Privacy Policy

This Privacy Policy explains how Chatonn (“we,” “us,” or “our”) collects, uses, discloses, and safeguards your information when you visit our website, use our platform, or interact with our AI-powered customer support software (collectively, the “Services”).

Our Services are built to help businesses deliver instant, intelligent customer support. As part of that mission, we are committed to protecting your privacy and handling your data with transparency, security, and care. This policy describes the types of information we collect, why we collect it, and the choices you have regarding your data.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the Services.

We collect information that you provide directly to us, information that we collect automatically when you use the Services, and, in some cases, information we receive from third parties. The categories of data we collect are described below.

Information You Provide to Us

• Account information - your name, email address, password (stored as an encrypted hash), company name, and billing information when you create an account.
• Billing details - payment card or banking information, which is processed and stored by our PCI-DSS-compliant payment processors and is never stored on our servers.
• Customer content - knowledge base articles, FAQs, documents, and other training material you upload to configure your AI assistant.
• Support communications - messages you send to us when requesting help, reporting issues, or providing feedback.
• Forms and surveys - information you submit through signup forms, contact forms, demo requests, and optional user surveys.

Information Collected Automatically

• Usage data - pages visited, features used, session duration, and interaction patterns within the dashboard.
• Device & browser information - IP address, browser type and version, operating system, screen resolution, and language preferences.
• Log data - timestamps, requested URLs, error logs, and performance metrics used for diagnostics.
• Cookies & similar technologies - as described in Section 6, we use cookies, pixels, and local storage to remember preferences and understand how the Services are used.

Information We Receive From Third Parties

• Payment processors, to confirm transaction details and reconcile billing.
• Third-party authentication providers, if you choose to sign in using a social or OAuth provider.
• Analytics providers, to understand aggregate usage patterns.
• Referral and marketing partners, when you arrive at our Services through a promotional campaign.

We use the information we collect to operate, maintain, improve, and secure our Services, and to communicate with you. Specifically, we use your information to:

• Provide, operate, and maintain the Services, including your AI assistant and analytics dashboard.
• Configure, personalize, and improve your AI assistant based on the content you upload.
• Process transactions, manage subscriptions, and send invoices and payment receipts.
• Send service notifications, product updates, security alerts, and (with your consent) marketing communications you can opt out of at any time.
• Provide customer and technical support, and respond to your inquiries.
• Detect, prevent, and investigate fraud, abuse, security incidents, and prohibited activity.
• Comply with applicable legal obligations, enforce our agreements, and protect our legal rights.
• Aggregate and anonymize data for benchmarking, product improvement, and reporting.

For individuals located in the European Economic Area (EEA) or the United Kingdom, we process personal data under one or more of the following legal bases set out in the GDPR:

• Performance of a contract - where processing is necessary to provide the Services you have requested or to carry out our obligations under our terms of service.
• Legitimate interests - where we have a legitimate interest in operating and improving the Services, ensuring security, and preventing fraud, balanced against your rights and interests.
• Consent - where you have given us explicit permission to process your data (for example, for marketing or optional analytics).
• Legal obligation - where processing is required to comply with applicable laws and regulations.

Where we rely on consent as a legal basis, you may withdraw your consent at any time by contacting us or adjusting your account and communication preferences. Withdrawing consent will not affect the lawfulness of processing that occurred before the withdrawal.

We do not sell, rent, or trade your personal information. We share information only in the limited circumstances described below, and always under obligations of confidentiality and data protection:

• Service providers - with trusted vendors that help us operate the Services, such as cloud hosting providers, payment processors, analytics platforms, and LLM API providers. These providers process data on our behalf and may only use it to perform services for us.
• Legal compliance - when we believe in good faith that disclosure is required by law, regulation, legal process, or a valid government request, or to protect our rights, property, and safety.
• Corporate transactions - in connection with a merger, acquisition, reorganization, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
• With your consent - in any other circumstance where you have given us explicit permission to share your data.

