Smara puts a talking assistant on someone else's website. That means two sets of people matter here: the businesses who install it, and the visitors who end up talking to it. This explains what happens to both.
On this page
Two relationships, with different rules.
You are our customer. We hold your account details and we act on your instructions. In data protection terms you are the controller of your visitors' conversations and we are your processor. You decide what is kept and for how long; we do what you set.
The business running that site decides what happens to that conversation, not us. We hold it on their behalf. If you want it deleted, the fastest route is to ask them, and you can also write to us and we will pass it on and act on it.
Before a business is a customer, we sometimes set Smara up as its receptionist on a private demo link, so its owner can try it. We use only what the business has already published: its website, brochures and public listings. Ask us and we delete the demo the same day.
| What | Why it exists |
|---|---|
| Your email and name | To have an account and to email you about it. Set when you sign in. |
| Site and API keys | So the avatar knows which business it is answering for. |
| Conversation text | The questions visitors asked and the answers given, so you can see what people want. |
| Minutes used | To bill correctly and to show you your usage. |
| Approximate country and time zone | Taken from the network connection and the browser, to pick a nearby server and the visitor's language, and to stop abuse. |
| Your own avatar or voice, if you make one | The photo or the short recording you upload, what we build from it, and your consent (its words, the time and your IP address), so the assistant can look or sound like you. Only you can use it, only on your sites. |
| A random visitor id | Stored in the visitor's browser so a free demo cannot be used repeatedly. It is a random string and identifies nobody. |
For customers, we process account and billing data because we have a contract with you and cannot deliver the service without it.
For visitors' conversations, we process on our customer's instructions. Their own lawful basis governs it, and most rely on legitimate interests in answering their visitors' questions. Where consent is the right basis in your country, the business running the site collects it before the avatar loads.
When a visitor chooses to give their name, phone number or email in a conversation, typed or said out loud, we read it out of the conversation and pass it to that business so they can reply, and it is kept with the conversation for the same 30 days.
The assistant is always an AI and says so. The widget shows an AI label, and if anyone asks whether they are talking to a person, it says it is an AI assistant.
We also keep minimal records for security and fraud prevention, which is our own legitimate interest in not being abused.
A short list, and it stays short on purpose.
| Who | What they do |
|---|---|
| Groq | Generates most reply text, and turns some speech into text when our own recognisers cannot. Conversations pass through; they are not used for training. |
| Upstash | Stores conversation text, usage and keys, in encrypted storage. |
| Modal | Runs the servers that draw the avatar, make its voice, and build an avatar or voice you ask for. |
| Vercel | Serves the website and the widget file. |
| Supabase | Holds accounts and sign-in, including sign-in with Google if you choose it. |
| Cashfree | Takes payments. Card details go to them, never to us. |
Most speech recognition, all speech synthesis and the avatar itself run on our own servers, so what your visitors say and hear mostly stays in our infrastructure rather than being sent to a third party.
| What | How long |
|---|---|
| Conversation text, and contact details given in it | 30 days by default. Shorter, or not at all, on request. |
| Visitors' audio | Not kept. Discarded within the request that produced it. |
| Your own avatar or voice | Until you delete it in the studio or close the account. Deleting it removes the photo or recording and what was built from it. |
| Usage totals | As long as the account exists, then 7 years for tax records, without the conversations attached. |
| Account details | Until you close the account, then 30 days. |
| Server logs | 14 days. |
| Payment records (plan, amount, date) | As long as Indian tax law requires, up to 8 years. Card and bank details are never sent to us. |
Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop processing it, and ask for it in a portable format. If you are in the UK or the EU these are rights under the GDPR; if you are in India they are rights under the DPDP Act; if you are in California they are rights under the CCPA. We apply the same process to everyone rather than sorting people by passport.
Write to connect@smaralive.com. We reply within 30 days. We will not charge you and we will not make you explain why.
If you think we have handled this badly you can complain to your data protection authority. In India that is the Data Protection Board; in the EU it is your national authority; in the UK it is the ICO. We would rather you told us first so we can fix it.
Smara is sold to businesses and is not directed at children. We do not knowingly collect data from children (in India, anyone under 18). A business whose visitors may be children, such as a school or a coaching institute, must get a parent's consent before they talk to the assistant, as India's data protection law requires. If you believe a child has used an avatar and left personal details, write to us and we will delete it.
If you find a security problem, write to connect@smaralive.com. We will not take action against anyone who reports something in good faith.
If we change something that matters, we will email account holders before it takes effect rather than quietly editing this page. The date at the top always reflects the current version.
Smara Intelligence Pvt Ltd, India. Privacy questions, data requests and complaints go to our grievance officer at connect@smaralive.com, with "Privacy" in the subject. We acknowledge within 24 hours and resolve within 15 days. If an avatar or a voice uses someone's face or voice without their consent, we take it down first and look into it after.