Privacy Policy — Chatoly Merchant

This Privacy Policy explains how Chatoly LLC ("Chatoly," "we," "us," or "our") collects, uses, and shares information in connection with the Chatoly Merchant mobile application for Android and iOS (the "App") and the Chatoly platform, admin dashboard, chat widget, and related services that the App connects to (together with the App, the "Service").

The App is a companion tool for merchants who use Chatoly to run AI-assisted customer conversations for their online store. If you are a shopper who contacted a store that uses Chatoly, please see Section 4 ("Data we process on behalf of merchants") and contact that store directly, as they control your data.

By downloading, accessing, or using the App or the Service, you agree to this Privacy Policy. If you do not agree, do not use the App or the Service.

1. The two roles we play

Because Chatoly is a business-to-business tool, we handle personal data in two different capacities:

• As a controller — for data about the merchant, their team members, and account/administrative use of the Service (for example, the name and email of the person who signs in to the App). We decide how and why this data is processed.
• As a processor (service provider) — for data about a merchant's own customers and website visitors (for example, chat messages, contact details, and browsing activity). The merchant is the controller of that data; we process it only on the merchant's behalf and under our agreement with them. If you are an end customer, the merchant — not Chatoly — is your primary point of contact for privacy requests.

2. Information you provide to us

• Account and sign-in information. The App uses Google Sign-In. When you sign in, we receive your name, email address, profile picture (avatar), and Google account identifier from Google, based on the permissions you grant. The App requests read-only profile and email scope only; it never posts to your Google account on your behalf.
• Content you create in the App. Replies you send to conversations, internal notes, tags, and status changes (for example, marking a conversation resolved).
• Support communications. Information you provide when you contact us for support.

3. Information collected automatically

• Push notification token. If you enable notifications, we process a push notification token and your device platform (Android/iOS) to deliver alerts about new conversations.
• Technical and log data. Standard technical information such as IP address (used transiently for security and rate-limiting), request timestamps, and error/diagnostic logs.

What the App does not collect. The App does not collect your device's location, advertising identifier, contacts, calendar, photos, camera, or microphone, and it contains no third-party advertising or analytics SDKs. We do not track you across other apps or websites, and we do not sell your personal information.

4. Data we process on behalf of merchants

To let a merchant manage their customer conversations, the Service processes information about that merchant's shoppers and site visitors, which the App displays to the merchant. This may include:

• Conversation content — messages exchanged between the shopper and the store (via the website chat widget, Instagram, Facebook Messenger, WhatsApp, or email), including any information the shopper chooses to share in chat.
• Contact and identity details — such as a visitor/customer identifier, name, email address, or phone number where provided or captured through a lead/coupon form.
• Approximate location — city, region, country, and time zone derived on our servers from network information (we do not read location from the visitor's device GPS).
• Activity data — pages viewed, cart/product context, visit counts, and similar engagement signals used to inform support and recovery features.

We process this data under the merchant's instructions to provide the Service and do not use it for our own independent purposes. Each merchant is responsible for having a lawful basis and appropriate notices/consents for the data they collect through Chatoly.

5. How we use information

We use information to: authenticate you and provide access to the App and your workspace; display, route, and let you respond to customer conversations; generate AI-assisted replies and suggestions (see Section 6); send push notifications and other operational messages; operate, secure, debug, and improve the Service, including preventing abuse and enforcing our Terms; provide customer support; and comply with legal obligations.

Legal bases (EEA/UK). Where GDPR/UK GDPR applies, we rely on: performance of a contract (providing the Service to you); our legitimate interests (securing and improving the Service); consent (for example, device push notifications, which you can withdraw in your device settings); and compliance with legal obligations.

6. AI processing

Chatoly uses a third-party AI provider to generate AI responses, reply suggestions, summaries, and related features. The provider does not use data submitted through its API to train its models. AI-generated output can be inaccurate or incomplete and should be reviewed before it is relied upon.

7. Push notifications

If you enable notifications, a notification may include the sender's name and a short preview of the message. You can turn notifications off at any time in your device settings; doing so does not otherwise affect your use of the App.

8. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We share information only as described here:

With service providers (sub-processors) who help us run the Service — such as AI processing, cloud hosting and storage, content delivery, messaging-channel, email, and push-notification providers — under contracts that limit their use of the data to providing the Service to us.

• With the merchant. If you are a team member, the merchant/workspace owner can access account and activity information associated with your use of the Service.
• For legal reasons. To comply with law, respond to lawful requests, or protect the rights, safety, and property of Chatoly, our users, or the public.
• In a business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

An up-to-date list of sub-processors is available on request at support@chatoly.com.

9. Data retention and deletion

We keep personal data only as long as needed for the purposes described in this Policy, unless a longer period is required by law. In particular:

• Account data is retained while your account is active.
• Conversation and customer data is retained for the merchant while their Chatoly account is active, and is deleted when the merchant's data is redacted (see below).
• Certain activity data is deleted on a rolling schedule.
• Uninstalling the App signs you out and clears locally stored data on that device. Uninstalling the store's Chatoly app deactivates the account; associated data is then deleted in line with our redaction process.

Your deletion request / Shopify redaction. We honor data-deletion and access requests, including standard data-deletion and data-request flows required by the platforms we integrate with. To request deletion of your personal data or your account, contact support@chatoly.com or use https://chatoly.com/delete-account. We will respond as required by applicable law.

10. Data security

We use industry-standard technical and organizational safeguards to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. International data transfers

We and our sub-processors may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for such transfers. Contact us for more information.

12. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent. You may also have the right to lodge a complaint with a supervisory authority.

• EEA/UK residents (GDPR/UK GDPR). You may exercise the rights above. Where we act as a processor for a merchant, we will refer your request to that merchant.
• California residents (CCPA/CPRA). We do not sell or share personal information as those terms are defined under California law. You have rights to know, delete, correct, and to non-discrimination for exercising your rights.

To exercise any right, contact support@chatoly.com. We may need to verify your identity before responding.

13. Children's privacy

The App and Service are intended for business use by adults and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

14. Third-party services

The App relies on and links to third-party services (for example, Google Sign-In and the messaging platforms a merchant connects). Their handling of your data is governed by their own privacy policies, and we encourage you to review them. We are not responsible for the practices of third parties.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

16. Contact us

If you have questions or requests regarding this Policy or your personal data, contact us at: