Privacy Policy

1. Who this policy covers, and our role

We act in two roles.

• As the controller, for the data of people who use our website or have an intoCHAT account: account holders, their team members, and people who contact us.
• As a processor, for the data that flows through the AI agents our customers ("businesses") build: their website visitors' conversations, the contact details visitors give, and order data from a connected store. The business decides what its agent does and is the controller of that data; we process it only on its behalf and on its instructions.

If you chatted with an agent on a business's website, that business is responsible for your data. Contact it first; we help it answer your request.

2. Data we process

Account and team data:

• Name, email address and company, and your password, stored only as a one-way hash.
• If you sign in with Google: your name, email address and profile picture from Google.
• Two-factor authentication: the authenticator secret, stored encrypted, and recovery codes, stored only as hashes.
• Team membership: who belongs to which account and with which role.
• Billing: handled by Stripe. We store your plan and Stripe's customer and subscription identifiers, never card numbers.

Content a business adds to its agents: website pages we read for it, files, text and Q&A, and Notion pages it connects.

Data from conversations with an agent, processed on the business's behalf:

• Messages and the agent's replies, and files a visitor attaches when the business allows it.
• The visitor's approximate country, derived from the IP address by our hosting provider; the IP address itself is not stored with the conversation. The page the chat started on, without its query string.
• Ratings, and, when the business turns them on, topic and sentiment labels, spam checks and summaries of ended conversations.
• Details the visitor chooses to give: contact details, form answers, meeting bookings, and return or exchange requests.
• When the business uses identity verification: the user ID, name, email and other details its own website passes for a signed-in visitor.
• Messages written by the business's team in a live chat.

Order data from a store the business connects (Shopify or WooCommerce):

• To answer a visitor's question about an order, the agent reads that order's number, date, status, items, shipment tracking and total. It does not store them.
• Each lookup is recorded in an access log with its time, the order number and the outcome, without the email or the order's contents. The log is kept for 90 days.
• The order's email address is read only to check that the visitor gave the same email (or is the signed-in customer). It is never shown to the AI or stored for a lookup.
• We do not request customers' names, phone numbers, addresses or payment details from Shopify, and we never show them to the AI.
• If the business turns on returns, a return or exchange request stores the order number, email, items and reason the visitor gave, so the business can handle it.

Technical data:

• IP addresses, used briefly to prevent abuse (rate limits) and kept in our hosting providers' logs for their retention period.
• On our website and dashboard (not in the chat widget), Vercel Analytics measures how pages are used without cookies. Google Analytics does so with cookies only if you accept analytics in the cookie banner, and Google Ads learns that a new account came from one of our ads only if you also accept advertising.

The free website demo and our Chrome extension:

• You enter a website address, or click the extension's icon to use the address of the tab you are on. The extension reads that address only when you click, and never your browsing history or the content of the pages you visit.
• We read a few public pages of that website with Firecrawl and use OpenAI to prepare the demo agent. What we read, and the demo itself, are kept for 24 hours and are not linked to an account.
• Your questions to the demo agent are sent to OpenAI to write the replies. We do not store the conversation; we only count how many questions a demo has used.
• The extension has no analytics. It keeps the address you clicked on in the browser's memory only until the browser closes.

Business contacts we write to (outreach):

• We sometimes email businesses that intoCHAT might help. For this we use business contact details that are publicly available, such as the address a company publishes on its own website or in business directories, and data providers that collect such details and check whether an address works.
• We keep the person's name, role, company, business email address and phone number, website, city and language, a few lines on why we think intoCHAT could help, and the emails we sent and whether they were answered. Replies are read and sorted with the help of an AI provider (OpenAI), so that a request to stop is acted on at once.
• We do this on the basis of our legitimate interest in telling businesses about our service (Art. 6(1)(f) GDPR and the Swiss Federal Act on Data Protection). Every email says who is writing and why, and has a link to never be emailed again; you can also object at any time by replying or by writing to privacy@intochat.ai.
• We delete these details when they are no longer needed, at the latest 24 months after our last email. If you ask us not to contact you, we keep only your email address on a do-not-contact list, so that we never email you again.

3. How we use data

We use personal data only to:

• Provide intoCHAT: run agents, answer visitors for the business, and show the business its conversations, leads and statistics.
• Verify that a visitor owns an order before the agent shares its status, and pass return requests to the business.
• Send the emails, webhooks and Slack messages the business turns on, and service messages to account holders.
• Keep intoCHAT secure: authentication, rate limits, spam protection and preventing misuse.
• Bill subscriptions, provide support, and improve intoCHAT using aggregate usage statistics.

We do not sell personal data or use it for automated decisions with legal or similarly significant effects, and we use it for advertising only as described under Measuring our ads below, with your consent. We do not train AI models on our customers' or their visitors' data: agents answer by looking up the business's own knowledge at the moment a question is asked.

