Lovable App

This Privacy Policy explains how Buyer Mode AI ("we", "us") collects, uses, discloses, and safeguards your information when you visit our website, use our dashboard, or interact with the embedded copilot widget on a customer's website.

1. Who we are

CareRequest AI Ltd, trading as Buyer Mode AI, is a multi-tenant SaaS that lets businesses ("Customers") embed an AI copilot on their websites. We are the data controller for Customer account data, billing data, and website visitor data we collect on our own site. For end-user visitors of a Customer's website, the Customer is the data controller and we act as their data processor.

2. Data we collect

Account data (Customers): email, name, workspace name, hashed password or OAuth identifier.
Knowledge base content (Customers): documents, URLs, and text uploaded to train the copilot.
Conversation data (Visitors): messages typed or transcribed from voice, copilot responses, and (if voluntarily provided) name, email, and meeting requests.
Usage events: timestamps, message counts, token counts, model used, IP address (truncated, kept for up to 30 days for abuse prevention and rate limiting).
Cookies: only strictly necessary cookies for authentication and session security. See our Cookie Policy.

3. Legal bases (GDPR Art. 6)

Contract — to provide the service to Customers.
Legitimate interests — security, fraud prevention, service improvement.
Consent — for optional features such as voice input.
Legal obligation — tax, accounting, lawful requests.

4. How we use data

To operate and secure the service, generate AI responses, send transactional emails, bill Customers, and comply with the law. We do not sell personal data, and we do not use Customer content to train third-party foundation models.

5. Subprocessors

Lovable Cloud (Supabase) — managed database, auth, storage. EU/US regions.
Lovable AI Gateway — large language model inference.
Paddle.com Market Ltd — our Merchant of Record: sale of the product, subscription management, payments, invoicing, and sales tax/VAT compliance.
Cloudflare — edge hosting and DDoS protection.

We also share data with professional advisers (legal, accounting) and with authorities where required by law.

6. Retention

Conversations: 90 days by default; Customers can shorten or delete on request.
Data no longer needed for these purposes is deleted or irreversibly anonymised.
Usage events: 12 months.
Account data: until account deletion + 30 days backup window.
IP addresses: 30 days, then aggregated.

7. Your rights

EEA, UK, Swiss, and California residents have rights to access, correct, delete, port, restrict, or object to processing of their personal data. Submit a request via our Data Subject Request form or email privacy@buyermode.ai. We respond within 30 days.

8. International transfers

Where data leaves the EEA/UK, we rely on Standard Contractual Clauses and supplementary safeguards with our subprocessors.

9. Security

Encryption in transit (TLS 1.2+) and at rest, per-tenant row-level isolation, hashed API keys, least-privilege access. See our Security overview.

10. Children

The service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We will post material changes here and, where required, notify Customers by email.

12. Contact

CareRequest AI Ltd — Privacy team — privacy@buyermode.ai.