Privacy policy

At Chatly, we are committed to protecting your privacy and personal data. This Privacy policy explains how we collect, use, store, and protect your personal information when you use our service. This policy complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

The data controller responsible for processing your personal data is:

2. Data We Collect

We collect the following types of personal data when you use our service:

2.1. Account Data

• Email address (required for account creation)
• Name (optional)
• Password (encrypted and hashed)
• Organization information (company name, contact person)

2.2. Content Data

• Content you upload for chatbot training (PDFs, text, website content)
• Chatbot configurations and settings
• Chat conversations and messages

2.3. Usage Data

• Number of messages sent
• Content items uploaded
• Subscription plan and billing information

2.4. Technical Data

• IP address
• Browser type and version
• Device information and operating system

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide and maintain our service
• To process your subscription and payments
• To train and improve your chatbots using AI services
• To communicate with you about your account and our service
• To send you important updates and notifications
• To comply with legal obligations and protect our rights

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

• Contract: Processing is necessary for the performance of a contract with you (providing our service)
• Consent: You have given consent for specific processing activities
• Legal Obligation: Processing is necessary to comply with legal obligations (e.g., tax, accounting requirements)
• Legitimate Interest: Processing is necessary for our legitimate interests (e.g., service improvement, security)

5. Data Sharing and Third Parties

We share your data with the following third-party service providers to operate our service:

5.1. Third-Party Services

• Google Cloud Platform: Used for AI/ML services (Vertex AI) to generate embeddings and process chatbot queries, data storage, and file storage. All data is stored exclusively on Google's European data centers (europe-west1 region). Data is processed in accordance with Google Cloud's data processing terms.
• Mailgun: Mailgun: Used to send transactional emails (contact form submissions, notifications). Email addresses and message content are processed by Mailgun.
• Stripe: Stripe: Used to process subscription payments. Payment information is handled by Stripe and is not stored on our servers.
• HubSpot / Customer CRM: If you enable lead mode with CRM delivery, chat contact data (name, email, question, and limited conversation context) is sent to selected receivers.

6. Data Retention

We retain your personal data for the following periods:

• Account data: Retained while your account is active and for 30 days after account deletion
• Content data: Retained while your account is active. Deleted within 30 days of account deletion
• Usage data: Retained for up to 2 years for analytics and service improvement
• Legal/accounting records: Retained for 5 years as required by Norwegian law
• Conversations: Conversations with contact requests are stored permanently and can only be deleted manually from the dashboard. Conversations without contact requests are deleted when the user chooses to do so through the chatbot, or after 2 months at the latest through an automatic cleanup process that runs every 2 months.
• Lead data sent to third-party CRM/webhook destinations is retained according to each receiver configuration and retention policy.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Secure password storage using bcrypt hashing
• Regular security audits and updates
• Access controls and authentication mechanisms

9. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Required for the service to function (authentication, session management)
• Functional Cookies: Enhance functionality and personalization (language preferences)
• Analytics Cookies: Help us understand how users interact with our service (currently not implemented)

10. International Data Transfers

All your data is stored exclusively on Google's European data centers (europe-west1 region) and processed within the European Economic Area (EEA).

11. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Privacy policy

We may update this Privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the 'Last Updated' date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, concerns, or wish to exercise your rights regarding this Privacy policy, please contact us: