Privacy Policy

Who we are

The Service is operated by Diali AI LLC, a limited liability company organised under the laws of the State of Wyoming, USA ("Diali", "we", "us", "our").

• Registered address: c/o Registered Agent, 30 N Gould Street, Sheridan, WY 82801, USA
• General contact: hello@diali.ai
• Privacy / data-protection contact: privacy@diali.ai

For the personal data described in this policy, Diali acts as the data controller (under EU/UK GDPR) and as a business (under the California Consumer Privacy Act, as amended by the CPRA).

Scope

This policy covers personal data we process about:

• Account holders and visitors to diali.ai (the marketing site, dashboard, and onboarding wizard);
• People who contact us (e.g. via support or contact forms); and
• People an assistant contacts. If a user directs their assistant to message or call you, we process limited data about you, your contact details (e.g. phone number or messaging ID) and delivery metadata, solely to deliver that communication. The user who directed the communication is responsible for its content and for having a lawful reason to contact you; assistants identify themselves as AI and offer you a way to opt out (e.g. replying STOP). Your rights under this policy apply to this data too.

It does not govern: (a) how an AI provider you use with your own key or your own subscription processes your conversations (their policies apply); (b) how messaging channels (Telegram, WhatsApp, Discord, Slack, Mattermost, Matrix) and the SMS or voice carrier account you connect (Twilio, Telnyx, or Plivo) handle your use of them; (c) how a third-party service you connect processes data in your own account there; or (d) third-party sites we link to.

Personal data we collect

We collect the following, grouped by purpose. We have designed the Service to collect as little as practical.

Account and identity data

• Name and email address.
• Password: stored only as an argon2id hash; we never store or can see your plaintext password.
• Email-verification status.
• If you sign in with a third party (Google, GitHub, or GitLab; Apple planned): the provider's user identifier and the email address associated with that provider. We do not retain the provider's access or refresh tokens.

Session, device, and security data

• Cookie-based session identifiers (stored in Redis, not in our primary database).
• IP address (received via Cloudflare), and derived approximate location (city-level), plus browser/device descriptors, used to show you your active sessions and to send "new sign-in" security notifications.
• Signals used to detect fraud and abuse, including repeated or automated account signups.

Billing and payment data

• We use Stripe to process payments. Payment card numbers are entered directly into Stripe and are tokenised. Diali does not receive or store your full card number.
• We store a Stripe customer identifier, subscription and invoice references, and limited card display metadata (card brand, last four digits, expiry) so you can see your saved payment method.

Service configuration data

• Assistant configuration: assistant name, tone/personality, selected use-cases, size, add-ons, chosen channels, and the assistant's language and timezone.
• Your own provider keys (the "vault"), in BYOK mode: the API keys you provide for your own AI/LLM providers, and later other tools. These are encrypted (AES-256) and stored as secrets in Google Secret Manager. A key is given only to your own running assistant that uses it, inside that assistant's isolated environment, so it can call your provider; the dashboard shows only a masked preview. We validate keys against the relevant provider to confirm they work.
• Your AI subscription, in subscription mode: if you sign your assistant in to an AI plan you pay for, you finish the sign-in on the provider's own page with a one-time code. The credentials the provider issues are kept only in your assistant's own storage; Diali does not receive or keep them. We store which provider it is, a masked account label (for example j***@example.com), the plan tier the provider reports, and the connection's status and when it was last checked, so we can show it to you and tell you when you need to sign in again. How much of your plan's limits you have used is read from your assistant when you look at it, not stored.
• Channel connection data: the credentials each channel requires, for example, a Telegram bot token and optional numeric allow-list, or the equivalent for Discord, Slack, Mattermost, or Matrix. These are passed to our provisioning system and stored as secrets; they are not retained in our primary database.
• Telephony data: if your assistant uses SMS or voice-call features, they run on the carrier account you connect (Twilio, Telnyx, or Plivo; voice calls are available on OpenClaw assistants). Your carrier credentials are stored as encrypted secrets like other provider keys, and phone numbers and call/message routing metadata are processed through that carrier account to deliver those communications.