Measuring our ads (Google Ads): only if you accept advertising in the cookie banner, we tell Google that a signup happened when a new free intoCHAT account is created, by email or with Google. Google Analytics passes this event to Google Ads with the page (without its query string), the previous page's site and Google's cookie IDs; like any request to Google, Google also receives your IP address and browser details. We never send your name, email address or account ID. Google Ads uses it to show which of our ads lead to signups and to optimize our campaigns. We don't use remarketing, customer lists, enhanced conversions or ad personalization. This measurement goes through Google Analytics, so it also needs your analytics consent. The legal basis is your consent, which you can withdraw at any time with Cookie settings; withdrawal applies at once. Google (Google Ireland Limited in the EEA and Switzerland) processes this data under its own privacy policy: policies.google.com/privacy.

4. How the AI is used

To write a reply, the visitor's message, recent conversation history and the relevant parts of the business's knowledge are sent to the AI provider whose model the business chose for its agent: Anthropic by default, or OpenAI or Google if the business selects one of their models. If that provider can't answer, OpenAI writes the reply instead. Whichever model the business chooses, OpenAI is also used to index knowledge, and, where the business turns them on, for topic and sentiment labels, spam checks, conversation summaries, reply drafts for its team, and web search. Under OpenAI's API terms, data sent through its API is not used to train its models by default, and OpenAI may keep it for up to 30 days to detect abuse. Under Anthropic's and Google's terms for their paid APIs, data sent to them is likewise not used to train their models.

5. Service providers

We use these providers to run intoCHAT. Each processes data only to provide its service to us:

• Vercel: hosting, file storage and website analytics.
• Supabase: database.
• Redis Cloud (Redis Ltd., EU): short-lived data for rate limits.
• OpenAI: AI replies and the other AI features above.
• Anthropic: AI replies, for agents whose business chose a Claude model.
• Firecrawl: reading the website pages a business adds.
• Resend: emails, including receiving and answering emails sent to an agent's email address.
• Stripe: payments.
• Google: sign-in with Google; with your consent, Google Analytics and Google Ads signup measurement on our website; and AI replies for agents whose business chose a Gemini model.

When a business connects them, we also exchange data with Shopify, WooCommerce, Notion, Google Drive, Intercom, Cal.com, Calendly, Slack, Zendesk, Freshdesk, HubSpot, Gorgias, Help Scout and the business's own Stripe account, and send webhooks to addresses the business chooses.

6. How long we keep data

• Account data: for as long as the account exists. Deleting your account deletes its agents, conversations, leads and other content.
• Conversations, leads, form answers, bookings and return requests: until the business deletes them, the agent or its account. Where the business allows it, visitors can delete their own chat.
• Attached files: deleted with their conversation; files uploaded but never sent are removed after 24 hours.
• Order data from a store: not stored. A lookup reads it, answers, and keeps nothing. Each lookup's access-log entry (time, order number, outcome) is deleted after 90 days.
• Shopify: uninstalling the intoCHAT app deletes the store's connection and its return requests. When Shopify forwards a customer's or a store's deletion request, we delete that customer's return requests, or all data for that store.
• Cookie choices: each choice made in the cookie banner (a random ID kept by the browser, the choice, the notice's version and language, and the time) is kept for 5 years as proof of consent, without a name, email or IP address.
• Backups and logs: kept by our database and hosting providers for their limited retention periods, then overwritten.

7. How we protect data

• Encryption in transit (HTTPS) everywhere, and encryption at rest for the database and its backups.
• Credentials for connected services (store keys and tokens, Notion, calendars, identity verification secrets, two-factor secrets) are additionally encrypted by intoCHAT with AES-256-GCM. Passwords and recovery codes are stored only as hashes.
• Two-factor sign-in for accounts, roles for team members, and rate limits on sign-in and on order lookups.
• Separate development and production environments and data.
• Access to production systems is limited to the people who need it, using two-factor authentication.
• Only the minimum data is requested from connected stores, and order data is not stored.

If a security incident affects personal data, we investigate and contain it, and inform affected businesses without undue delay, and within the time limits the law sets, so they can inform their customers. No system is completely secure, but we work to keep risks low.

8. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, or object to or restrict how we use it. Account holders can update their details and delete their account in Settings. For anything else, email privacy@intochat.ai. If you chatted with a business's agent, contact that business: it controls that data, and we help it respond. You may also complain to your data protection authority.

9. International transfers

Our database, which holds the data intoCHAT stores, is hosted in Switzerland. Some of our providers process data in the United States and other countries; where the law requires it, these transfers rely on the providers' standard contractual clauses or other approved safeguards.

10. Cookies and browser storage

The dashboard uses cookies to keep you signed in and remember which account you are working in. The chat widget stores an ID in the visitor's browser to continue the conversation, and, when the business turns them on, a list of earlier chats and whether the launcher is shown. Our website and dashboard set Google Analytics and Google Ads cookies only after you accept them in the cookie banner, where analytics and advertising are separate choices, and you can change your choice with Cookie settings. See our Cookie Policy for details.

11. Children

intoCHAT is not directed at children under 16, and we do not knowingly collect their personal data.

12. Businesses and data processing agreements

Businesses that need a data processing agreement for the data their agents process can request one at privacy@intochat.ai. Businesses are responsible for telling their visitors and customers how their agent uses their data, for example in their own privacy policy.

13. Changes

When we change this policy, we update the date at the top. If a change is significant, we also tell account holders by email before it takes effect.