Privacy Policy

Talaash (“we”, “our”) provides AI-powered search and search analytics for Webflow CMS sites. This policy explains what we collect, where it is stored, and when it is deleted when you create a Talaash account or install the Talaash Webflow app.

Information we collect

• Account data — your email address and a hashed password for your Talaash account. If you sign in with Google, we receive your Google account’s email address, name and profile picture URL from Google; we never see your Google password.
• Webflow authorization — an OAuth access token that lets us read your site details and the CMS collections you choose, and add or remove the Talaash search script on your site. The token is encrypted (AES-256-GCM) before it is stored, is only ever used on our servers, and is never sent to browsers, site visitors, or AI providers.
• CMS content — the titles, fields and text from the collections you choose to index, stored with AI embeddings so visitors can search them.
• Visitor search data (on by default) — when a visitor searches on your site we record the search text, the number of results, and random anonymous visitor and session IDs that the search widget stores in the visitor’s browser (local storage and session storage). These IDs let Insights count unique visitors and sessions; they are not linked to names, emails or IP addresses. Site owners can turn the IDs off with data-search-analytics="off" (searches are then still counted, without IDs).
• Autocomplete (on by default) — while a visitor types, the widget sends the partial text to our suggestion service to show autocomplete options. Suggestion requests do not include visitor or session IDs. Site owners can turn autocomplete off with data-search-suggest="off".

How we use information

• Sign you in and connect your Webflow site
• Index the CMS content you select and answer searches on your site
• Show search analytics, content-gap insights and answer-readiness reports
• Add, update and remove the Talaash search script on your Webflow site
• Operate, secure and improve the service

Where data is stored

• Database — account records, the encrypted Webflow token, indexed CMS content and embeddings, field mappings, and search analytics are stored in a managed PostgreSQL database provided by Supabase, hosted on Amazon Web Services in Singapore (AWS ap-southeast-1). Data is encrypted in transit (TLS) and at rest.
• Application servers — the Talaash dashboard and search API run on Vercel. They process requests but do not keep your CMS content or analytics after a request finishes.
• AI processing — OpenAI processes text as described below; it is not our storage location for your data.

AI provider (OpenAI)

To provide AI search, AI answers, content suggestions and related reports, we send limited data to OpenAI as a processor:

• CMS text you index — to create embeddings; short excerpts may be included when generating AI answers or drafting suggestions.
• Visitor search text — to find matching content and, when AI answers are on, to write an answer from your CMS content.
• Search patterns — when you run Content intelligence or AEO (answer engine optimization) reports, sampled or summarized search and CMS signals.

We never send your Webflow token, passwords or visitor/session IDs to OpenAI. Under OpenAI’s API terms, API data is not used to train their models.

Sharing

We do not sell your data. We only use the subprocessors needed to run the product (Vercel for hosting, Supabase for the database, OpenAI for AI features). Site visitors only talk to our search service using a site-specific public search key — never your Webflow token or our server keys.

Retention & deletion

• While connected — indexed content, mappings and search analytics are kept while your Webflow site is connected so search and Insights keep working.
• When you disconnect in Talaash (Setup → Disconnect Webflow) — we remove the search script from your site, revoke our Webflow access, and immediately and permanently delete the stored token and that site’s indexed content, embeddings, field mappings and search analytics. Publish your site afterward so script removal goes live.
• When you uninstall or revoke Talaash from Webflow — the token stops working immediately. Our daily cleanup job detects the revoked access and deletes the stored token and that site’s indexed content, embeddings, mappings and analytics within 24 hours. Because we no longer have access, remove the TalaashSearch script yourself under Site settings → Custom code, then publish (see Support).
• Deletion requests — email us (address on Support) to delete your account or any site data. We complete requests within 30 days and confirm by email. Deleting your account also deletes all connected sites’ data as described above.
• Backups — our database provider keeps automatic backups for up to 7 days; deleted data disappears from backups when they expire.

Contact

Privacy questions: email the address on our Support page.