Connected accounts (integrations)

If you connect a third-party account (such as email, calendar, notes, or task tools) so your assistant can act in it for you:

• We store the access and refresh tokens the provider issues, in our integrations vault, which runs on our own infrastructure. Apps you connect through Composio (such as Gmail, Google Calendar and Google's other apps, and Meta, LinkedIn and Zoom apps; their sign-in screen shows Composio's name) are the exception: Composio, Inc. holds their tokens and carries out each action your assistant takes in them. We do not receive or store your password for any of these services.
• We store the identity of the connection (which provider, which account identifier, when it was connected) so we can show it to you and let you disconnect it.
• Data your assistant reads from or writes to that account (the contents of your emails, calendar entries, notes, or tasks) is processed in order to carry out what you asked. We do not copy that content into our own storage or retain it after the request completes.
• For apps connected through Composio, Composio keeps a log of each action your assistant takes, including what was sent and what came back (for example, the text of an email your assistant read), for up to one year, and then deletes it automatically.
• Disconnecting an integration in the dashboard revokes our stored access. For an app connected through Composio, it also deletes the connection at Composio.

Managed AI usage data (Diali AI mode)

If you use managed mode, we operate an inference gateway between your assistant and the AI provider. For each request we record the model and provider used, the number of input/output (and cached) tokens, the computed cost, the pricing version applied, the response status, and the error category if it failed; and your credit balance, grants and purchases, and the resulting usage ledger and daily rollups.

Dashboard chat history and messages between your assistants

• Messages in your messaging apps (Telegram, WhatsApp, and the other channels) are not stored by Diali.
• Conversations you hold with an assistant in the dashboard chat are stored in our database (the text of each message, and descriptors of pictures or files the assistant produced) so you can see your history across devices, search it, and export it.
• If you let your assistants message each other, the text of those messages is stored so you can review the exchange.
• Deleting a thread removes it from your history; its content is deleted from our database when you delete the assistant or close your account, and the copies in our database backups expire within 7 days after that. You can export your chat history from the dashboard at any time.

Marketing attribution data (only with your consent)

If you accept the matching category in our cookie banner, we measure whether the advertising that brought you here worked. We do not personalise ads or build profiles: our tags always tell Google that ad personalisation is denied.

• The click identifier an ad platform appends to the link you arrived on (Google Ads' gclid, X's twclid, Reddit Ads' rdt_cid, OpenAI (ChatGPT) Ads' oppref, TikTok Ads' ttclid), kept in a first-party cookie by that platform's tag and in our own first-party cookie (diali-ad-click, 30 days, so the purchase can be credited even if an extension blocks the platform's tag), only if you accept marketing (see the Cookie Policy).
• Google: if you accepted analytics when you paid, we report the purchase, and later renewals and refunds of that order, to Google Analytics with your Google Analytics client identifier, the order reference, the amount, and the plan. We send Google no email address. Google Ads may count these purchases as conversions of the ad you clicked.
• X (Twitter) Ads: if you accepted marketing when you paid or started a free trial, we send X the order reference, the amount (none for a trial start), the X click identifier if the pixel stored one, the page you checked out on, the IP address and browser you paid from, and a one-way (SHA-256) hash of your email address, so X can count the purchase or the trial start as a conversion of the ad you clicked. X can only match the hash against accounts it already holds; it never receives your name or the plaintext address from us.
• Reddit Ads: its pixel reports page visits, a sign-up, the start of a free trial and a purchase from your browser, only if you accept marketing. If you had accepted marketing when you paid or started a free trial, we also send Reddit, Inc. the order reference, the amount (none for a trial start), the click and browser identifiers its pixel stored, the IP address and browser you paid from, and a one-way (SHA-256) hash of your email address, so it can count the purchase or the trial start as a conversion of the ad you clicked. It never receives your name or the plaintext address from us.
• OpenAI (ChatGPT) Ads: its pixel reports page visits, a sign-up, the start of a free trial and a purchase from your browser, only if you accept marketing. If you had accepted marketing when you paid or started a free trial, we also send OpenAI, L.L.C. the order reference, the amount (none for a trial start), the click and browser identifiers its pixel stored, the IP address and browser you paid from, and a one-way (SHA-256) hash of your email address, so it can count the purchase or the trial start as a conversion of the ad you clicked. It never receives your name or the plaintext address from us.
• TikTok Ads: its pixel reports page visits, a sign-up, the start of a free trial and a purchase from your browser, only if you accept marketing. If you had accepted marketing when you paid or started a free trial, we also send TikTok Technology Ltd. the order reference, the amount (none for a trial start), the click and browser identifiers its pixel stored, the IP address and browser you paid from, and a one-way (SHA-256) hash of your email address, so it can count the purchase or the trial start as a conversion of the ad you clicked. It never receives your name or the plaintext address from us.
• We record your consent choice alongside the order, and we send nothing of the above for a purchase or trial made without the matching consent. Reports made after the checkout itself (the first charge after a free trial, renewals and refunds) are not sent if you have since withdrawn that consent in our cookie banner while signed in. Nothing is reported for an invoice a coupon covers in full: the purchase is the first invoice that charges money.

