Privacy Policy — Chatoly Merchant

This Privacy Policy explains how Chatoly LLC ("Chatoly," "we," "us," or "our") collects, uses, and shares information in connection with the Chatoly Merchant mobile application for Android and iOS (the "App") and the Chatoly platform, admin dashboard, chat widget, and related services that the App connects to (together with the App, the "Service").

The App is a companion tool for merchants who use Chatoly to run AI-assisted customer conversations for their online store. If you are a shopper who contacted a store that uses Chatoly, please see Section 4 ("Data we process on behalf of merchants") and contact that store directly, as they control your data.

By downloading, accessing, or using the App or the Service, you agree to this Privacy Policy. If you do not agree, do not use the App or the Service.

1. The two roles we play

Because Chatoly is a business-to-business tool, we handle personal data in two different capacities:

• As a controller — for data about the merchant, their team members, and account/administrative use of the Service (for example, the name and email of the person who signs in to the App). We decide how and why this data is processed.
• As a processor (service provider) — for data about a merchant's own customers and website visitors (for example, chat messages, contact details, and browsing activity). The merchant is the controller of that data; we process it only on the merchant's behalf and under our agreement with them. If you are an end customer, the merchant — not Chatoly — is your primary point of contact for privacy requests.

2. Information you provide to us

• Account and sign-in information. The App uses Google Sign-In. When you sign in, we receive your name, email address, profile picture (avatar), and Google account identifier from Google, based on the permissions you grant. The App requests read-only profile and email scope only; it never posts to your Google account on your behalf.
• Content you create in the App. Replies you send to conversations, internal notes, tags, and status changes (for example, marking a conversation resolved).
• Support communications. Information you provide when you contact us for support.

3. Information collected automatically

• Push notification token. If you enable notifications, we process a push notification token and your device platform (Android/iOS) to deliver alerts about new conversations.
• Technical and log data. Standard technical information such as IP address (used transiently for security and rate-limiting), request timestamps, and error/diagnostic logs.

What the App does not collect. The App does not collect your device's location, advertising identifier, contacts, calendar, photos, camera, or microphone, and it contains no third-party advertising or analytics SDKs. We do not track you across other apps or websites, and we do not sell your personal information.

4. Data we process on behalf of merchants

To let a merchant manage their customer conversations, the Service processes information about that merchant's shoppers and site visitors, which the App displays to the merchant. This may include:

• Conversation content — messages exchanged between the shopper and the store (via the website chat widget, Instagram, Facebook Messenger, WhatsApp, or email), including any information the shopper chooses to share in chat.
• Contact and identity details — such as a visitor/customer identifier, name, email address, or phone number where provided or captured through a lead/coupon form.
• Approximate location — city, region, country, and time zone derived on our servers from network information (we do not read location from the visitor's device GPS).
• Activity data — pages viewed, cart/product context, visit counts, and similar engagement signals used to inform support and recovery features.
• Order information from the merchant's store — when a shopper asks about an order, or when an order is placed, we read order information from the merchant's connected store. This includes the order number and status, the items ordered, fulfilment and tracking information, the order total, the email address recorded on the order, and whether the shopper has consented to marketing.

We request access to the email address only. We do not request the shopper's name, phone number, or postal address from the store.

Before we reveal any order details in a chat, the shopper must supply both the order number and the email address on that order, and both must match. The email address is used to verify that the person asking is entitled to the information.

We process this data under the merchant's instructions to provide the Service and do not use it for our own independent purposes. Each merchant is responsible for having a lawful basis and appropriate notices/consents for the data they collect through Chatoly.

5. How we use information

We use information to: authenticate you and provide access to the App and your workspace; display, route, and let you respond to customer conversations; generate AI-assisted replies and suggestions (see Section 6); send push notifications and other operational messages; operate, secure, debug, and improve the Service, including preventing abuse and enforcing our Terms; provide customer support; and comply with legal obligations.

On a merchant's behalf, and where the merchant enables the feature, we also use information to:

• Send recovery and follow-up messages on the merchant's behalf. Where the merchant enables it and the shopper has consented to marketing, we send abandoned-cart reminders, back-in-stock notifications, and post-purchase review requests. We check the marketing consent recorded in the merchant's store before sending, and we honour unsubscribe and suppression requests. A shopper who has not consented is not messaged.
• Produce insights for the merchant. We use order data — revenue, currency, and which products sold — together with conversation topics to show merchants how their store and their support conversations are performing. These insights are aggregated and do not identify individual shoppers.

Legal bases (EEA/UK). Where GDPR/UK GDPR applies, we rely on: performance of a contract (providing the Service to you); our legitimate interests (securing and improving the Service); consent (for example, device push notifications, which you can withdraw in your device settings); and compliance with legal obligations.

