Privacy Policy

For our customers' account data (people who sign up for ChatKit), we are the controller.

For visitor chats on our customers' websites, the website owner is the controller and we act as their processor. We process visitor messages only on their documented instructions, under our Data Processing Agreement (DPA). If you chatted with an agent on someone else's site, please contact that business first.

• Account data: name, email, workspace name, billing details (handled by Stripe — we never store full card numbers).
• Knowledge content: pages, files and Q&A you add to train your agent.
• Visitor chat data: messages, timestamps, approximate location derived from IP, browser information, and any contact details a visitor chooses to share (e.g. email for lead capture).
• Usage data: product analytics and error logs used to keep the service reliable.

• To provide the service: generate answers, deliver chats to your inbox, send notifications (contract).
• To bill you and prevent fraud (contract, legal obligation).
• To secure and improve the service (legitimate interests).
• To send product updates you can opt out of at any time (consent / legitimate interests).

Visitor questions and relevant snippets of your knowledge content are sent to our AI model provider to generate answers. We use API terms under which this data is not used to train the provider's models.

We do not use your content or your visitors' conversations to train models for other customers.

We use a small number of vetted subprocessors. Transfers outside the EEA rely on Standard Contractual Clauses.

We will notify customers of material changes to this list in advance.

Account data is kept while your account is active and deleted within 30 days after closure, except where we must retain invoices by law. Customers control retention of visitor conversations and can delete them at any time; deleted data is removed from backups within 30 days.

Data is hosted in the EU, encrypted in transit (TLS) and at rest. Access is limited to staff who need it, and secrets such as integration tokens are encrypted at the application level.

You can request access, correction, deletion, restriction, portability, or object to processing. Email [email protected]. You may also complain to your local data protection authority. Visitors to a customer's website should contact that business, and we will assist them.

Our website uses only essential cookies for sign-in and security. The chat widget stores a visitor identifier in the browser so a conversation can continue across pages; it does not track visitors across other websites.

Questions about privacy or our DPA? Email [email protected].