Communications and support data

• Transactional email content and delivery metadata (sent via Resend).
• Messages you send us through contact/support forms, and notifications we generate for you.
• Files you upload to the Service, if any.

Operational telemetry

• Structured request logs and correlation identifiers, health/uptime metrics, and error reports (via Sentry). We explicitly exclude secrets, tokens, card data, and AI prompt/response content from logs.
• Product analytics in your browser (via PostHog), only if you accept analytics in the cookie banner: pages visited and features used, session replays of your visits (what you type is masked; replays are kept 30 days), click heatmaps, and browser console errors. When you are signed in, these are linked to your account's ID, name, email address, and language. If you reject analytics, PostHog still counts anonymous, cookieless page views, with no identifier stored on your device.
• Account and billing events (via PostHog), for every account, whatever you chose in the cookie banner. Our servers tell PostHog when you sign up, sign in, and verify your email; when you check out; about subscription payments (including renewals), failed payments, and cancellations; when you top up AI credits; and when an assistant is created, goes live, is paused, resumed, or deleted, plus a few similar milestones (such as a referral or an AI subscription sign-in). Each event carries the details of that step (such as the plan and amount of a payment) and is keyed to your account's internal ID, a pseudonymous identifier; the event itself carries no email address or name. When the event happens during a request from your browser, it also carries your browser's user agent (the text that names your browser, its version, and your operating system). We send no IP address and no location with these events. They read and store nothing on your device, so the cookie banner does not govern them. We rely on our legitimate interest in understanding how the Service is used and billed; to object, email privacy@diali.ai.
• Arrivals from an ad (via PostHog), for every visitor, whatever you chose in the cookie banner: when you open our site from an ad link, our server records which ad platform and campaign the link names, the page you landed on, and whether the request looks like a crawler. To count a reload of the same ad click once, it adds a one-way (SHA-256) hash of the link's click identifier that changes every day; the identifier itself is never sent. Nothing is read from or stored on your device, no IP address or location is sent, and the count is never linked to you, your browsing session or your account.
• Linking those events to your browsing session, only if you accept analytics: your browser then sends its PostHog session identifier with its requests to our servers, so the events appear in that session's timeline. If you reject analytics, it sends no session identifier, and the events are not linked to your browsing.

What we don't do

These are core commitments of the Service:

• We do not read your conversations or use them to train models, in either BYOK or managed mode. Messages in your messaging apps are not stored by Diali; only dashboard chat history and messages between your assistants are stored, as described in Section 3.
• We do not retain the content your assistant reads from or writes to a connected account.
• We do not access your messaging-app contacts or message history.
• We do not use your data (including anything passing through our managed inference gateway) to train AI models.
• We do not sell your personal data, and we do not "share" it for cross-context behavioural advertising (as those terms are defined under the CCPA/CPRA). The only data that reaches an advertising platform is the consent-gated conversion measurement described in Section 3, used solely to measure our own campaigns.

