AI, Privacy and Installation Guide

Version 2026-10-27.1 · Updated 27 October 2026

DRAFT — owner and professional legal approval required before commercial reliance. Missing details and unverified safeguards are explicitly identified below.

Before enabling a widget

Confirm authority to import/upload every source; use only content you may process. Review answers for accuracy and prompt injection. Publish your own visitor privacy notice explaining WHALE, Supabase, OpenAI, storage, insights, transfers, retention and rights contact. Avoid sensitive and children’s data. Configure a real human contact and an HTTPS privacy notice.

Widget configuration

Add data-whale-privacy="https://your-business.example/privacy" and data-whale-support="https://your-business.example/contact" to the generated script tag, replacing examples with verified customer URLs. Links accept HTTPS only. Reinstall generated snippets after widget changes; existing inline installations do not automatically update.

Processing choices

Public chats currently persist regardless of local dashboard storeConversations preference. Do not represent that toggle as an enforced opt-out. Inbox visibility is separate from collection. A server-enforced collection setting and launch approval remain required. Aggregated insights can still contain identifiable excerpts; apply privacy review.

Accessibility and contact

Keyboard controls and reduced motion are supported in source. WCAG 2.2 AA is a technical target, not a certification. Report barriers or privacy concerns to [OWNER REQUIRED: contact]. Do not use the assistant for emergencies; contact qualified human services directly.