This Privacy Policy describes how SayShan Technologies ("Fahmix AI") collects, uses, and retains Personal Data when you visit fahmix.com, manage a tenant in the dashboard, or interact with the Fahmix AI chat widget embedded by a tenant.
1. Data we collect
As a tenant admin
- Email, password hash, tenant id, role, last login
- Action history (audit events) inside the dashboard
As an end-user of a tenant's chat widget
- Your message content + any consent + step-up records
- Approximate IP location (region-resolution only, hashed before storage)
- Any consent + DSAR records you create
We process this on behalf of the tenant per our Data Processing Addendum.
2. How we use it
- To answer your inquiries via the AI agent
- To maintain the tamper-evident audit chain (EU AI Act Article 26)
- To bill the tenant for resolved outcomes (no end-customer data leaves the tenant's billing context)
- To improve service quality via aggregated, anonymized eval metrics
3. We never
- Sell Personal Data
- Train foundation models on your data without explicit opt-in (Google, Anthropic, OpenAI all contractually confirmed no-training)
- Allow any tenant to read another tenant's data (Postgres Row-Level Security at the database)
4. Your rights
Under GDPR, CPRA, UAE PDPL, and BD DSA, you have the right to:
- Access — get a copy of all data we hold about you
- Rectify — correct inaccurate data
- Erase — delete your data (audit-chain entries preserved per Article 17(3)(b/d))
- Restrict — limit processing
- Port — receive a machine-readable export
- Object — to specific processing activities
File a request via the tenant's portal at /portal/dsar?tenant=<API_KEY>. We respond within 30 days.
5. Retention
- Conversation transcripts — tenant-configurable, default 24 months
- Audit chain — 6 years (regulatory minimum)
- Consent records — as long as the underlying consent is in force + 3 years
6. Cookies
A strictly-necessary session cookie (NextAuth) keeps you signed into the dashboard. No third-party tracking. PostHog analytics fire only when explicitly enabled by the tenant.
7. Contact
Data Protection Officer: [email protected]. EU representative: TBD. UK representative: TBD.