> For the complete documentation index, see [llms.txt](https://docs.sentifyd.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sentifyd.io/security-privacy-and-ai-compliance.md).

# Security, Privacy & AI Compliance

Sentifyd is built so that you can deploy an AI avatar on your site responsibly — with transparency toward your users and privacy by default. This page summarizes what Sentifyd handles for you and what you're responsible for as the deployer.

{% hint style="info" %}
This page is practical guidance, not legal advice. For your specific obligations, consult qualified counsel.
{% endhint %}

### AI Transparency (EU AI Act)

Under the EU AI Act (Article 50), users must be informed that they are interacting with an AI system. Sentifyd handles this for you by default:

* **Built-in AI disclosure and consent.** Before a conversation starts, the widget shows a “Consent for AI conversation” dialog that discloses the AI nature of the avatar and collects the user's consent.
* **The avatar never pretends to be human.** If asked, it will confirm it is an AI assistant.
* **AI-generated audio/video marking.** The avatar's generated speech and animation are machine-readably marked as AI-generated, as required for synthetic media.

**Your responsibility as deployer:**

* If you set `terms-accepted="true"` on the embed, the built-in consent dialog is **skipped** — you are attesting that you have already disclosed the AI nature and obtained consent in your own flow (e.g., your app's onboarding or consent manager). Only do this if that is actually true.
* Do not use the avatar for **high-risk** purposes under the AI Act (e.g., recruitment decisions, credit scoring, essential-services eligibility, or educational assessment). Sentifyd's terms prohibit such deployments.
* If your avatar is modeled on a **real person** (e.g., an Avaturn avatar of your founder), make sure your deployment makes clear that users are interacting with an AI likeness.

### Privacy & Data Handling

* **No long-term conversation storage.** Conversation transcripts are kept only briefly (a few hours) to support context and resuming, then discarded. Sentifyd does not train models on your users' conversations.
* **User data collection is consent-based.** When the avatar collects personal details (e.g., for a support request), it does so with the user's consent within the conversation.
* **Transcript download.** End users can download their own conversation transcript during the conversation.
* **Terms and privacy links.** The widget links to Sentifyd's terms and privacy policy by default; replace them with your own using the `terms-href` and `privacy-href` settings so your users see your policies.

### Content Safety

All conversations run within AI-guarded environments provided by leading AI platforms. Harmful, unsafe, or non-compliant prompts and responses are detected and blocked automatically, keeping conversations within ethical and legal boundaries.

### Credential Security

* The **avatar API key** is safe to expose in your page: it only allows chatting with your avatar, and the **allowed domains** setting prevents it from being used on other websites. Still, treat the shareable link and key with care — conversations consume your credits. You can rotate the key at any time from the avatar page.
* For stricter setups, keep the key server-side and use the [Short-lived Avatar Tokens](/manual-web-integration/short-lived-avatar-tokens-advanced.md) pattern.
* Credentials you configure for [MCP tools](/features/adding-mcp-tools-to-your-avatar.md) are used only server-side and never exposed to end users.

### Quick Deployer Checklist

* [ ] Set your own `terms-href` and `privacy-href` links
* [ ] Leave the built-in AI consent dialog enabled, **or** provide equivalent disclosure + consent before setting `terms-accepted`
* [ ] Configure allowed domains for every site where the avatar is deployed
* [ ] Don't deploy for high-risk (AI Act Annex III) purposes
* [ ] Rotate the avatar API key if a shareable link or embed leaks