We and our partners use cookies, pixels, and similar technologies to remember your preferences, keep you signed in, understand how the Services are used, and (where you have consented) deliver more relevant content. The categories of cookies we use include:

• Essential cookies - required for the Services to function, including authentication and security cookies.
• Functional cookies - remember your preferences, theme choice, and session state.
• Analytics cookies - help us understand how visitors use the Services so we can improve them. We use privacy-friendly analytics configurations and avoid collecting precise location data.
• Marketing cookies - used only where permitted to measure campaign effectiveness and avoid showing you irrelevant advertising.

Managing Cookies

You can control and delete cookies through your browser settings, and you can refuse non-essential cookies at any time. Disabling cookies may affect certain features, such as keeping you signed in or remembering your preferences.

Do Not Track

We honor “Do Not Track” signals where your browser sends them. Our Services also offer clear consent choices for optional tracking technologies.

Because chatonn is an AI-powered platform, conversations between your customers and your AI assistant may be processed by third-party large language model (LLM) providers - including OpenAI, Google Gemini, Anthropic Claude, Groq, and Ollama - in order to generate responses. We take the following measures to protect your data:

• We only transmit the minimum data necessary to generate a response to the chosen LLM provider.
• All data transmitted to LLM providers is encrypted in transit using industry-standard TLS.
• You can configure your assistant so that certain content (such as knowledge base documents) is never sent to third-party LLMs and is handled by self-hosted models (e.g., Ollama) instead.
• Enterprise customers can request a data processing addendum (DPA) that imposes additional restrictions on how providers may use data.

Data Used for Model Training

By default, we do not use your knowledge base content or customer conversations to train shared or public models. Some third-party LLM providers may retain data for short periods for abuse monitoring or service improvement; you can disable retention or choose a provider whose policies meet your requirements. We will always honor your configuration choices.

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention practices include:

• Account data - retained for as long as your account is active and for a reasonable period after deletion to allow for reactivation, after which it is permanently deleted.
• Billing records - retained for the period required by tax and financial regulations (typically up to 7 years).
• Usage and log data - retained for up to 24 months before being aggregated or anonymized.
• Customer content - retained until you delete it through the dashboard or request its removal, whichever comes first.

You can request the deletion of your account and associated data at any time by contacting us or using the self-serve deletion tools in your account settings. Deletion requests are processed in accordance with applicable law.

We implement technical, administrative, and organizational safeguards designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2+ and at rest using AES-256.
• Role-based access controls and least-privilege principles for our employees.
• Regular security audits, dependency scanning, and penetration testing.
• Continuous monitoring, intrusion detection, and incident response procedures.
• Secure infrastructure operated by reputable, SOC 2-aligned hosting providers.

Your information may be stored and processed in the country where you are located and in other countries where we, our affiliates, or our service providers operate facilities. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer personal data from the EEA, the UK, or Switzerland to countries outside those regions, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, and we take additional measures to ensure an adequate level of protection.

For more information about our transfer safeguards, or to obtain a copy of the relevant clauses, please contact us at privacy@chatonn.app.

Depending on where you live, you may have certain rights regarding your personal information. Where applicable, you have the right to:

• Access - request a copy of the personal data we hold about you.
• Rectification - correct inaccurate or incomplete personal data.
• Erasure - request deletion of your personal data in certain circumstances.
• Portability - receive a machine-readable copy of data you provided to us.
• Restriction & objection - restrict or object to certain processing activities.
• Withdraw consent - where processing is based on consent, withdraw it at any time.

How to Exercise Your Rights

To exercise any of these rights, email us at privacy@chatonn.app or submit a request through your account dashboard. To protect your privacy, we may need to verify your identity before processing your request. We aim to respond to all verifiable requests within 30 days.

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, opt out of the sale or sharing of personal information, and not be discriminated against for exercising your privacy rights. We do not sell personal information, and we do not use or disclose sensitive personal information for purposes other than those specified by the CCPA/CPRA.

Right to Lodge a Complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

Our Services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately so we can delete that information.

Our Services may contain links to third-party websites, plugins, or applications that are not operated by us. Once you leave our Services, this Privacy Policy no longer applies, and the privacy practices of those third parties will govern your information. We encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the “Last Updated” date at the top of this page and notify you by email or through an in-product notice before the changes take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy.