Privacy Policy

Last updated: October 28, 2026

Chat Fits ("we", "us") provides an AI chatbot and customer inbox that businesses add to their websites and connect to their email, Facebook Messenger, Instagram and WhatsApp accounts. This policy explains what personal data we handle, why, who we share it with, and the choices you have.

1. Who is responsible for your data

We act in two roles:

• For our customers' accounts (the businesses that sign up, their team members and their billing details), we decide how the data is used and are responsible for it.
• For the people who talk to our customers (website visitors who use a chatbot, and people who message a connected Messenger, Instagram or WhatsApp account or email inbox), we process data on behalf of that business, following its instructions. The business is responsible for that data and for telling those people how it is used. If you contacted a business through Chat Fits, please contact that business first about your data; we will help them respond.

2. Data we collect

From our customers

• Account details: name, email address, password (stored only as a secure hash), profile photo, company name, team members and their roles.
• Billing details: plan and payment history. Card payments are handled by our payment provider; we never see or store full card numbers.
• Chatbot content: the website pages, documents, FAQs, products and settings a business imports or writes to train its chatbot.
• Connected accounts: when a business connects an email inbox (for example Gmail or Outlook) or a Facebook Page, Instagram professional account or WhatsApp Business number, the access tokens needed to read and send its messages. Tokens are encrypted and are never shown in the dashboard.
• Usage data: sign-ins, actions in the dashboard (an activity log for the account's security), device and browser type, and IP address.

From people who contact a business through Chat Fits

• Conversations: the messages exchanged with the chatbot or the business's team, and the time they were sent.
• Details you choose to share: for example your name, email address, phone number and what you are interested in, when you fill in a form or type them in the chat.
• Technical data: the page you were on, your browser, an approximate country from your IP address, and a random chat identifier kept in your browser so a chat can continue across pages.
• Ratings: if you rate a live chat, your rating and comment.

3. Messenger, Instagram and WhatsApp

When a business connects its Facebook Page, Instagram professional account or WhatsApp Business account to Chat Fits, we use Meta's official APIs, with the permissions the business grants during connection, to:

• receive messages people send to that account, together with their public profile name and, where Meta provides it, profile picture or phone number;
• show those messages in the business's Chat Fits inbox and send the replies the business (or, if it switches this on, its chatbot) writes;
• show whether replies were delivered and read, and mark incoming messages as read.

We use data received from Meta only to provide these messaging features to the business that connected the account. We do not sell it, use it for advertising, or use it to build profiles of people, and we do not share it with anyone except the service providers described in section 6 that are needed to run the service. Our use of this data follows the Meta Platform Terms and Developer Policies.

A business can disconnect an account at any time in Channels; we then delete its access tokens immediately. To have the messages themselves deleted, see our Data Deletion page.

4. How we use data

• To provide the service: run each business's chatbot and inbox, deliver messages, create leads, tickets and contacts, and send notifications to the business's team.
• To keep accounts secure: sign-in protection, activity logs, and detecting abuse or fraud.
• To bill customers and manage subscriptions.
• To support customers and improve the service, for example fixing errors and measuring which features are used.
• To meet legal obligations.

We do not sell personal data, and we do not use the conversations of our customers' contacts to advertise to them.

5. AI processing

To answer a question, the chatbot sends the question, recent messages in the conversation and the most relevant parts of the business's own content to an AI model provider, which generates the reply. The provider processes this data only to return the answer to us and does not use it to train its models. Website and document content is also turned into search vectors on our own servers so the chatbot can find relevant answers.

6. Who we share data with

We share data only with service providers that help us run Chat Fits (such as hosting, payments, email delivery and the AI model that writes chatbot replies), under contracts that require them to protect it and use it only for that purpose. Email and messaging providers receive data only when a business connects its own accounts.

We may also disclose data if required by law, to protect the rights, safety or property of our customers, the public or us, or as part of a merger or sale of our business (in which case this policy continues to apply).

7. How long we keep data

• Account data: for as long as the account is open, then deleted within 30 days of closing it, except what we must keep for tax or legal reasons (such as invoices).
• Conversations, contacts, leads and tickets: until the business deletes them or closes its account.
• Access tokens for connected accounts: until the business disconnects the account, or deletion of the account.
• Backups: up to 30 days after deletion.

8. Security

Data is encrypted in transit (HTTPS). Passwords are stored as secure hashes, and access tokens for connected accounts are encrypted at rest. Access inside each business account follows the roles the business assigns, and our staff access customer data only when needed to support or protect the service. No system is perfectly secure, but we work to protect your data and will notify affected customers of a breach as required by law.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To use these rights:

• Customers can update most details in their dashboard, or email us.
• People who contacted a business should contact that business; you can also email us and we will pass on your request.

See how to delete your data. You may also complain to your local data protection authority.

10. Cookies and local storage

The dashboard uses a secure session cookie to keep you signed in. The chatbot on business websites stores a chat identifier and recent messages in your browser's storage so a conversation continues as you browse; it does not use advertising or tracking cookies.

11. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

12. Children

Chat Fits is a business service and is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We will change the date at the top and, for important changes, tell customers by email or in the dashboard before they take effect.

14. Contact us

Questions or requests about privacy: [email protected].