Last updated: October 28, 2026
Waffer, Inc., a Delaware corporation doing business as “Teaflask” (“Teaflask”, “we”, “us”), provides an AI agent and related features that companies embed in their own products. This policy explains what personal data we handle, in which role, and what your rights are. It covers three situations: browsing teaflask.com, using the Teaflask dashboard as a customer, and using one of our customers’ products that runs Teaflask’s code. Cookies and browser storage are covered in detail in our Cookie & Storage Policy.
1. The two roles we act in
For data about our own website visitors and customers, Teaflask is the controller (or “business” under US state privacy laws): we decide how and why it is processed, and this policy governs. For personal data processed through surfaces our customers deploy — above all, conversations between a customer’s end users and that customer’s assistant, whether embedded in the customer’s product or on a help center we host for them, and activity captured in a customer’s product where that customer turns capture on — Teaflask is a processor (or “service provider”) acting on the customer’s instructions.
2. If you used a product that runs Teaflask's code
This policy does not govern personal data we process on behalf of our customers through their use of the service. The company whose product you were using is the controller of that data: its privacy policy governs, we process the data only according to its instructions and our agreements with it, and it decides how long conversations are kept and who sees them. Requests to access, correct, or delete that data should be directed to that company first; we assist our customers in responding to such requests as required by law.
Even so, you deserve to know how the machinery behaves, so here is what Teaflask’s surfaces actually do on our customers’ behalf:
- Teaflask’s embedded code sets no cookies. It authenticates with short-lived tokens and stores only namespaced entries in the browser’s local and session storage, described in the Cookie & Storage Policy.
- Hosted help centers set nothing on your device. Help centers we serve for customers require no account, set no cookies, and use the same cookieless, in-memory analytics as our marketing site.
- Anonymous conversations carry no identity. If the host product has not identified you to the assistant, the conversation record contains no user identifier, no IP address, and no device fingerprint — the only personal data in it is whatever you chose to type. These conversations are deleted after a fixed idle period (currently 365 days since last activity).
- Identified conversations belong to the customer. If the host product signs you in to the assistant, it passes us an identifier of its choosing (and optionally your email address for display — which we do not store in our database; it travels only inside short-lived tokens). The assistant may also retain working notes about identified users on the customer’s behalf, to personalize future conversations; the customer controls and can delete them.
- Activity capture is optional, and the company decides how it’s used. Some Teaflask features capture how people use a company’s product. They are off unless the company turns them on and adds them to its product; the company decides whether and whom to capture, and Teaflask shows you no banner or prompt of its own. Where capture runs, it can include the pages you open, the site you arrived from and whether the page is in view; the controls you use; what you enter in forms and the choices you make; what the page shows; and events the company’s own code sends. Sensitive fields such as passwords and payment card details, and values that look like secrets, are redacted in your browser, and the company can exclude any part of its pages. Unless the company has chosen otherwise, nothing is captured while your browser sends a Global Privacy Control signal; the company can also stop capture or let you opt out. Captured activity carries no IP address or device fingerprint, but it can contain personal data that appears on the pages you use or that you type, and if the company has identified you, it is linked to your account. It is kept for the period the company sets and then deleted, and the company can delete it sooner.
- Connecting your ChatGPT plan is optional and under your control. If the host product offers it, you may connect your own ChatGPT Plus or Pro plan through OpenAI’s Sign in with ChatGPT, so that your conversations with the assistant run on that plan. OpenAI’s consent screen asks you to share basic profile information (your name and email) and permission to use your plan. We verify the sign-in and then discard the identity details: we store no name, email, or ChatGPT account identifier from it, only the access and refresh tokens, encrypted at rest. Those tokens are used only to run your own conversations with the assistant on your plan, to check that the connection still works, and to refresh themselves, including a periodic background refresh while you are idle. You can disconnect in the assistant, which deletes the stored tokens and asks OpenAI to revoke the access you granted; reconnecting replaces the tokens and revokes the old access the same way. You can also remove the app in ChatGPT’s settings under linked apps.
- Page reading is bounded and redacted. When the assistant reads the page you are on to help you, it receives the page URL, title, and a bounded snapshot of visible content. Password fields, card numbers, and one-time codes are always redacted before anything leaves your browser, and hidden fields are never read.
- It is always presented as AI. Assistants identify themselves as AI assistants, and actions that matter require approval under rules the host company configures.
3. Data we collect as controller
Visitors to teaflask.com
The marketing site sets no cookies and writes nothing to your device. We collect aggregate, cookieless usage analytics (pages viewed, referrer, coarse device type) that are not joined into a profile of you across visits. If you email us, we receive what you send.
Customers and their team members
- Account data: name, email address, and credentials — or, if you sign in through a third-party identity provider, the identity that provider shares with us — plus your organization and your role in it.
- Service content: the content and systems your organization connects and the content it creates in the service. This is your organization’s data under the Customer Agreement; we process it only to provide the service.
- Usage data: how the dashboard is used — page views, feature usage, and the success or failure of operations — collected via our analytics provider, along with operational logs and metrics that are limited to opaque identifiers rather than content.
- Billing data: payments are handled by our payment processor, which collects your payment details directly; we never receive card numbers, and we reference your organization to it by an internal identifier, not by your name or email.
- Support and communications: messages you send us, and messages you exchange with the Teaflask assistant inside the dashboard.
4. How we use personal data
- to provide, secure, and operate the service — including authentication, abuse and fraud prevention, and rate limiting (IP addresses are used transiently for rate limiting and security and are not stored in our database);
- to understand how the product is used and to fix and improve it, using usage analytics and operational telemetry;
- to bill for paid features and maintain business records;
- to communicate with you about the service — transactional email such as sign-in confirmations and, where permitted, product updates you can opt out of;
- to comply with law and enforce our agreements.
Where GDPR or similar laws apply, our legal bases are: performance of a contract (providing the service), legitimate interests (security, product improvement, business operations — balanced against your rights), consent where we ask for it, and legal obligations.
5. AI processing and model providers
The service is built on third-party foundation models. Conversation content, connected content, and page context are sent to our model providers to generate responses and embeddings; those providers act as our subprocessors and process this data solely to provide the service to us. Activity captured in a customer’s product may also be processed by these providers to provide the service; the commitments in this section, including that providers may not train on this data, apply to it in the same way. We do not use your data or your end users’ conversations to train AI models, and our agreements with our model providers prohibit them from using this data to train theirs. Two kinds of traffic run under someone else’s agreement rather than ours, so that promise is not ours to make for them. Customers who bring their own model-provider API key send model traffic under their own provider agreement instead; that provider relationship is theirs, and we store their key encrypted and use it only to provide the service to them. Likewise, conversations that an end user chooses to fund with their own ChatGPT plan are processed by OpenAI under that user’s own agreement and data controls with OpenAI, not under our subprocessor agreement; whether OpenAI may use those conversations is governed there, not by our agreements.
6. Who we share personal data with
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We disclose personal data only to the service providers below (bound by data protection agreements and processing only on our instructions), to professional advisers, in a corporate transaction with notice, or where required by law — in which case we will notify you unless legally prohibited.
| Category | Purpose | Location |
|---|---|---|
| Foundation model providers | Generate agent responses and embeddings from conversation content and connected content | United States |
| Cloud infrastructure providers | Hosting, database and authentication, storage, workflow orchestration, isolated build environments, and content delivery | United States |
| Payment processor | Payment processing for paid features; collects payment details directly — card numbers never reach us | United States |
| Analytics and monitoring providers | Product analytics, operational logs and metrics, and internal alerting | United States |
| Services your organization connects | When your organization connects an outside service — a code host, identity provider, or other integration — we exchange data with that provider at your direction | Wherever your chosen provider operates |
This section is written in categories on purpose: the specific vendors within a category change as the product evolves, and the named subprocessor list is available on request at privacy@teaflask.com. If we begin sharing personal data with a new category of provider, we will update this policy first.
7. How long we keep data
| Data | Retention |
|---|---|
| Anonymous end-user conversations | Deleted after a fixed idle period — currently 365 days after last activity |
| Identified end-user conversations and assistant notes | Retained for the customer, until the customer deletes them or the customer relationship ends |
| Activity captured in customers' products | Kept for the period the customer sets — currently 90 days unless the customer chooses between 7 and 365 days — then deleted. When the customer deletes captured activity, stored copies are removed within 24 hours |
| An end user's connected ChatGPT plan tokens | Until the user disconnects in the assistant, reconnects (which replaces them), or the customer's organization is deleted. Refreshing replaces the tokens but does not end the connection, and we do not end connections on a schedule: a connection that has stopped working stays stored, flagged in the assistant for the user to act on, until the user disconnects |
| Customer account and organization data | Life of the account; deleted on verified request or termination (termination is your instruction to delete, subject to legal holds) |
| Transient working data (previews, recently deleted items, operational logs) | Short fixed windows — days to a few weeks — then purged automatically |
| Billing records | As required by tax and accounting law |
8. Security
We maintain administrative, technical, and organizational safeguards appropriate to the data we process, including encryption in transit, tenant isolation, least-privilege access, always-on redaction of sensitive fields read from or captured on pages, and encrypted storage of customer API keys. Details of our security program are available through our trust center. No system is perfectly secure; if a breach affects your personal data, we will notify affected customers without undue delay. Security researchers can reach us at security@teaflask.com.
9. International transfers
We are a US company and process data in the United States. Where we receive personal data from the EEA, UK, or Switzerland, we protect it using appropriate safeguards — including the European Commission’s Standard Contractual Clauses with our subprocessors where required — and you may request a copy of the relevant safeguards via privacy@teaflask.com.
10. Your rights (EEA, UK, and similar jurisdictions)
Where data protection law grants them, you have the right to access, correct, delete, and receive a portable copy of your personal data; to object to or restrict certain processing; to withdraw consent at any time where processing is based on consent; and to complain to your supervisory authority. To exercise these rights, email privacy@teaflask.com — we will verify your request and respond within the time the law requires. If the data at issue is processed on behalf of one of our customers, we will refer your request to that customer and assist them in fulfilling it (see section 2).
11. US state privacy rights
Residents of California and other US states with comprehensive privacy laws have rights to know, access, correct, delete, and port their personal information, and to opt out of its sale, sharing, or use for targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and we honor opt-out preference signals such as Global Privacy Control to the extent they apply. We will not discriminate against you for exercising any privacy right. Exercise these rights via privacy@teaflask.com; authorized agents may submit requests the same way.
12. Children
Our website and service are not directed to children under 18, we do not knowingly collect personal data from them, and our Customer Agreement prohibits deploying the service in products directed at them. If you believe a child has provided us personal data, contact privacy@teaflask.com and we will delete it.
13. Changes to this policy
We will post any changes here with an updated date, and for material changes we will give notice — to customers by email or in the dashboard — before they take effect. Earlier versions are available on request.
14. Contact us
Privacy questions and requests: privacy@teaflask.com. Legal notices: legal@teaflask.com. Waffer, Inc., 2261 Market Street, STE 86804, San Francisco, CA 94114.