Privacy policy

This policy explains how Sinai Tech Ventures LLC handles data under Egypt Personal Data Protection Law No. 151/2020.

Who is responsible

For ai-me.dev and site-owner data, Sinai Tech Ventures LLC is responsible. When you visit a customer's site, that site owner decides what its assistant knows and whether conversations are stored; we process that data on the site owner's behalf.

When you use an assistant

To answer a question, we send the question, recent prior turns supplied from the widget's browser memory, relevant excerpts from the site owner's knowledge base, and a system instruction naming the site's brand to the chosen language-model provider. No IP address, cookie, or visitor identifier is included in that model request.

The platform language-model sub-processor is Groq, Inc. (USA) at api.groq.com, using our key. A site owner may instead choose an allowed provider and use its own key; traffic using that key is not answered with our key.

Embeddings

Embeddings of questions and knowledge-base text are computed on our own server and never leave it. They use a self-hosted multilingual model and are not sent to a third party.

Conversation storage

Conversation storage is off by default and is enabled only if the site owner chooses it. When enabled, we store question and answer text, whether the answer was grounded, citations, and timestamps; conversations contain no IP address, user agent, or origin. The site owner chooses retention, which defaults to 30 days, and expired records are purged hourly. The ai-me.dev demo assistant does not store conversations, and MCP ask does not store them.

IP addresses and technical logs

We use an IP address in rate-limit counters to protect the service. Those counters keep it in plaintext and are deleted about one hour after the last use. IP addresses are not included in conversations or our application request logs. Hosting infrastructure may produce technical server logs.

When the service or the chat widget hits a software error, we record a technical error report on our own server: the error type, message and code location, the release, and the server route. Reports never contain questions, answers, form input, cookies or the page address. Instead of an IP address, a report from a browser carries a short daily hash of it. The report is used only to find and fix bugs.

Analytics on ai-me.dev

The landing pages, including the AI readiness check page, use Umami, open-source analytics self-hosted by us on a server in Germany. It is cookieless, honours Do Not Track, and records page, referrer, browser, operating system, device type, screen size, language, country, and time. The tracker loads on those pages only, not on legal pages.

The assistant widget and analytics set no cookies. Signing in sets one strictly necessary session cookie. It is HttpOnly and Secure, expires after 30 days or when you sign out, contains only a random identifier, and is used for no other purpose. The opt-out below is stored only in this browser's local storage under umami.disabled.

Analytics is on for this browser. Turn analytics off

When you arrive from a campaign link, the landing pages keep that link's campaign tags (utm_*, gclid, li_fat_id), the external page you came from and the first page you opened in this browser's local storage under aime.attribution for 30 days. They reach us only if you submit the AI readiness check form. Nothing is stored after you turn analytics off, or when your browser sends Do Not Track.

Free AI readiness check

If you use the free AI readiness check, we store your name, email address, optional company, the website address you entered, the result of the check, the campaign tags described above and the status of our follow-up. We use them to show and email you the result and to follow up on your request, based on your consent, which you can withdraw at any time by emailing us. To run the check, our server fetches four public files from the website you entered (the homepage, robots.txt, sitemap.xml and llms.txt). We send you the summary, and our team a notification, through our email provider. The record is deleted 12 months after you submitted it at the latest.

Site-owner data

We process assistant names and slugs, settings, allowed origins, knowledge-base content and submitted URLs, hashed API keys, and count-only usage records. If a site owner supplies a provider key, it is encrypted with AES-256-GCM and only its last four characters are shown. Our server fetches URLs submitted for ingestion directly. For an account, we process the email address, a password hash made with scrypt (the password itself is never stored), the verification time, and a hash of the 6-digit verification code we email you (the code itself is never stored) and hashed single-use password-reset link tokens. A verification code expires after 10 minutes and allows at most 5 wrong attempts; reset links expire after 1 hour. Unverified sign-ups are deleted after 7 days, and token records are deleted 1 day after use or expiry. We send verification and reset emails through our email provider.

MCP connections

For MCP connections we store client registrations and hashed tokens. MCP access is read-only, and rotating the assistant API key disconnects clients.

Hosting, database and backups

The application runs on our own server, operated by a hosting provider. PostgreSQL runs on the same server. Nightly encrypted backups are copied off the server.

Transfers outside Egypt

Assistant model requests described above may be transferred to Groq, Inc. in the USA. A site owner's own-key provider receives traffic when that owner chooses it. Embeddings remain on our server. Site owners: the processor terms and the full sub-processor list are in our Data Processing Agreement.

Retention summary

Rate-limit counters are removed about one hour after last use. AI readiness check records are deleted 12 months after submission at the latest. Optional conversations use the site owner's chosen retention, 30 days by default, and are purged hourly. Other service data remains while the assistant or connection exists or as needed to operate and protect the service.

Your rights and contact

You may request access, correction, deletion, or object to processing by emailing legal@sinaitechventures.com. For a customer's assistant, contact the site owner as well.

Changes

We will publish policy changes on this page and update the date below.

Last updated: 22 October 2026