgrading to the Business plan for Email-restricted access (only the people you specify can view), and redact or remove sensitive fields before uploading
- This platform applies detection and masking to highly sensitive personal data (such as national ID numbers and payment card numbers) in AI conversations, but managing source content is still the most effective safeguard
If you are uncertain whether a document is appropriate to upload, please consult your organization's compliance or information security team.
12. Vulnerability Reporting