Privacy

What we collect

On this public website, Statsig collects page views, clicks, device and browser context, performance data, a pseudonymous per-device identifier, and session replay data so we can understand and improve the experience. Form inputs are masked and lead forms are blocked from session replay; named analytics events do not contain submitted contact details or assistant prompt text. If you choose a Console signup link, the browser uses the per-device identifier transiently to create a separate pseudonymous acquisition identifier and sends a short-lived signed handoff directly to the Console. The raw website identifier is not placed in the URL or persisted in our CRM notes. The public site assistant processes your messages and keeps the recent conversation context needed to answer. If you choose its workflow-consultation form, we collect the contact details, company information, workflow brief, and contact consent you review before submission. When you sign in with Google to the separate console, we receive your account identity (your email and a stable subject identifier) to create your workspace. We also store the deployment metadata and operational records needed to run and secure the service and administer subscriptions, such as which apps you deployed and safety-control counters.

Secrets and tokens are protected by design

Service credentials and secrets are stored through the credential broker, never in manifests, widget payloads, or logs. Our logging is structurally redacted: no code path logs a request header, request body, bearer token, secret value, or continuation token. Tool-call payloads and the contents your server processes are not retained as logs.

How we use data

We use the data above to operate, secure, debug, and improve the hosted service; administer subscriptions, pooled usage limits, and safety controls; and respond when you explicitly submit a contact or workflow-consultation form. Contact fields entered in the assistant’s private form go through a confirmation-gated app action to our CRM and are not added to the ordinary model conversation. We do not sell personal data.

Conversation history

A business using an assistant on Noodle Seed can choose to keep a history of its conversations so its staff can review them. When it does, the assistant tells you how long chats are kept, for example “Chats are kept for 7 days” under the chat box or in its first WhatsApp or SMS reply. History holds the messages shown in the chat and a note of any actions taken; payment card numbers are masked to their last four digits. It is kept for the period the business chooses, up to its plan’s limit, and then deleted. Only that business’s authorized staff can read it, and the business can export or delete it. Noodle Seed’s own site assistant keeps history only when it shows that notice.

WhatsApp

When you message a WhatsApp number answered by an assistant running on Noodle Seed, we receive your WhatsApp phone number or user ID, your messages and delivery status updates through Meta's WhatsApp Business Platform (and, for Noodle Seed's own number, our provider 360dialog). The assistant uses your messages and recent conversation context to reply. The assistant’s working copy of your messages is deleted within seven days of receipt, or sooner if the business sets a shorter period. If the business keeps conversation history, its first reply tells you how long chats are kept, and they are deleted after that period; we keep only content-free records such as usage counters, blocks and delivery receipts to prevent abuse and run the service. We do not use WhatsApp messages for advertising and do not sell them. When a business connects its own WhatsApp number, that business decides what its assistant does and we process its customers' messages on its behalf.

SMS assistance

When you text a number answered through Noodle Seed, we process your phone number, message content, message identifiers, timestamps and delivery status to answer your request, maintain recent conversation context, enforce opt-outs and prevent abuse. Noodle Seed’s own SMS assistance program is operated by TheNoodleSeed Corporation. You initiate the conversation; your message permits replies in that exchange, not marketing or recurring outreach. For another business’s number, that business controls its assistant and we process messages on its behalf. The assistant’s working message content is deleted within seven days of receipt, or sooner if the business sets a shorter period. Separately enabled conversation history follows the retention notice in the first reply. Content-free usage, delivery, security and opt-out records may remain so we can operate the service and honor your choice to stop.

The SMS privacy details for Noodle Seed’s own number are published on our business website.

SMS information and consent

We do not sell or rent mobile information, use it for advertising, or share it with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties. Service providers process the message data needed to deliver and answer your requested conversation on our behalf, as described below; consent is not transferred to them for their own messaging.

Subprocessors

The hosted service runs on Google Cloud, which processes data on our behalf to provide compute, storage, and key management. Statsig processes website analytics, session replay data, pseudonymous Console interactions, and pseudonymous service-verified product-usage facts. Those product facts exclude prompts, responses, tool arguments and results, URLs, tokens, configuration values, logs, errors, and raw account or deployment identifiers. The configured model provider processes site-assistant messages so it can answer, and our Twenty CRM service processes contact-form and confirmed workflow-consultation submissions. Meta delivers WhatsApp messages, and 360dialog relays them for Noodle Seed’s own WhatsApp number. Twilio and mobile carriers deliver SMS, processing phone numbers, message content and delivery information. These providers may retain their own records under their applicable policies. We will publish a full subprocessor list as the service matures.

Deleting your data

You can delete the apps you deploy at any time. To delete your account data, email hello@noodleseed.com from the address you sign in with. To delete a WhatsApp or SMS conversation with an assistant running on Noodle Seed, email hello@noodleseed.com with the phone number you used; we erase the conversation content and keep only content-free abuse-prevention, usage and opt-out records. To delete conversation history kept by a business’s assistant, ask that business or email hello@noodleseed.com; the business can erase it immediately. If you messaged a business's own number, you can also ask that business. We confirm deletion within 30 days. Deleting data from Noodle Seed does not delete copies held by WhatsApp, Meta, Twilio, mobile carriers or that business. Deleting conversation content does not undo an SMS opt-out.