Privacy Policy

Chatsloop is an AI-powered chatbot platform that allows businesses (“Customers”) to create, customise, and embed AI assistants on their websites. We process data belonging to two categories of person:

• Customers — individuals or organisations who sign up, create chatbots, and manage the platform through our dashboard.
• End-users / Visitors — people who interact with a chatbot widget embedded on a Customer's website.

This policy covers both groups. Where obligations or rights differ, we say so explicitly.

2.1 — Account & profile data (Customers)

• Email address and password (hashed — we never store plaintext passwords)
• First name, last name, company name, website URL, phone number (optional)
• Billing information — card details are stored exclusively by our payment processor; we never see or store raw card numbers
• Subscription plan and usage metrics

2.2 — Website content you provide

• URLs you submit for crawling — we fetch, parse, and index the textual content of those pages
• Documents you upload (PDF, DOCX) — we extract text and store embeddings derived from it
• Custom instructions and system prompts you write for your chatbot

2.3 — Visitor chat data (End-users)

• Messages sent to a chatbot widget (conversation content)
• An anonymous visitor ID generated in the browser — no login required, no cross-site tracking
• Name and email if a visitor voluntarily submits a lead-capture form within the widget
• Approximate session timestamps

2.4 — E-commerce platform integrations

If you install Chatsloop through a supported e-commerce app store (such as Shopify), we additionally collect your store domain and an encrypted access token needed to manage the chat widget on your storefront. We do not collect or store your orders, product data, or any other store content.

2.5 — Automatically collected technical data

• IP address and user-agent (abuse prevention; not linked to individual profiles)
• API request logs (retained up to 30 days for debugging and security monitoring)
• Performance and error telemetry (no personally identifiable information)

3.1 — What is sent to our AI provider

• The visitor's question (natural-language text)
• Relevant excerpts from your website content or documents, retrieved via semantic search
• Your chatbot's system prompt and custom instructions
• Recent conversation history for context continuity

3.2 — What is NOT sent to our AI provider

• Visitor IP addresses or device identifiers
• Customer billing or payment information
• Passwords or authentication tokens
• Your entire website — only the most relevant excerpts are retrieved per query

3.3 — AI provider data use

Our AI provider processes this data under a standard API agreement and does not use it to train their models by default.

3.4 — Embeddings & vector storage

We convert your website content into vector representations used to match visitor questions to relevant content. These are stored in our database alongside the source text used to construct AI prompts.

3.5 — No automated decision-making with legal effect

Chatsloop's AI is used exclusively to answer questions about a Customer's website content. We do not use AI to make automated decisions with legal effects (e.g. credit decisions, employment screening).

We use a small number of trusted service providers to operate Chatsloop, each bound by a data processing agreement and used only to the extent necessary for their function. We do not sell your personal data to any third party.

All providers are GDPR-compliant. A full list of our subprocessors, including names, is available on request — email privacy@chatsloop.com.

We use the minimum number of cookies necessary to operate the service.

We do not use advertising, tracking, or analytics cookies. You can clear cookies at any time via your browser settings — deleting the auth cookie will sign you out of the dashboard.

We do not sell, rent, or trade your personal data. We may disclose data only in these limited circumstances:

• Service providers — as listed in Section 5, strictly for service operation.
• Legal requirements — if required by law, court order, or to protect rights, property, or safety.
• Business transfers — in the event of a merger or acquisition, we will notify you before data becomes subject to a different privacy policy.
• With your consent — any other sharing only occurs with your explicit permission.

We implement industry-standard technical and organisational measures to protect your data:

• All data in transit encrypted via TLS 1.2+
• Data at rest encrypted (AES-256)
• Row-level security in our database — each Customer can only access their own data
• Passwords are cryptographically hashed, never stored in plaintext
• All API routes protected with authentication checks
• Payment data handled exclusively by our PCI DSS Level 1 compliant payment processor
• Access to production systems restricted to authorised personnel only

Despite these measures, no system is completely secure. To report a vulnerability, email security@chatsloop.com.

You can request deletion of your account and all associated data at any time by emailing privacy@chatsloop.com. We will process your request within 30 days.

10.1 — GDPR rights (EEA / UK residents)

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data (subject to legal retention obligations).
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is consent-based, you can withdraw at any time without affecting prior processing.

10.2 — CCPA rights (California residents)

California residents have rights to know, delete, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact privacy@chatsloop.com.

10.3 — How to exercise your rights

Email privacy@chatsloop.com with the subject line “Privacy Request”. We will respond within 30 days. We may ask you to verify your identity first.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA in the EU).

Chatsloop is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe your child has provided us with personal information, contact privacy@chatsloop.com and we will delete it promptly.

When we make material changes to this policy, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered Customers at least 14 days before changes take effect
• Where required by law, ask for your consent before changes apply

Your continued use of Chatsloop after changes take effect constitutes acceptance of the updated policy.

For questions, concerns, or privacy requests, contact us: