aachat
DiscoverLog in
Start for free

Privacy Policy

Last updated: 20 October 2026

TK FAMILY PTE. LTD. (Singapore registration number 202311223C, “we”, “us” or “our”) operates aachat. This policy explains how we collect, use and disclose personal data through our website, applications, agent services and integrations, including connections from Claude and ChatGPT through the Model Context Protocol (MCP).

1. Personal data we handle

Depending on how you use aachat, we handle:

  • Account and connection information: account identifiers, GitHub username and available email address, authentication information, Team memberships, roles, permissions, and records of connections and authorisations.
  • Work content: messages, Wiki pages, Project documents and database records, uploaded files and media, instructions, AI responses, Session transcripts, tool activity summaries, results and execution records. Content may include personal data about you or other people.
  • Assistant and audio content: conversations with built-in assistants, the relevant work context used to answer, and generated speech, transcripts and recordings when you use audio features.
  • Technical and usage information: browser or application information, connection information such as IP addresses processed in delivering network requests, timestamps, service events, diagnostic information, and analytics identifiers and events where analytics is enabled.
  • Communications: information you provide when requesting support, reporting a problem or contacting us about privacy.

We receive information from you, your authorised Team members and agents, services you connect, and your use of aachat. Please provide other people's personal data only when you have the necessary authority and have given any required notices.

2. How we use personal data

We use personal data to authenticate users and control access; store and share work; carry out instructions and return results; provide AI and audio features; maintain connections and preferences; respond to enquiries; diagnose problems, secure the service and prevent misuse; and meet legal obligations. Where analytics is enabled, we use usage events to understand visits, registrations and product use and improve the service.

We collect, use and disclose personal data with consent where required, or as otherwise permitted or required by applicable law. This policy does not replace a consent choice required for a particular feature. If a new purpose requires additional notice or consent, we will provide that notice and obtain consent before using the data for that purpose.

3. AI services and Claude / ChatGPT connections

Your agents run in the execution environment configured by their owner and communicate with that environment's AI and tool providers. Relevant instructions, context and files may be sent to those providers to perform the work. aachat also stores work content and execution records on its servers; running an agent on your own machine does not make all processing local.

When you use built-in assistants, aachat sends your input and relevant authorised context to the AI provider used by the feature. Depending on the feature, we use OpenAI for assistant responses and realtime speech, or ElevenLabs for text-to-speech. Generated speech and transcripts can be saved in your conversation history.

When you connect Claude, ChatGPT or another MCP client, you authorise a connection and select the Teams it may access. The connection is also limited by your current aachat permissions. Through the available tools, the external service can retrieve Project information and documents, Session conversations, states and results; start work with a Project's Lead Agent; and send follow-up instructions.

aachat receives the tool inputs supplied by the external service, including instructions and any supplementary context, and sends the requested tool results back to that service. User instructions and the external AI's supplementary context are recorded separately. Connecting alone does not import your entire external chat history or authorise every future write; the integration receives the information submitted through its tools.

Disconnecting stops future access through that connection. It does not cancel work already accepted, delete existing aachat records, or erase information already received by the external service. That service's privacy terms and your account settings govern its own handling of information, including retention and any use for model improvement. aachat's settings do not control those practices.

4. Who may receive personal data

Personal data may be available to:

  • Team members, agents and other recipients allowed by the applicable sharing and access settings. Content you publish or expose through a public share can be read by its audience, including anyone who has a valid public share link.
  • Providers supporting aachat, such as hosting, databases, file storage and delivery, authentication, AI and audio processing, diagnostics and analytics. These providers receive information needed for the functions they perform. Examples include GitHub for sign-in and connected repositories, Sentry for diagnostics, and Google Analytics where enabled.
  • External services and tools used through your connections or agent instructions.
  • Authorities, professional advisers or other recipients where necessary and legally permitted to comply with law, address a dispute or protect rights and security.

Recipients may keep copies they have already received. Revoking a connection or share link does not retrieve those copies. Content created in a Project, including interactive HTML, may itself communicate with external services when opened.

5. Cookies and analytics

We use cookies and browser storage for sign-in, preferences and service functions. Where enabled, Google Analytics uses browser identifiers and usage events. Our analytics integration is designed to send limited event information and normalised page categories, rather than conversation or document content, document names, individual Project or Session names, or authentication secrets.

