Data and security
Where does your data live
The first question a company asks is whether data will leak, so this page answers all of it in one place, including the part we hold ourselves and the parts we do not have. Hand it to your IT people as it is; they should not need to come back with questions.
For companies that have to clear IT or a director before adopting a new tool.
The three things companies are actually afraid of
Who ends up holding our customers' data
Names, phone numbers, addresses, conversations. That is your customers' data, not only yours, so whoever signs off needs to know every place it comes to rest.
Will it be used to train an AI
The most asked and the hardest to answer, because the answer depends on which AI provider is used and what that provider's terms say.
What happens to the data if we leave
If the contract ends one day, does everything accumulated leave with the vendor? Can it be got back? Who has to be asked?
How the data travels
These five steps are everything that happens to one message. There is no step that isn't written down.
- 01
Your business data sits in your sheet
Questions and answers, prices, the booking table, expenses, all in a Google Sheet inside your own company's Google Drive. It is not in our system. We are the ones reaching into yours.
- 02
We reach it through an account created for your company alone
Not a shared account that can open everybody's sheets. We create a connection account specifically for your company, and you are the one who shares the sheet with it. Revoke that from your own Google admin any time, without telling us.
- 03
Customer messages pass through our servers to be processed
When a customer writes in over LINE or your page, the message passes through our servers to be validated, ordered and assembled into a prompt before it goes to the AI.
- 04
It goes to the AI provider you chose
Gemini, Claude, OpenAI and OpenRouter are supported, and so is Ollama, which is an AI running on your own hardware. Choose Ollama and the message never reaches any AI provider at all.
- 05
Conversation history is kept in two places
A copy goes into your sheet so you can read it back, and another is kept in a database on our side so the bot remembers what it has already discussed with that customer. That is the one part that sits with us, and we say so here rather than leaving you to find it later.
What that means for the company
The sheet is yours from day one
No export to wait for, nothing to ask back. Stop whenever you like and the data is still complete in your own Drive. Revoke our account's access and that's the end of it.
You can cut off access yourself, immediately
No ticket to raise, no approval from us to wait for. Open Google Drive, remove the share, and our system cannot read it from that second on.
You choose whether data leaves the organisation
If company policy forbids sending data to an outside provider, run Ollama on your own server. The rest of the system works exactly the same.
Your customers can read a policy in your shop's name
Every shop gets its own privacy policy and data-deletion page, carrying your business name and your contact details. Not a generic page with our company on it, or worse, with somebody else's shop on it.
This document can go straight to IT
What we have and what we do not are both written down, so there is no round trip of questions and nothing that surfaces later during a real review.
How this differs from an ordinary tool
The first three are facts about how it is built. The last is about how this page is written.
Cross-company access is something the system cannot do, not something we promise not to do
Your company's connection account can open only the sheets you shared with it. Enter a sheet id wrongly and the system reads nothing at all. It does not accidentally open another company's. That risk isn't guarded by a check; it is designed to be inexpressible.
You can change AI provider without changing systems
Most tools are tied to a single AI provider, so if that provider raises prices, changes terms, or your company adopts a new policy, you cannot move. Ours switches provider in configuration, because the code talks to a shared interface rather than to one vendor.
The AI can run inside your organisation
Ollama has been in the supported list from the start; it is not a special build. For a company whose policy forbids data leaving, that is a complete answer rather than a reduction in risk.
We put what we do not have on the same page
The next section is the list of what we lack. It isn't in an appendix, because IT will find it anyway, and them finding it is always worse than us saying it.
What we do not have
Read this before you take us into a meeting. If your company needs any of these and cannot do without it, we are not the answer yet, and we would rather you knew today.
No certifications of any kind
No SOC 2, no ISO 27001, no third-party penetration test report. We are a small team that has just started. If your procurement process requires them, we cannot pass it today.
No SSO and no per-person permissions
The system authorises staff by their presence in the staff LINE group, not by individual logins. Everyone in the group can issue the same commands, and there is no way yet to control who can see what.
Conversation history is on our side too, and we keep it permanently
It does not live only in your sheet. We keep a copy so the bot can remember context, and we keep it permanently rather than ageing it out. If a customer asks you to delete their data, today we do it by hand once you tell us: there is no button for you to press yet. And if your policy absolutely forbids customer data outside the organisation, we need to talk about running it on your own server first.
Running it on your own server has never actually been done
The system is Docker, so technically it can be installed on your hardware, and the AI can already run in-house. But we have never set it up that way for anyone: there is no guide and no packaged installer. We are glad to discuss it case by case, and we will not describe it as something that is ready.
We cannot issue a full tax invoice
We issue a receipt every time, and we can invoice a company and wait for its payment run. What we cannot do at the moment is issue a full tax invoice. If your finance team requires one for every payment, that is a conversation to have before we start, not something to meet at the first invoice.
An AI provider's terms are theirs, not ours
Choose Gemini, Claude or OpenAI and the data reaches that provider under whatever terms they publish. We do not set those terms and we will not guarantee them on their behalf. If your company cannot accept that uncertainty, use Ollama in-house.
Something this page didn't answer
Message us on LINE and ask directly. If it is something we do not have, we will say we do not have it, rather than that it is coming. And if your company wants the system on its own server, we can talk it through case by case.