Privacy policy
1. Who we are
The Chatinit service (https://chatinit.com) is operated by [LEGAL_COMPANY_NAME], [LEGAL_ADDRESS], tax ID [LEGAL_TAX_ID] (“we”). Contact for anything about personal data: [LEGAL_EMAIL].
2. Our two roles
- Controller — for the data of our customers (the businesses that use Chatinit) and of visitors to our own website.
- Processor — for the data of the visitors who use the chat widget on our customers’ websites. For that data the website owner is the controller; we process it only on their behalf, under the data processing agreement in our Terms of service (section 13). Visitors should direct requests about that data to the website owner — we will help them answer.
3. What data we process
- Customer account: e-mail address, company name (optional), password (stored only as a secure hash), account and subscription status.
- Payments: handled by Stripe. We receive the subscription status and a customer identifier — never your card details.
- Customer content: the documents you upload, the passages and search index created from them, your widget settings and the assistant’s role description.
- Widget conversations: the messages visitors type, the assistant’s answers, a random conversation identifier and timestamps; questions the assistant could not answer (“unanswered questions”). We do not store visitors’ IP addresses — they are used only briefly, in memory, to protect the service against abuse (rate limits), and appear in technical server logs (see below).
- Technical server logs: IP address, time, requested address and browser type, kept to operate and secure the service. Logs are rotated and overwritten automatically.
Please do not put special categories of personal data (health, religion, etc.) into documents or ask visitors for them through the widget.
4. Why we process it (legal bases)
- to provide the service and handle your subscription — performance of a contract (Art. 6(1)(b) GDPR);
- security, abuse prevention and service improvement — our legitimate interests (Art. 6(1)(f) GDPR);
- accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).
5. Who else receives data (subprocessors)
- Hosting: [LEGAL_HOSTING_PROVIDER] — the server our application, database and document search run on.
- AI model provider: answers are written by a language model. When a hosted model is enabled, the visitor’s question, the relevant passages of the customer’s documents and the recent conversation are sent to OpenRouter, Inc. (USA), which forwards them to the provider running the selected model. We only allow providers that neither store these requests nor use them for training. Document search itself always runs on our own server. When the local model is selected, no conversation data leaves our server.
- Payments: Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates).
We do not sell personal data or use it for advertising.
6. Transfers outside the EEA
OpenRouter and some model providers are based in the United States. Such transfers rely on the safeguards those companies provide under GDPR Chapter V — the EU–US Data Privacy Framework where the recipient is certified, or standard contractual clauses.
7. How long we keep data
- Account data and customer content: while the account exists. When you delete your account it is archived for 30 days (you can restore it), then permanently deleted together with documents, search index and conversations.
- Widget conversations: 365 days after the last message, then deleted automatically. Unanswered questions: 365 days after they were last asked (customers can delete them earlier).
- Backups: up to 30 days.
- Billing records: as long as tax law requires.
8. Cookies and browser storage
Our website uses one strictly necessary cookie (cw.sid) that keeps you signed in, remembers your language and protects forms against forgery; it expires after 14 days. We use no analytics, advertising or tracking cookies, so no consent banner is needed. The chat widget on customers’ websites sets no cookies; it keeps the current conversation in the browser’s session storage, which is cleared when the tab is closed.
9. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interests. Write to [LEGAL_EMAIL]; we reply within one month. You may also complain to a data protection authority — in Poland the President of the Personal Data Protection Office (UODO), or the authority in your country.
10. Security
All traffic is encrypted (HTTPS); each customer’s documents and conversations are strictly separated; passwords are stored as hashes; access to production systems is limited to the people who operate the service.
11. Changes
We will publish any change to this policy on this page with a new date, and inform customers by e-mail or in the dashboard about material changes.