Privacy Policy

Last updated: August 8, 2026

1. Who We Are

AmeritAI is an AI customer-communication platform operated by Norshin LLC ("AmeritAI", "we", "us"), a limited liability company registered in the Commonwealth of Virginia, United States.

Address: 2807 Hampton Woods Dr, Henrico, VA 23233, USA
Privacy contact: privacy@ameritai.com

2. Scope and Our Role

This policy explains how we handle personal information when you (a) visit our website, (b) create and use an AmeritAI account as a business customer, or (c) interact as an end-user with an AI assistant that a business operates using AmeritAI — on our web widget or through connected channels such as Facebook Messenger, Instagram, WhatsApp, SMS, or voice.

For our website and business-customer accounts, Norshin LLC is the controller. When a business customer uses AmeritAI to communicate with its own end-users, that business is the controller of those conversations and AmeritAI acts as a processor / service provider handling the data on the business's behalf and under its instructions.

3. Information We Collect

• Account & billing data (business customers): name, email, phone, company details, and payment information processed by our payment provider.
• Conversation data (end-users): the messages you send and receive, timestamps, the channel used, and any information you choose to provide during a conversation.
• Channel identifiers: platform-scoped IDs required to route replies (e.g., a Messenger PSID, Instagram IGSID, WhatsApp number, or web session ID).
• Technical & usage data: IP address, browser/device information, and log data collected automatically to operate and secure the service.

We do not intentionally collect sensitive information such as government IDs, full payment card numbers, or health records, and we train our assistants to avoid requesting it. Please do not share such information in a conversation, except as described in "Visual Analysis" below.

Visual Analysis (optional). If a business enables the Visual Analysis feature, a visitor may upload a photo (for example, of a skin or product condition) for a preliminary, non-diagnostic AI assessment. We process such images only to return that assessment on the business's behalf: the image is sent to our AI vision provider and is not stored on AmeritAI's servers. The uploaded photo is held only in the visitor's own browser for the duration of the chat and is cleared when the chat is closed or reset. Under our agreements with our AI vision provider, these images are not used to train AI models. Any assessment is informational only and is not medical advice or a diagnosis; the business — not AmeritAI — is the controller of images its visitors submit.

4. How We Use Information

• To provide, operate, and secure the AmeritAI service and generate AI responses.
• To route and deliver messages between a business and its end-users across the connected channels.
• To process subscriptions, billing, and customer support.
• To maintain, improve, and troubleshoot the service.
• To comply with legal obligations and enforce our terms.

5. AI Transparency and Human Oversight

Some responses in AmeritAI are generated by artificial intelligence. Although we strive for accuracy, AI-generated responses may occasionally be incomplete or inaccurate, and the business operating the assistant remains responsible for reviewing automated responses where appropriate.

When a business enables human handoff, a conversation may be transferred from the AI assistant to a human representative of that business.

AmeritAI does not make legally binding or similarly significant decisions about individuals solely by automated means, without human involvement.

6. Platform Data from Meta (Facebook, Instagram, WhatsApp)

When a business connects its Facebook Page, Instagram professional account, or WhatsApp Business number to AmeritAI and an end-user messages that business, we receive and process Platform Data solely to deliver automated replies on the business's behalf. This includes the platform-scoped user ID (PSID / IGSID or WhatsApp number), the content of messages, and basic profile information the platform makes available.

We use Meta Platform Data only to provide the messaging functionality the business has enabled. We do not sell it, we do not use it for advertising, and we do not use it to build profiles for unrelated purposes. When a business disconnects a channel, the stored access tokens are deleted immediately, and the associated conversation data is removed or anonymized in line with our retention policies and applicable legal obligations. You may request deletion of your data at any time — see our Data Deletion Instructions.

Compliance. Our use of data obtained through Meta complies with the Meta Platform Terms and the Meta Developer Policies.

Token security. OAuth access tokens for connected accounts are encrypted and stored securely. A business can revoke AmeritAI's access at any time from its Meta Business Settings or by disconnecting the channel in AmeritAI.

Minimal permissions. We request only the permissions required to provide the features a business enables; we do not request unnecessary permissions.

7. Service Providers and AI Subprocessors

We rely on trusted third parties to run the service. They process personal information only to perform services for us, under contractual confidentiality and security obligations. Our key providers include:

• Google Firebase / Google Cloud — database, authentication, and hosting infrastructure.
• Vercel — application hosting and delivery.
• Pinecone — vector storage for each business's knowledge base.
• AI model providers (Anthropic, OpenAI, Google) — generating assistant responses. Conversation content sent for inference is not used by these providers to train their models under our API agreements.
• ElevenLabs — voice synthesis for voice assistants.
• Twilio — SMS and telephony delivery.
• Meta Platforms — Messenger, Instagram, and WhatsApp message delivery.
• Stripe — payment processing (we do not store full card numbers).
• SendGrid / Resend — transactional email.
• Google Analytics — aggregated website-usage measurement.

A current list of subprocessors is maintained at ameritai.com/subprocessors.

Business customers may request a Data Processing Addendum (DPA) by contacting privacy@ameritai.com.

8. How We Share Information

We do not sell your personal information. We share it only with the service providers listed above; with the business customer whose assistant you interacted with; when required by law or to protect rights and safety; and in connection with a merger, acquisition, or asset transfer, subject to this policy.

9. Data Retention

We keep personal information only as long as needed to provide the service and for legitimate legal, accounting, or security purposes. Business customers can configure conversation retention, and end-users can request deletion as described below.

10. Security

We use industry-standard safeguards, including encryption in transit (TLS) and at rest, access controls, and least-privilege permissions. No method of transmission or storage is completely secure, but we work to protect your information and to notify affected parties where required by law. Learn more on our Security page.

11. International Data Transfers

We are based in the United States, and our providers may process data in the US and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

12. Your Privacy Rights

EEA / UK (GDPR): you have the rights to access, rectify, erase, restrict, and port your data, and to object to processing. You may also lodge a complaint with your local supervisory authority.

California (CCPA / CPRA): you have the rights to know, access, delete, and correct your personal information and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under the CPRA, and we will not discriminate against you for exercising your rights.

Other US states: residents of states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah) have similar rights to access, correct, delete, and opt out.

To exercise any of these rights, email privacy@ameritai.com. We will verify and respond within the timeframes required by applicable law. If your data was collected by a business using AmeritAI, we will help route your request to that business.

13. Cookies and Analytics

Our website uses essential cookies and, through analytics tooling such as Google Analytics, cookies that measure aggregate usage. You can control cookies through your browser settings.

14. Children's Privacy

AmeritAI is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us data, contact us and we will delete it.

15. Messaging Consent

If you provide a phone number and opt in, you may receive SMS or WhatsApp messages related to your request from the business you contacted. Message and data rates may apply, consent is not a condition of purchase, and you can opt out at any time by replying STOP.

16. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with a new "Last updated" date.

17. Contact Us

Questions or requests: privacy@ameritai.com — Norshin LLC, 2807 Hampton Woods Dr, Henrico, VA 23233, USA. To delete your data, see our Data Deletion Instructions.