01 Who this covers
Aisley is an embeddable AI concierge that a business (the "site operator") places on its own website. When you interact with a concierge, you are on the site operator's site — the concierge acts on their behalf, configured to their rules.
This policy explains how the Aisley platform, operated by Autonomi Studios, handles the small amount of data the concierge processes about visitors. If you are a site operator using Aisley, it also tells you what we do with data on your behalf — see roles & rights.
02 What the concierge collects
Three narrow things, each in service of holding a useful conversation:
- An anonymous visitor id (
visitorId). The first time you interact, the widget mints a random, opaque id and stores it in your browser. It means "the same browser," never who you are. It is not your name, email, or account, and it is not linked to any of those — unless you type such details into the conversation yourself. - Conversation-derived facts. To stay useful across a visit — and, on plans with memory, across visits — the concierge distills a small set of preferences from what you tell it (for example, "prefers linen," or "shopping for a gift"). This is a capped set (currently 40 entries per visitor); when it fills, the oldest entry is dropped. It is a preferences scratchpad, not a dossier, and it is only ever what the conversation itself revealed.
- Operational metadata. Budget and rate counters, timestamps, and coarse telemetry — for instance, that an action fired or was missed. These keep the service inside its cost caps and let us detect a concierge that has quietly broken. They are not a behavioral profile of you.
03 What we never do
Two commitments matter more than anything in the list above, because they are the ones most products quietly break:
04 How your data is isolated
Every stored fact is keyed to the pair (tenantId, visitorId) — the specific site
you are using and your browser — never the browser alone. This is a hard architectural
boundary, not a policy promise: two businesses using Aisley have no read path into each
other's visitors. A visitor id on Site A carries nothing to Site B.
Anything that must be true about a real person (say, that you are a logged-in customer) comes from a separate, server-signed token supplied by the site operator — never from state the widget stores in your browser. The concierge does not treat browser-held data as proof of identity.
05 Where your data lives
Persistent data — visitor facts, budget counters, and site-operator configuration — is stored in Google Firestore (Google Cloud), in a United States region. Request handling runs on Vercel's serverless infrastructure. Both are established providers with their own security and privacy programs.
If you require a specific region or data-processing arrangement for an enterprise deployment, contact us — residency is a deployment decision we can discuss, not a fixed constraint of the product.
06 How long we keep it, and how to erase it
Visitor facts persist only while they remain useful and within the 40-entry cap; older entries are evicted automatically as new ones arrive. Operational counters roll over on their budget window. We do not accumulate an ever-growing record of you.
Erasing your data, today: email
autonomistudiosllc@gmail.com
(or ask the site operator whose page you were on) and we will delete the facts tied to your
visitorId. To help us find the right record, include the visitorId if
you have it, or the site and roughly when you visited. Self-serve erasure is on the roadmap;
until it ships, the email path is a real, honored channel — not a placeholder.
You can also de-link yourself immediately: clearing your browser's site data removes the
visitorId, so any prior facts become orphaned and a future visit starts fresh.
08 The AI disclosure guarantee
Every Aisley concierge tells you it is an AI. This is a non-removable platform default — a site operator cannot switch it off — and the persona is instructed never to deny being an AI. It aligns with Article 50 of the EU AI Act (transparency obligations, in force 2 August 2026). You always know what you are talking to.
09 Third parties we rely on
We keep the list short and we do not sell your data — ever. The parties that process data on our behalf are:
- Our AI model provider — a third-party large-language-model API that generates the concierge's replies. Content is sent to produce a reply and returned; it is not used to train models. We name the current provider in our subprocessor list, available on request.
- Google Cloud / Firestore — stores data at rest (US region).
- Vercel — hosts the service and handles requests.
To receive the current, dated subprocessor list, email us at the address below.
10 Roles, and your rights
When you interact with a concierge on a business's website, that business is the data controller — it decides what its concierge does and why. Autonomi Studios operates Aisley as a data processor acting on the business's instructions. For a question about your data, you can contact either the site operator whose page you were on, or us; we will route as needed.
Depending on where you live (for example under the GDPR or CCPA), you may have rights to
access, correct, or delete data about you, and to object to certain processing. Because we hold
very little, and it is keyed to an anonymous id, exercising these usually just means giving us
your visitorId (or the site and approximate time) so we can find the record.
If you are a site operator using Aisley: you are the controller for your visitors' data and we are your processor. A data-processing arrangement is available on request.
11 Children
Aisley is a business tool embedded on business websites and is not directed at children. We do not knowingly build profiles of children. If you believe a child's data reached us, contact us and we will delete it.
12 Changes, and how to reach us
We will update this page as the product evolves and move the "last updated" date at the top. For a material change, we will give active site operators a heads-up rather than change things quietly.
Questions, requests, or the subprocessor list: autonomistudiosllc@gmail.com. [Registered address available on request.]