Privacy policy
Last updated September 27, 2026
This policy explains what personal information Which AI Sent (“we”, “us”) handles, why, and what you can do about it. Which AI Sent is operated by Tamitechs. If anything here is unclear, email info@whichaisent.com.
We handle information in two different roles, and this policy covers both:
- As a business ourselves: when you visit whichaisent.com, contact us, or become a customer.
- On behalf of our customers: when our tracking script runs on a customer’s website. There, the customer decides what is collected and why, and we process it for them. If you visited one of our customers’ websites, their privacy policy applies too, and they are your first point of contact.
1. Visitors to whichaisent.com
Our own site uses the same tracking script we provide to customers. It records:
- a random visitor ID and visit ID, stored in a first-party cookie and your browser’s local storage;
- the page that referred you, the page you landed on, and any campaign tags in the link (such as
utm_source); - whether you’re on a phone or a computer, and the time of the visit.
We don’t store your IP address, use advertising cookies, or build profiles for advertising. Our fonts are hosted on our own servers, so visiting our site doesn’t send your details to Google or other font services.
2. When you contact us
If you use our contact form or email us, we keep what you send: your name, email, company, website, how you heard about us, and your message. We use it to reply, to talk with you about the service, and to understand where our enquiries come from. We don’t add you to a mailing list unless you ask us to.
Help chat
If you use the help chat on our site, the messages you type are sent to our AI provider (currently OpenAI; we may switch to Anthropic), which provides the model that writes the replies, and are kept in your browser for the current tab only. We don’t store chat conversations, but the provider may retain them for a limited period under its own policies. Please don’t enter passwords, access keys or sensitive personal information in the chat.
3. Customers
If you use Which AI Sent, we hold your account details (contact names and email addresses, company name, websites) and the settings you choose. Passwords are stored only as salted, one-way hashes, never in readable form. When you log in, we set a secure session cookie (was_session, 30 days) that keeps you signed in on that device. So that your own browsing isn’t counted on your website, when you open your dashboard we keep a scrambled, one-way code made from your network address and browser (never the address itself) for up to 30 days, and skip visits to your website that match it. We use these to provide the service, support you, and handle billing where it applies.
4. Data we process for customers
When a customer installs our script on their website, it collects the same visit information described in section 1 for that website’s visitors. When a visitor submits a contact or quote form on that website, the script also sends us the name, email address, phone number and “how did you hear about us” answer they typed into it. On Webflow sites it reads only the forms and fields the customer chose for it (in their dashboard or the Webflow Designer), and never a form with a password, sign-in, verification-code or payment field (details: Data & tracking). Customers can also add or import lead records themselves, such as phone leads, booking status and job value.
We use this only to produce that customer’s attribution reports and dashboard. We don’t sell it, use it for advertising, combine it across customers, or use it for any purpose of our own. What each item is and how long it’s kept is listed on our data & tracking page.
4a. Google user data (Connect Google Tag Manager)
Customers can connect Which AI Sent to their website through Google Tag Manager instead of editing code. When a customer clicks Connect Google Tag Manager and approves access in Google’s sign-in screen, Which AI Sent receives a temporary access token for one Google Tag Manager permission:
| Permission | What we use it for |
|---|---|
Manage Tag Manager containers (tagmanager.edit.containers) | To find the container that runs on the customer’s website, create a separate workspace in it, and add one tag, “Which AI Sent”, that loads our tracking script on all pages |
How we handle it:
- We use the access only to add the “Which AI Sent” tag, in its own new workspace. We never publish: the customer reviews the tag and publishes it themselves in Tag Manager. We don’t read, change or delete any other tags, triggers or variables.
- We request one-time access only: no refresh token. We revoke the access token immediately after adding the tag, and we never store it.
- We keep only the container ID (for example GTM-XXXXXXX) and a log entry that the connection succeeded, so the customer can see how their site was connected.
- We don’t access any other Google data, and we don’t sell, share or use Google user data for advertising.
- The customer can remove the tag at any time in Google Tag Manager, and can review or remove app access at myaccount.google.com/permissions.
