1. Introduction

ChattyBox ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Profile picture (if provided via OAuth)
• Authentication credentials (managed by Clerk)

2.2 Billing Information

When you subscribe to a paid plan, we collect:

• Payment card details (processed securely by Stripe)
• Billing address
• Transaction history

Note: We do not store your full credit card number. Payment processing is handled by Stripe.

2.3 Content You Provide

When using our service, we collect:

• Website URLs you choose to scrape
• Scraped content from your websites
• Chat conversations from your chatbot widgets
• Widget customization settings

2.4 Automatically Collected Information

We automatically collect:

• IP addresses and device information
• Browser type and version
• Usage patterns and feature interactions
• Error logs for debugging

3. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Process transactions and send billing communications
• Generate AI responses based on your scraped content
• Improve and personalize your experience
• Communicate about updates, security alerts, and support
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Third-Party Services

We use service providers to operate ChattyBox. The information a provider receives depends on the feature you use, the configuration of your account, and (for optional site analytics) your privacy choice.

These providers process data under their own terms and privacy notices. We do not control their independent retention settings or processing practices.

5. Data Retention

We retain information for as long as reasonably necessary to provide and secure the service, resolve issues, meet legal or accounting requirements, and enforce our agreements. Retention can vary by data type, account settings, provider configuration, and applicable law.

• Account, project, and indexed content: retained while needed to operate the account or project. Deleting a project or account removes the associated active application records through the available deletion flow.
• Chat conversations: retained with the project until deletion or another applicable retention process. Do not submit sensitive information that you would not want stored with the project.
• Billing and transaction records: retained as required by Stripe and applicable legal, tax, or accounting obligations.
• Security, error, and operational records: retained for the period configured for the relevant service or as needed to investigate and prevent abuse. Backups and provider systems may retain data on their own schedules.

6. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Object: Object to certain processing of your data
• Restrict: Request limited processing of your data

To exercise these rights, contact us at privacy [at] chattybox.ai

7. Data Security

We implement security measures including:

• Encryption of data in transit (TLS) and at rest
• Secure authentication via Clerk
• Regular security audits and updates
• Access controls and monitoring

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. Cookies

We use cookies and similar browser storage for essential site operation and to remember privacy choices. Optional analytics and tag-management tools are not loaded on this site unless you choose to allow analytics.

• Essential storage: authentication and session controls supplied by Clerk, a locale preference, and the `chattybox_analytics_consent` preference used to remember your choice.
• Optional analytics storage: PostHog is initialized only after consent. Google Tag Manager is also loaded only after consent; the cookies or similar storage it uses depend on the tags configured in the container.

You can change this choice at any time with the Privacy choices control. Browser settings can also restrict cookies and storage, although disabling essential storage can affect sign-in, locale selection, or other service functionality.

9. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect data from children. If we learn we have collected data from a child, we will delete it promptly.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses where applicable.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact Us

For privacy-related inquiries:

• Email: privacy [at] chattybox.ai
• Data Protection Officer: dpo [at] chattybox.ai