Plain-language summary: you bring your own AI provider key, we host the assistant and keep your key encrypted, you pay $49/month, and either side can cancel anytime. The full terms below control.

1. Agreement

These Terms of Service ("Terms") govern your access to and use of the SikloAI platform, websites, APIs, and embeddable widget (the "Service"). By creating an account or using the Service, you agree to these Terms. If you are using the Service on behalf of an organization, you represent that you are authorized to bind that organization.

2. The Service

SikloAI lets you create AI assistants ("workspaces") trained on knowledge you provide, embed them on your website, and run agent tools. The Service operates on a bring-your-own-key ("BYOK") basis: you supply your own API key for a third-party AI provider (Anthropic, OpenAI, Groq, or Gemini), and the assistant uses that key. We store your key encrypted at rest and use it solely to operate your workspaces.

3. Accounts & security

You are responsible for the activity under your account and for keeping your password and API keys confidential. You must provide a valid email address and verify it where required. Notify us promptly of any unauthorized use. We may suspend accounts that appear compromised or that violate these Terms.

4. Acceptable use

You agree not to use the Service to: (a) break the law or infringe others' rights; (b) upload content you don't have the right to use; (c) generate or distribute malicious, deceptive, harassing, or unlawful content; (d) attempt to disrupt, reverse-engineer, or gain unauthorized access to the Service; or (e) exceed plan limits or circumvent rate limits. You are responsible for the knowledge you add and the outputs your assistant produces.

5. Third-party AI providers

The Service relies on third-party AI providers that you connect via your own key. Your use of those providers is also governed by their terms and policies, and they — not SikloAI — process the prompts and content sent using your key. AI outputs may be inaccurate; you are responsible for reviewing outputs before relying on them.

6. Fees & billing

Paid plans are billed in advance on a recurring monthly basis ($49/month for the Workspace plan unless otherwise stated) through our payment processor. By subscribing, you authorize recurring charges until you cancel. Fees do not include any usage costs charged to you directly by your AI provider under your own key.

7. Cancellation

You may cancel anytime from your billing settings. Cancellation stops future renewals; access continues until the end of the current billing period. Subscriptions are non-refundable except as described in our Refund Policy.

8. Your content

You retain ownership of the documents, knowledge, and data you provide ("Customer Content"). You grant SikloAI a limited license to host, process, and transmit Customer Content solely to provide the Service. You are responsible for having the rights to that content and for complying with applicable privacy laws regarding any personal data it contains.

9. Availability & changes

We work to keep the Service available but do not guarantee uninterrupted operation. We may modify, suspend, or discontinue features, and may update these Terms; material changes will be posted here with an updated date. Continued use after changes constitutes acceptance.

10. Disclaimers

The Service is provided "as is" and "as available," without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. SikloAI does not warrant that AI outputs are accurate, complete, or suitable for any purpose.

11. Limitation of liability

To the maximum extent permitted by law, SikloAI will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits or data. Our total liability for any claim relating to the Service will not exceed the amount you paid us in the three months before the claim.

12. Indemnification

You agree to indemnify and hold SikloAI harmless from claims arising out of your Customer Content, your use of the Service, or your violation of these Terms or applicable law.

13. Termination

We may suspend or terminate your access for violation of these Terms or for risk to the Service or others. On termination, your right to use the Service ends; we may delete your data after a reasonable period.

14. Contact

Questions about these Terms? Email [email protected]

Plain-language summary: we collect what we need to run your account, we encrypt your AI provider keys, we don't sell your data, and your prompts are processed by the AI provider you connect with your own key.

1. Who we are

This policy explains how SikloAI ("we", "us") collects, uses, and protects information when you use the SikloAI platform and embeddable widget (the "Service").

2. Information we collect

• Account data: your email address, hashed password, role, and email-verification status.
• Workspace data: the workspace names, settings, and knowledge documents you add.
• Provider keys: the AI provider API key you supply, stored encrypted at rest (AES-256-GCM) and never displayed back to you.
• Usage & activity: message counts, basic analytics, and an activity log of chats and tool runs, used for limits and insights.
• Billing data: handled by our payment processor, PayPal. We store identifiers and subscription status, not full card numbers.
• Connected integrations: if you choose to connect a third-party app (Google — Gmail, Calendar, Drive; Slack; GitHub; Notion), we store the OAuth access/refresh tokens it issues — encrypted at rest — plus a basic account label.
• End-user chats: messages sent to your embedded assistant by visitors of your site, processed to generate answers.