How and why we use your data

Under EU/UK GDPR we must have a lawful basis for each use. The table below sets out what we do and why.

Where we rely on legitimate interests, you have the right to object (see "Your rights" below). Providing your account and billing information is necessary to create an account and use the Service. Configuration data (such as channel details, and provider keys in BYOK mode) is necessary only to run the features you choose to enable. Connecting a third-party account is entirely optional. Any other information is optional.

AI providers, in every mode

Diali AI (managed): the default

Your assistant's requests go to our inference gateway, which forwards them through a third-party AI routing service to the model's developer (such as Anthropic, OpenAI, or Google), on Diali's account. In this mode: the routing service and the model's developer process your conversation content to produce the response; Diali does not use your content to train models and does not send it for training; the gateway records usage metadata only (Section 3), never the content; and you do not need, and do not give us, a provider account of your own.

Bring your own key (BYOK)

Your assistant runs on your provider account using a key you supply. In this mode: your key is encrypted and stored as described in Section 3, and Diali staff do not use it to read your conversations; the content you exchange with your assistant is processed by your chosen AI provider under that provider's terms and privacy policy, not ours (you are responsible for reviewing and complying with those terms); and Diali charges only the hosting subscription and does not meter your AI usage.

Your AI subscription

Your assistant signs in to a plan you already pay for with an AI provider (such as ChatGPT or SuperGrok) and runs on it. In this mode: the sign-in and its credentials stay with your assistant as described in Section 3; the content you exchange with your assistant is processed by that provider under your plan's terms and privacy policy, not ours (you are responsible for reviewing and complying with those terms, including any limits on where the plan may be used); your usage counts against your plan's limits; and Diali does not meter it. If you choose to continue on Diali AI credits when your plan's limit is reached, those requests run in managed mode, as described above.

Who we share data with

We do not sell your data. We share it only with service providers ("processors") who help us run the Service, under contracts that require them to protect it. Our key providers are:

The advertising platforms above act as independent controllers for the matching they perform on their side; their own privacy policies govern that step. Everyone else in the table processes data on our instructions.

Our integrations vault runs on our own infrastructure rather than a third-party SaaS, so the tokens of most accounts you connect are not passed to an additional vendor. Apps you connect through Composio are the exception (see the table above). We may also disclose data: (a) to comply with law, legal process, or lawful government requests; (b) to enforce our Terms or protect the rights, safety, and security of Diali, our users, or the public; and (c) in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

International transfers

We host your data in the EU (Google Cloud, Belgium). However, Diali is a Wyoming, USA company, and some of our processors and recipients (e.g. Stripe, the AI routing service and the managed AI providers, Microsoft, Resend, Zoho, PostHog, Google, X Corp., Composio, and the sign-in providers) are based in or transfer data to the United States and other countries.

Where personal data of individuals in the EU/UK is transferred outside the EEA/UK, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and/or the EU-US Data Privacy Framework where the recipient is certified. You may request a copy of the relevant safeguards by emailing privacy@diali.ai.

How long we keep data

After a retention period ends, we delete or irreversibly anonymise the data. We may retain limited data longer where required by law or to resolve disputes.

Cookies

We use cookies and similar technologies to make the Service work and to keep it secure. Strictly necessary cookies (required to sign you in, keep your session active, and protect against fraud and abuse, including Cloudflare security) are always on; the Service cannot function without them. Functional cookies remember how you use the interface (such as your language or a collapsed sidebar) and are not used for tracking. Analytics cookies (PostHog, Google Analytics) and marketing cookies (Google Ads, X (Twitter) Ads, Reddit Ads, OpenAI (ChatGPT) Ads, and TikTok Ads click attribution) are set only after you accept the matching category in the banner; the X, Reddit Ads, OpenAI (ChatGPT) Ads, and TikTok Ads pixels do not even load before that. The full list, with lifetimes and controls, is in our Cookie Policy.