Which AI Sent’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Other one-click connections. Customers can also connect WordPress, Shopify, Wix or Webflow. Each platform shows its own approval screen listing exactly what Which AI Sent may do. For WordPress, Shopify and Wix we use the access once, to add our plugin, pixel or script, and don’t keep the access token.
Webflow. We use Webflow’s Custom Code API to register our fixed, versioned script and apply it to the site the customer picks. We never publish the customer’s site: the script goes live when they publish from Webflow. We also use Webflow’s Forms API (List forms only) to show the customer their site’s forms, so they can choose which one our script reads; we never request their form submissions through Webflow. We store the Webflow access token encrypted (AES-GCM, with the key kept outside the database) and use it only to apply, update or remove our script, list the site’s forms when the customer asks, and notice when the app is uninstalled. It’s deleted when the customer disconnects the site or uninstalls the app.
Integrations customers set up. A customer can choose to have new leads sent to their own tools, such as their CRM, Zapier, Make or GoHighLevel. We send lead details there only because the customer asked us to, and the customer controls that destination.
5. Legal basis
Where laws such as the GDPR apply, we rely on our legitimate interest in running and improving our website and replying to enquiries, and on performing our contract with customers. For data we process on behalf of customers, the customer is responsible for having a lawful basis and giving any notice or obtaining any consent their local law requires.
6. Who we share it with
For customers, our Data Processing Agreement sets out exactly how we handle the data we process for them.
We use a small number of service providers to run Which AI Sent:
| Provider | What for |
|---|---|
| Cloudflare, Inc. | Hosting, content delivery, our database, and forwarding our own email |
| Resend (Plus Five Five, Inc.) | Sending account emails: verification, password resets and lead alerts |
| Paddle.com | Checkout, payments, invoices and sales tax for paid plans. Paddle is the Merchant of Record and handles your payment details directly; we never see or store your full card number. |
| OpenAI, L.L.C. / Anthropic, PBC | The AI model behind the help chat (only what you type into the chat), and AI visibility checks (only a business’s name, service and area, never visitor or customer data) |
We may also disclose information if the law requires it, or to a buyer if the business is sold, in which case this policy would continue to apply. We never sell personal information and never “share” it for cross-context behavioural advertising as the California Consumer Privacy Act defines those terms.
7. Where it’s stored
Our database is hosted by Cloudflare. Requests are handled on Cloudflare’s global network, so information may be processed in the United States, the European Union and other countries where Cloudflare operates. Cloudflare protects international transfers using standard contractual safeguards.
8. How long we keep it
| Data | Kept for |
|---|---|
| Anonymous visit records (source, pages viewed, active time on the site, device) | 25 months, then deleted automatically |
Visitor ID in the browser (_ta_vid) | 90 days from the last visit |
| Leads, bookings and revenue a customer records | While the customer’s account is active; deleted within 90 days after it closes (or sooner on request) |
| Contact-form enquiries to us | 24 months |
| Audit log of changes (who changed what, and when) | 24 months |
| Email verification and password-reset links | Deleted 7 days after they expire or are used |
| Login sessions | Deleted when they expire (30 days for customers, 12 hours for staff) |
| Help-chat usage counters (no message content) | 90 days |
| Database backups (Cloudflare point-in-time recovery) | Roll off automatically within 30 days |
Deletions run automatically every night.
9. Your choices and rights
Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, and to object to or restrict how we use it. To ask, email info@whichaisent.com. We’ll respond within 30 days and won’t treat you differently for asking.
If your request is about a website that uses our service, we’ll pass it to that business and help them respond. You can also contact them directly.
To stop our script from recognising you, clear cookies and site data for the website in question. Customers can also set the script to respect the Global Privacy Control signal.
10. Security
Data is encrypted in transit. Access to customer data requires a secret key, and each customer’s dashboard can only see that customer’s data. No system is perfectly secure. If a breach affects your information, we’ll tell the affected customers and, where required, the authorities.
11. Children
Which AI Sent is a business service and isn’t directed at children under 16. We don’t knowingly collect their information.
12. Changes
If we change this policy, we’ll update the date at the top. If the change is significant, we’ll tell customers by email before it takes effect.
13. Contact
Which AI Sent, operated by Tamitechs
info@whichaisent.com