6. AI processing

Chatoly uses a third-party AI provider to generate AI responses, reply suggestions, summaries, and related features. The provider does not use data submitted through its API to train its models. AI-generated output can be inaccurate or incomplete and should be reviewed before it is relied upon.

7. Push notifications

If you enable notifications, a notification may include the sender's name and a short preview of the message. You can turn notifications off at any time in your device settings; doing so does not otherwise affect your use of the App.

8. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We share information only as described here:

With service providers (sub-processors) who help us run the Service — such as AI processing, cloud hosting and storage, content delivery, messaging-channel, email, and push-notification providers — under contracts that limit their use of the data to providing the Service to us.

• With the merchant. If you are a team member, the merchant/workspace owner can access account and activity information associated with your use of the Service.
• For legal reasons. To comply with law, respond to lawful requests, or protect the rights, safety, and property of Chatoly, our users, or the public.
• In a business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We use the following service providers to deliver the Service: OpenAI (AI replies and summaries), Vultr (hosting), Resend (email delivery), Meta Platforms (WhatsApp, Instagram, and Messenger delivery), Google (sign-in), Stripe (billing), and Expo (mobile push notifications). We give merchants at least 30 days' notice before adding or replacing a provider that processes shopper data. The current list, with each provider's purpose and location, is Annex III of our Data Processing Addendum (https://chatoly.com/dpa).

9. Data retention and deletion

We keep personal data only as long as needed for the purposes described in this Policy, unless a longer period is required by law. In particular:

• Account data is retained while your account is active.
• Conversation and customer data is retained for the merchant while their Chatoly account is active, and is deleted when the merchant's data is redacted (see below).
• Conversation, activity, and messaging data is deleted automatically on the schedule set out below, whether or not the merchant's account is still active.
• Uninstalling the App signs you out and clears locally stored data on that device. Uninstalling the store's Chatoly app deactivates the account; associated data is then deleted in line with our redaction process.

We delete data automatically on the following schedule, enforced by a daily job:

Open support tickets are never deleted automatically, however old they are.

When a merchant's account is closed, data processed on their behalf is deleted within 90 days. Encrypted backups expire on their own schedule — 14 daily backups, plus the first backup of each month kept for 12 months — and data present only in a backup is removed as that backup expires.

Your deletion request / Shopify redaction. We honor data-deletion and access requests, including standard data-deletion and data-request flows required by the platforms we integrate with. To request deletion of your personal data or your account, contact support@chatoly.com or use https://chatoly.com/delete-account. We will respond as required by applicable law.

10. Data security

We protect information with the following measures:

• All data is encrypted in transit using TLS.
• Store and messaging-channel access tokens are encrypted before they are stored.
• Backups are encrypted with AES-256, verified as restorable when written, and rehearsed monthly. The encryption key is held separately from the backups.
• Staff sign-in is federated to Google; we do not store staff passwords.
• Chatoly staff can only access a merchant's workspace through an explicit, time-limited grant, and every grant is recorded with who accessed it, why, and from where.
• Every read of shopper order data is recorded together with the purpose it served. Those records identify the shopper by a one-way fingerprint rather than by their email address.
• We maintain a documented security incident response policy and will notify affected merchants within 72 hours of becoming aware of a breach affecting their shoppers' data.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Processing Addendum

Merchants act as the controller of their shoppers' personal data and Chatoly acts as the processor. The terms governing that relationship, including security measures, sub-processor commitments, breach notification, and international transfer safeguards, are set out in our Data Processing Addendum (https://chatoly.com/dpa), which forms part of our Terms of Service.

12. International data transfers

We and our sub-processors may process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for such transfers. Contact us for more information.

13. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent. You may also have the right to lodge a complaint with a supervisory authority.

• EEA/UK residents (GDPR/UK GDPR). You may exercise the rights above. Where we act as a processor for a merchant, we will refer your request to that merchant.
• California residents (CCPA/CPRA). We do not sell or share personal information as those terms are defined under California law. You have rights to know, delete, correct, and to non-discrimination for exercising your rights.

To exercise any right, contact support@chatoly.com. We may need to verify your identity before responding.

14. Children's privacy

The App and Service are intended for business use by adults and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

15. Third-party services

The App relies on and links to third-party services (for example, Google Sign-In and the messaging platforms a merchant connects). Their handling of your data is governed by their own privacy policies, and we encourage you to review them. We are not responsible for the practices of third parties.

16. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

17. Contact us

If you have questions or requests regarding this Policy or your personal data, contact us at: