Privacy Policy

This Privacy Policy describes how ChatterMate ("we," "us," or "our") processes and protects information in our AI-powered customer service platform.

1. Information We Collect

1.1 Customer Organization Data

• Business contact information
• User accounts and role assignments
• Integration configurations and API credentials
• Custom AI training data and knowledge base
• Theme customization settings

1.2 End-User Data

• Chat transcripts and conversation history
• Support tickets and resolution data
• User context and preferences
• Service interaction analytics

1.3 Technical Data

• Usage statistics and performance metrics
• Integration activity logs
• System access records
• Error and debugging information

2. How We Use Your Data

This is how we will use your Data : Providing and improving the chatbot service, Generating AI responses, Generating analytics and performance reports, Managing user roles and permissions, Facilitating third-party integrations and Ensuring platform security and compliance

Your content is sent to a large language model at the time of each request to produce a reply (inference). We do not use your conversations, knowledge base, or other Customer Data to train or fine-tune any AI model, and your data is never used to train a model shared with other customers.

3. AI & Large Language Model Processing

ChatterMate answers questions using a large language model (LLM). Depending on your plan and settings, one of two configurations applies:

• Hosted model (cloud default): ChatterMate sends your request to a third-party large language model provider, operated on your behalf through the provider’s business API — not a consumer product — and your data is not used to train the provider’s models.
• Your own model (bring your own key): You may connect your own account with OpenAI, Anthropic, Google, Mistral, xAI, DeepSeek, or Groq. In that case your content is sent directly to the provider you chose, under your agreement with that provider, and ChatterMate does not retain the provider’s copy.

In both cases, only the content needed to answer a request (the message and relevant knowledge-base context) is sent, one request at a time. Each organization’s data is logically isolated and is never shared with, or used to answer, another customer.

4. Sub-processors

We rely on a small number of third parties to run ChatterMate. Each processes Customer Data only as needed to provide its part of the service:

Role	Purpose	Data processed
Large language model provider	Hosted AI model (cloud default)	Message text and knowledge-base context sent at request time
Cloud hosting provider	Application and database hosting	Stored Customer Data
Email delivery provider	Transactional and notification email	Recipient email address, message content
Payment processor	Subscription billing	Billing contact and payment metadata (card details are handled by the processor and never stored by us)

A current list of our sub-processors, including the specific providers, is available on request at support@chattermate.chat.

If you connect your own LLM provider (OpenAI, Anthropic, Google, Mistral, xAI, DeepSeek, or Groq), that provider processes your content under your own agreement with them and is not a ChatterMate sub-processor.

Self-hosted deployments do not use ChatterMate’s hosting or hosted-model sub-processors; you control your own infrastructure and model provider.

5. Data Protection Rights

• End-to-end encryption for sensitive data
• Role-based access control implementation
• Regular security audits and updates
• Secure API and integration handling
• Data backup and disaster recovery

6. Third-Party Integrations

Our platform integrates with various third-party services (Jira, Zendesk, Slack, etc.). Data sharing with these services is: Limited to necessary operational data, Controlled by customer configuration, Subject to respective privacy policies, Secured through encrypted channels.

CRM integrations (HubSpot and Pipedrive). If you connect a CRM, ChatterMate authenticates using OAuth 2.0 and pushes captured lead data one-way into your CRM at your direction — it does not read back or modify your other CRM records. The data sent is the lead’s email, name, phone, company, the AI qualification summary, any custom fields you configured, and the source page. In HubSpot this creates or updates a Contact and adds a note; in Pipedrive it creates or updates a Person, links an Organization, opens a Lead, and adds a note. We request only the minimum scopes needed (HubSpot: contacts read and write; Pipedrive: contacts, leads and search). OAuth access and refresh tokens are stored encrypted at rest, used solely to perform these syncs, and deleted when you disconnect. Your use of the connected CRM is governed by that provider’s privacy policy (HubSpot, Pipedrive).

For third-party account connections, users must comply with the Shopify Terms of Service:
https://www.shopify.com/legal/privacy

7. Data Retention

Retention periods vary by subscription:

• Self-hosted: Customer-controlled retention
• Professional: 12-month conversation history
• Enterprise: Custom retention policies

On request (via Delete my data) or when an organization closes its account, we delete its Customer Data from production systems, and it is removed from backups in the ordinary course of our backup rotation.

8. Customer Rights

• Access and export organization data
• Modify AI training materials
• Configure data retention policies
• Request data deletion
• Manage integration permissions

Deleting your data

To have your data deleted, including data from Messenger, Instagram or WhatsApp conversations, see Delete my data. It explains what to send us, what we remove, and what we may keep.

9. Shopify-Specific Data Handling

As a Shopify app provider, we process the following Shopify-specific data: Product information (names, descriptions, prices, variants, inventory), Order details (order numbers, status, fulfillment information), Customer information as permitted by granted scopes, Store configuration data necessary for integration.

We process this data only as necessary to provide our services and in accordance with Shopify's API Terms and Partner Program Agreement. We do not use this data for any purposes not explicitly disclosed in this policy.

10. Meta Platforms (Messenger, Instagram, WhatsApp)

When a customer connects their Facebook Page, Instagram account or WhatsApp business account, we receive and process, on their behalf: message content sent to and from their account; the sender's name, profile picture and platform user ID; and conversation timestamps and delivery status.

We use this data solely to deliver the customer support service to the business that connected the account — showing conversations in their inbox, generating assistant replies, enabling human handover, and keeping conversation history for context.

We do not sell this data, share it with other customers, use it for advertising, or use it to build or train AI models. It is retained per the retention terms above, and is deleted on request via Delete my data or when the account is disconnected.

11. International Data Transfers

ChatterMate may store Customer Data on secure cloud infrastructure operated by our hosting sub-processor. When the hosted AI model is used, message content is processed by our model provider for the duration of the request and is not retained by ChatterMate. Self-hosted customers control where their own data is stored and processed. By using our services, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules.

• We use appropriate safeguards for international data transfers
• EU-US data transfers comply with standard contractual clauses
• We implement technical measures to ensure data protection during transfers
• Our data storage providers maintain industry-standard certifications

12. Policy Updates

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on our website
• Sending an email to the primary contact on your account
• Providing in-app notifications about material changes
• Updating the "Last updated" date at the top of this policy

We encourage you to review our Privacy Policy whenever you access our services. Your continued use after policy changes constitutes your acceptance of the revised terms.

13. Children's Privacy

Our services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe we have collected information from a child under 13, please contact us at privacy@chattermate.chat.

14. Cookies and Tracking

Our services may use cookies and similar tracking technologies to collect information about your interactions:

• Essential cookies for authentication and security
• Functional cookies that remember your preferences
• Analytics cookies to help us improve our services
• Session tracking for conversation continuity

You can control cookies through your browser settings, but disabling certain cookies may limit your ability to use all features of our services.

15. Regulatory Compliance

ChatterMate is committed to complying with applicable data protection regulations including:

• General Data Protection Regulation (GDPR) for EU users
• California Consumer Privacy Act (CCPA) for California residents
• Personal Information Protection and Electronic Documents Act (PIPEDA) for Canadian users
• Other applicable regional and national privacy laws

We provide mechanisms for users to exercise their rights under these regulations as outlined in the Customer Rights section. For specific requests related to regulatory compliance, please contact our privacy team.

16. Contact Us

For privacy-related inquiries:

Email: privacy@chattermate.chat