How we keep it safe.

Smara sits on your website and talks to your visitors, so it has to be safe for both. This is what we do today, in plain words, and how to tell us if you find a problem.

Last updated 13 October 2026 · Smara Intelligence Pvt Ltd, India

Encrypted in transit: Every page, API call and live avatar stream uses TLS.
Keys stored hashed: Your full key is shown once. We keep only a hash, so even we cannot read it back.
Locked to your websites: A key only works on the websites you list, so a copied tag is useless elsewhere.
Card details never reach us: Payments happen on Cashfree's page. We only learn whether an order was paid.
Conversations kept 30 days: Then deleted automatically. Voice recordings are not kept at all.
Report a problem: Email connect@smaralive.com with "Security" in the subject.

On this page

How the product is built
Accounts and access
Keys and websites
Your data
Where it runs
Reporting a vulnerability
Status

1. How the product is built

The avatar, its voice and its answers are made on our servers. Your visitors' browsers receive only the picture and the sound, never our engine, models or your business's settings.

Each conversation is separate. One visitor's conversation is never visible to another.

2. Accounts and access

You sign in with Google or with a one-time code sent to your email. There are no passwords to leak.
Every account action checks that the site belongs to you.
Our own operator access needs a separate secret and gives short-lived tokens. Sign-in attempts are rate limited.

3. Keys and websites

A key is shown once, when it is made, and stored as a one-way hash.
Each site has a list of allowed websites. The engine checks where every conversation comes from before it starts.
You can revoke a key and make a new one at any time in your studio.

4. Your data

Conversation text is kept 30 days so you can see what people asked, then deleted. Visitors' audio is turned into text and discarded. Nothing is sold, and nothing is used to train AI models. The full detail is in our privacy policy.

5. Where it runs

Our servers run in Asia-Pacific on Modal; the website on Vercel; accounts on Supabase; stored data on Upstash; most replies come from Groq; payments go through Cashfree. Each is listed, with what it does, in our privacy policy. Data at rest is encrypted by these providers.

6. Reporting a vulnerability

Write to connect@smaralive.com with "Security" in the subject. Tell us what you found and how to reproduce it. We acknowledge within 2 working days and keep you updated until it is fixed. If you act in good faith, do not access other people's data and give us time to fix it, we will not take legal action against you.

7. Status

Live status of the website and API: smaralive.com/status.