Where the law requires it (including the EU/UK ePrivacy rules), we ask for your consent before setting any non-essential cookies via a cookie banner, and you can withdraw consent or change your choices at any time with the "Cookie settings" link in the footer of every page. You can also control cookies through your browser settings, though blocking strictly necessary cookies may break the Service.

There is no common industry standard for browser "Do Not Track" signals, so we do not respond to DNT; we do recognise the Global Privacy Control (GPC) signal as described in the California section below.

Security

We take protective measures including: passwords stored as argon2id hashes; provider keys, channel secrets, and integration tokens encrypted (AES-256) in Google Secret Manager; the database, caches and backups encrypted at rest with keys managed in Cloud KMS, and assistant storage encrypted at rest with Google-managed keys; TLS in transit; edge protection via Cloudflare; network isolation between tenant workloads; access controls; and exclusion of secrets and card data from logs (AI prompts and responses are not written to logs in normal operation; an error record can quote an assistant's own failure message).

Staff access to your assistant: no support tool opens your conversations, your assistant's memory or its files, and nobody at Diali reads them to operate the service. We do not open an assistant's storage or its stored conversations without your written approval on a support ticket; what we read are system logs and error records, to find and fix problems. Actions in our admin console are audit-logged with the staff identity, and Google Cloud's audit log keeps a 400-day record of every time a person opens an assistant's container or reads its stored secrets or logs.

No system is perfectly secure, but we work to protect your data. In the event of a personal-data breach, we will notify the relevant supervisory authority and affected individuals as required by law, under GDPR, generally within 72 hours of becoming aware, where the breach is likely to result in a risk to your rights.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have specific rights. In the 12 months preceding this policy, we collect the following categories of personal information (as defined by the CCPA):

Sources of this information: you (directly), your device/browser, your sign-in provider if you use OAuth, and the third-party services you choose to connect. Purposes: as described in "How and why we use your data". Sale/Share: we do not sell personal information and do not share it for cross-context behavioural advertising; the consent-gated conversion measurement in Section 3 is used only to measure our own advertising, and rejecting marketing in the cookie banner stops it. Beyond that there is nothing to opt out of; where applicable we nonetheless recognise browser opt-out signals such as Global Privacy Control (GPC). We use sensitive personal information only to provide the Service (e.g. to authenticate you, to operate your assistant, and to act in accounts you connect), not to infer characteristics, so the CPRA "right to limit" use of SPI does not expand our uses.

Your California rights: to know/access, to delete, to correct, to opt out of sale/sharing (n/a, we do neither), to limit use of SPI (n/a as above), and to non-discrimination for exercising your rights. You may submit a request at privacy@diali.ai. You may use an authorised agent. We will verify your request against your account information before acting.

Your rights (EU/UK GDPR)

If you are in the EU, UK, or a comparable jurisdiction, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), subject to our legal retention obligations;
• Restrict or object to processing based on legitimate interests;
• Data portability: receive certain data in a structured, machine-readable format;
• Withdraw consent at any time where we rely on consent; and
• Not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).

To exercise any right, email privacy@diali.ai. We respond within the timeframes required by law (generally one month under GDPR; 45 days under the CCPA, extendable as permitted). We may need to verify your identity first. You also have the right to lodge a complaint with a supervisory authority: in the EU, your local data-protection authority; in the UK, the ICO. We'd appreciate the chance to address your concern first.

Children

The Service is not directed to children. You must be at least 16 years old to use the Service, consistent with the minimum digital-consent age under GDPR Art. 8. Because the Service is a paid subscription, users under the age of majority in their jurisdiction (typically 18) may only subscribe with the involvement of a parent or legal guardian, who must agree to the Terms of Service and provide the payment method. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided us data, contact privacy@diali.ai and we will delete it.

Changes to this policy

We may update this policy. If we make material changes, we will notify you (e.g. by email or an in-Service notice) before they take effect where required. The "Last updated" date at the top of this page shows the current version.

Contact us

Privacy questions and requests: privacy@diali.ai. General enquiries: hello@diali.ai. Post: Diali AI LLC, c/o Registered Agent, 30 N Gould Street, Sheridan, WY 82801, USA.