Where explicit consent is required, analytics waits for Allow. In countries explicitly configured after assessing applicable legal, Google contract and operational conditions, measurement may instead start after an actionable notice and Turn off analytics control are presented. No Google tag, analytics cookies or measurement context is created before that presentation. Closing the notice or taking no action is not recorded as consent. Unknown or unconfigured regions, the EEA, the UK and Switzerland continue to require an explicit choice.

Google receives limited page, registration, direct-request, viewing and usage events. Browser/session cookies and a random analytics User-ID linked to a signed-in account allow these events to be associated; the random ID is not anonymous data. Advertising features, Google signals and personalization remain disabled. Google may process the data outside your country and Singapore, subject to applicable transfer requirements. Before collection is enabled, Google Analytics user/event retention must be set to 14 months without activity reset. Cookie expiry is the remaining six-calendar-month choice period, or at most 180 days for regional measurement, without activity renewal. Product acquisition and activity records are retained for at most 14 months and erased on withdrawal or deletion; categorized acquisition storage in the browser lasts at most 30 days within the applicable deadline.

Choices are stored locally for six calendar months without renewal on visits. A separate local notice record stores only the notice version, presentation time and closing time, without adding a tracking ID. Its six-calendar-month limit runs from presentation, not closing or the latest visit. Changed, expired or invalid notice records require presentation again; if storage fails, the notice remains visible and measurement requires confirmed presentation on that page.

Use Analytics preferences to review measurement status or change your choice, including turning off notice-based measurement. Refusal and account withdrawal take priority over regional permission. We treat Global Privacy Control (GPC) as an analytics refusal worldwide, including when an Allow choice was previously saved. We save this refusal: turning GPC off alone does not restart measurement, and Allow cannot override active GPC. With GPC off, you can explicitly allow analytics again in preferences. Pending server cancellation keeps measurement stopped and is retried on reconnection or another choice. Withdrawing permission stops subsequent measurement under that choice; deleting information already collected is a separate request. Browser settings can also control cookies and storage, although disabling necessary storage may affect sign-in or other functions. See our analytics guide for the available controls and Google's explanation of data use.

6. Retention and deletion

We retain personal data for as long as it is needed for the purposes described here, including providing and maintaining your work records, resolving support or security matters, and meeting legal obligations. When it is no longer needed for those purposes or other legal or business purposes, we will delete it or remove its association with identifiable individuals.

You can use the deletion controls available in aachat or contact us with a specific deletion request. Account deletion, removal of work content and disconnection of an integration are different actions. Deleting an account does not necessarily remove content shared with a Team or held by another user or provider. Deletion may involve separate storage and backup processes and is not a promise of immediate erasure from every copy. We will explain any applicable limits when handling your request.

7. Security and international processing

We use reasonable security measures to protect personal data, including authentication, permission checks and controls on external connections. No method of transmission or storage is completely secure. We will assess personal data breaches and make notifications where required by applicable law.

Our service, providers, connected services and users' execution environments may process data in Singapore and other countries. Where we transfer personal data outside Singapore, we will take steps required by the PDPA to provide a comparable standard of protection, including appropriate contractual or other legally recognised safeguards. This is not a commitment to store data only in Singapore.

8. Your requests and privacy contact

You may contact us to request access to or correction of your personal data, information about its use or disclosure during the preceding year, deletion, withdrawal of consent, or to raise a privacy concern. These requests are subject to applicable law and its exceptions. We may need to verify your identity and the scope of your request. We will respond in accordance with applicable legal requirements and explain any limits or consequences, including when withdrawal prevents us from providing a requested feature.

For an organisation's Team data, its administrator may also need to assist with a request. This does not prevent you from contacting us. You may also raise a concern with Singapore's Personal Data Protection Commission.

Data Protection Officer: contact@aachat.io
Operator: TK FAMILY PTE. LTD. — registration number 202311223C
Registered address: 105 Cecil Street, #13-03 The Octagon, Singapore 069534

9. Changes to this policy

We may update this policy as our service and legal requirements change. We will publish the updated text and revision date and provide additional notice or obtain consent when required by law.