Privacy Policy

1. Roles — who is responsible for what

For chat messages, visitor identifiers, lead fields, and similar data submitted through a customer’s project, ChatyTalk acts as a data processor (or equivalent service provider) processing data on the customer’s instructions to deliver the service.

For account registration, authentication, platform billing, and operation of chatytalk.com itself, ChatyTalk acts as a data controller.

If you are an End User chatting on a customer’s website or WhatsApp number, that customer — not ChatyTalk — is usually the data controller. Contact them first for access, deletion, or objection requests relating to your conversation.

Customers are solely responsible for their own privacy notices, lawful bases, consents, and regulatory compliance regarding End Users and the content they upload.

2. Data we collect

• Account data: company name, email address, password (stored hashed), organization and project settings.
• Usage data: message counts, token usage, plan limits, dashboard activity, and technical logs.
• Chat data: user messages, assistant replies, conversation history fragments, source channel (widget, API, WhatsApp), visitor_id, and optional embed_origin.
• Lead data: name, email, phone, company, and notes extracted from conversations when configured.
• Payment data: billing handled by Stripe; we do not store full card numbers.
• Technical data: IP address, browser type, cookies (e.g. session and locale preference), and error diagnostics.

3. How we use data

• Provide, secure, and improve the ChatyTalk service.
• Generate AI responses based on your knowledge base and conversation context.
• Display chat logs, leads, and analytics in your dashboard.
• Enforce plan limits, prevent abuse, and comply with legal obligations.
• Process subscriptions and send service-related communications.

4. Legal bases (EEA / UK)

Where GDPR applies, we rely on contract performance (providing the service), legitimate interests (security, analytics, product improvement), and consent where required (e.g. optional marketing cookies). Customers are responsible for establishing a lawful basis for End User data they route through ChatyTalk.

5. Third-party processors

We share only the data necessary for each provider to perform its function. Provider terms and privacy policies also apply.

• Anthropic (or your own configured LLM provider) — message and document processing for AI responses.
• Meta / WhatsApp Cloud API — when you enable WhatsApp messaging.
• Stripe — subscription and payment processing.
• Cloud hosting, database, and email infrastructure used to operate chatytalk.com.

6. Data retention

Chat logs and lead records are retained for the life of your project unless you delete them or close your account, subject to backup and legal retention requirements.

Account and billing records may be kept longer where required for tax, accounting, or dispute resolution.

7. Security — reasonable efforts only

We implement reasonable technical and organizational measures such as HTTPS, access controls, and encryption for sensitive credentials. No system is completely secure, and we do not guarantee that unauthorized access, loss, or alteration will never occur.

Customers are responsible for securing their API keys, dashboard access, and integration settings.

8. International transfers

Data may be processed in countries other than your own, including where our hosting or AI providers operate. Where required, we implement appropriate safeguards such as standard contractual clauses.

9. Your rights and how to exercise them

Depending on your location, account holders may have rights to access, rectify, erase, restrict, or port personal data relating to their ChatyTalk account, and to object to certain processing.

We will respond to account-holder requests within a reasonable time where required by law. We may ask you to verify your identity.

End Users must direct requests about chat content, leads, or website/WhatsApp interactions to the business that deployed ChatyTalk. We may redirect such requests to that customer or decline to act except on the customer’s documented instructions.

You may lodge a complaint with a supervisory authority where applicable law allows.

10. Cookies

We use essential cookies for authentication and locale preference. Analytics or marketing cookies, if introduced, will be described in a cookie notice and, where required, requested through consent.

11. Children

ChatyTalk is not directed at children under 16. We do not knowingly collect personal data from children.

12. No compliance warranty

Customers choose how to configure projects, what data to collect, and which channels (web, API, WhatsApp) to enable. ChatyTalk does not warrant that any particular customer use case complies with GDPR, KVKK, sector rules, or other laws. Customers must obtain their own legal advice.

13. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest version. Material changes will be posted on this page.