ChatSys Privacy Policy — How Your AI Chatbot Data Is Handled

No. We never use your scraped content or conversations to train models for other customers, and we never sell that data.

Your knowledge base and conversation history are used only to run your agent — retrieving relevant passages and generating responses for your visitors. Inference runs through a third-party AI inference provider's hosted models under contract; your content is not contributed to any shared training corpus.

ChatSys is built to be GDPR- and CCPA-ready. You can access, export, correct, or delete your data at any time from the dashboard, or by contacting us — regardless of where you are located. We honor the following rights:

• ·Access — request a copy of the personal data we hold about you.
• ·Rectification — correct inaccurate or incomplete data.
• ·Erasure — delete your data (the GDPR “right to be forgotten”).
• ·Portability — export your data in a machine-readable format.
• ·Objection — object to processing in the limited cases where it applies.
• ·No profiling — we do not sell personal data or use it for automated profiling.

Customers with formal compliance obligations can request our Data Processing Agreement (DPA).

• ·Account data — your email and profile details when you sign up.
• ·Site content you connect — pages we scrape and files you upload to train your agent.
• ·Conversations — messages exchanged between your visitors and your agent.
• ·Usage data — message counts and basic, privacy-preserving product analytics.
• ·Billing data — handled by Stripe; we never see or store full card numbers.

We use this strictly to operate the service: training and running your agent, showing your dashboard and usage, processing subscriptions, and keeping the platform secure and reliable.

Data is stored on Supabase (PostgreSQL) with per-workspace row-level security, so one customer can never read another's data. Traffic is encrypted in transit with TLS 1.3, and data is encrypted at rest with AES-256. We enforce least-privilege access for staff and are pursuing SOC 2 certification.

For the full technical breakdown, see our Security overview. Larger teams can review controls and procurement details on the Enterprise page.

We keep your data while your account is active. Delete a chatbot and its knowledge and conversations go with it. Cancel your account and we remove your workspace data within a 30-day deletion window, subject to short backup-rotation cycles and any legal retention obligations. If we ever suffer a data breach affecting your data, we will notify affected customers within 72 hours of becoming aware.

We use first-party cookies for authentication and session security only — no third-party advertising or cross-site tracking cookies, and no ad-tech profiling.

We rely on three subprocessors, all operating under Standard Contractual Clauses. We provide 30 days' notice before adding a new subprocessor so you can object.

• ·Supabase — database, authentication, and file storage.
• ·Stripe — subscription billing and payment processing.
• ·AI inference provider — hosted model inference for chat responses.

Subprocessor roles, safeguards, and your rights are documented in full in our DPA and Terms of Service.

Questions or a privacy request? Email privacy@chatsys.ai. Ready to build a privacy-first chatbot? Create your free ChatSys account.