3. How we use information

We use information to operate and secure the Service: authenticate you, run your assistants, enforce plan limits and rate limits, prevent abuse, provide analytics, process payments, and communicate with you (for example, verification and password-reset emails).

4. AI providers, connected integrations & sub-processors

AI provider. When your assistant answers, the relevant prompt and knowledge are sent to the third-party AI provider you connect using your own key (Anthropic, OpenAI, Groq, or Gemini). That provider processes that content under its own terms.

Connected integrations. When you connect a third-party app via OAuth — Google (Gmail, Google Calendar, Google Drive), Slack, GitHub, or Notion — you authorize SikloAI to access that app on your behalf to perform the actions you or your agent request. We store the OAuth tokens encrypted at rest and use them only to carry out those requested actions. You can disconnect any integration at any time from the dashboard, which deletes its stored tokens.

Google API Limited Use. SikloAI's use and transfer of information received from Google APIs adheres to the "Google API Services User Data Policy," including its Limited Use requirements. We use Google user data only to provide the features you request; we do not sell it, do not use it for advertising or to train AI models, and do not allow humans to read it except as necessary for security, to comply with law, or with your explicit consent.

Sub-processors. We rely on infrastructure and service sub-processors, including our payment processor (PayPal), site analytics (Google Analytics) and, if you enable it, email delivery (Resend). We share only what each needs to perform its function.

5. Encryption & security

Provider keys and connected-integration tokens are encrypted at rest. Passwords are salted and hashed (scrypt). Sessions store only a hash of the session token. We use HTTPS in production and apply rate limiting and access controls. No system is perfectly secure, but we take reasonable measures to protect your data.

6. Data sharing

We do not sell your personal data. We share data only with the sub-processors above to run the Service, when required by law, or to protect the rights and safety of users and the public.

7. Data retention

We retain account, workspace, and activity data for as long as your account is active and as needed to provide the Service. You can delete a workspace at any time, which removes its knowledge, usage, and activity. On account closure we delete or anonymize data after a reasonable period, except where retention is required by law.

8. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can manage much of this from the dashboard, or contact us to exercise these rights. If you provide end-user (visitor) data to your assistant, you are responsible for having a lawful basis and informing those individuals.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

10. Changes

We may update this policy; material changes will be posted here with a new date. Continued use after changes constitutes acceptance.

11. Contact

Questions or requests? Email [email protected]

How we protect your data: API keys and integration tokens are encrypted at rest, passwords are hashed, every workspace is isolated, and connected apps are accessed only to perform the actions you request.

Encryption

• At rest: AI provider API keys and connected-integration OAuth tokens are encrypted with AES-256-GCM (authenticated encryption) and are never displayed back to you.
• In transit: all traffic to the Service uses HTTPS/TLS.

Authentication & sessions

• Passwords are salted and hashed with scrypt — we never store them in plain text.
• Sessions store only a hash of the session token, so a database leak cannot be used to resume anyone's session.
• Auth endpoints are rate-limited to blunt credential-stuffing.

Tenant isolation & bring-your-own-key

• Each workspace's data, knowledge, keys, and connections are scoped to that workspace; owners can only access their own.
• SikloAI is bring-your-own-key: your AI usage runs on your own provider key, so it is isolated to your account and never shared across customers.

Connected integrations

• You connect third-party apps (Google, Slack, GitHub, Notion) via OAuth; we request the minimum scopes needed and store the resulting tokens encrypted.
• Tokens are used only to perform the actions you or your agent request. You can disconnect any integration at any time, which deletes its stored tokens.
• Our use of Google user data follows the Google API Services User Data Limited Use requirements.

Infrastructure

• The Service runs on managed cloud infrastructure with HTTPS, access controls, and per-tenant rate limiting.
• We follow the principle of least data: we collect only what is needed to run your account and the Service.

Responsible disclosure

If you believe you've found a security vulnerability, please email [email protected] with details. We appreciate good-faith reports and will work with you to investigate and fix issues. Please do not access other users' data or disrupt the Service while testing.

No system is perfectly secure. We take reasonable, industry-standard measures to protect your data, but cannot guarantee absolute security. This page describes our practices and is not a certification or warranty.

Contact

Security questions? Email [email protected]