Privacy Policy

Chatdek is a product of Advergenix ("we", "us"). This policy covers chatdek.com, the customer portal at app.chatdek.com, the Chatdek chat widget, the live demo on our website and our support. You can reach us about privacy at info@chatdek.com.

Chatdek deals with personal data for different groups of people, and our role differs:

• Customers (businesses that sign up, and their team members): we decide how this data is used, so we are the controller.
• Website visitors who chat with a customer's widget: the customer decides how this data is used and is the controller; we are their processor and follow their instructions under our Data Processing Addendum. If you are a visitor, please read the privacy notice of the website you chatted on and contact that business about your data. We will help them answer you.
• People who visit chatdek.com, try our live demo or contact us: we are the controller.

From customers and their team members

• Account details: name, email address, company name, website address, password (stored only as a secure hash) and, if you sign in with Google, the name and email Google shares with us.
• Team details: the people you invite, their roles, the websites they can access and an activity log of changes they make.
• Billing details: your plan, payment amounts and dates, order IDs and payment status. Card details are entered on our payment provider's page; we do not see or store full card numbers.
• Customer content: knowledge base entries, documents you upload, pages you ask us to crawl, widget settings, forms, assistant rules and email settings (passwords for your own email server are stored encrypted).
• Security details: sign-in sessions (time, IP address and device), two-factor authentication and passkey credentials (the secret is stored encrypted; a passkey is stored only as a public key), and a log of changes made in your account, including support access.
• Support and communications: messages you send us and our replies, support tickets, and notification preferences.
• Mail and contacts: if you use the Mail inbox, the emails of the mailbox you connect and the people in them; and the contacts, leads, bookings and tickets your team keeps in the portal.
• Referral data: your referral code, clicks on your link (kept 180 days, with the visitor's network address only in hashed form), the businesses you referred and the credit earned or used.

From website visitors (on behalf of our customers)

• The chat itself: the messages a visitor sends and the assistant's or team's replies, the page it started on, the chosen language and any rating.
• Details a visitor chooses to give: for example name, email, phone, form answers and appointment details.
• Technical data: IP address, browser and device type and time stamps, used for security, abuse prevention and to keep the conversation working.
• Visitor counts: if the website owner has it switched on, the widget sends small anonymous pings (a random id kept in the visitor's browser, the page path without its query, the referring website's name and campaign tags, the device type and whether the chat was opened). They are used to show the website owner how many people visited and used the chat. No cookie is set and no IP address is stored for this.
• Files, if the website owner allows them: files and images a visitor sends in chat (for example a photo or a PDF). They are stored privately and the assistant may read some of them to answer.
• What the assistant remembers: where the website owner has switched it on, a short note about a returning visitor (for example their name or a stated preference) for a limited time.
• Translations: if the visitor's language differs from the team's, messages may be translated by our AI provider.
• Voice input, if a visitor uses it: speech is turned into text by the visitor's own browser; we receive only the resulting text message.

From people who visit chatdek.com or use our live demo

• Live demo: the business name, email and website address you enter; we read public pages of that website to build a temporary demo assistant, and we keep the demo chat. Demo sessions expire after about two hours; your contact details are kept as an inquiry so we can follow up.
• Contact form and demo requests: your name, email, company, plan of interest and message.
• Referral links: the referral code in a link you followed, kept in a cookie for 60 days (see our Cookie & Storage Policy).
• Server logs: IP address, browser, pages requested and time, kept for security and troubleshooting.

• To provide the Service: run your assistant, answer visitors, save leads, forms and bookings, send booking confirmations and reminders, and show everything in your portal.
• To send notifications you choose (in the portal, by email or by push) and essential service emails (sign-up verification, security, billing, changes to these terms).
• To process payments, prevent fraud and keep accounting records.
• To keep Chatdek secure: detect abuse, spam and attacks, enforce rate limits and our Acceptable Use Policy.
• To give support and respond to inquiries and demo requests.
• To understand and improve the Service using aggregated, de-identified usage statistics.
• To send you occasional news about Chatdek if you are a customer or asked to hear from us. You can unsubscribe at any time from the link in the email.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use customer content or visitor chats to train AI models. We do not make decisions with legal or similarly significant effects about anyone based solely on automated processing.

• Contract: to provide the Service you signed up for and process payments.
• Legitimate interests: to keep the Service secure, prevent fraud, improve Chatdek, respond to inquiries and send customers relevant service news, balanced against your rights.
• Consent: for optional things such as push notifications, non-essential cookies (if we use them) and marketing where consent is required. You can withdraw consent at any time.
• Legal obligation: to keep financial records and respond to lawful requests.

For visitor data we process for customers, the customer is responsible for having a legal basis.

To write a reply, Chatdek sends our AI provider (OpenAI) the visitor's latest message, recent messages from the same chat, the parts of the customer's knowledge base that are relevant, and the assistant's settings (such as tone and rules). We use OpenAI's business API; under OpenAI's terms at the time of writing, data sent through the API is not used to train its models and is kept only for a limited time for abuse monitoring.

AI replies can be inaccurate. Visitors should not share sensitive information in chats, and customers should configure their assistant so it does not ask for it.

We share personal data only with:

• the customer whose website a visitor chatted on, and that customer's team members;
• service providers who help us run Chatdek (listed below), under contracts that require them to protect the data and use it only for the services they provide to us;
• professional advisers, such as lawyers and accountants, where needed;
• authorities, courts or others where the law requires it, or to protect the rights, safety and security of our customers, visitors, Chatdek or the public;
• a buyer or successor if Advergenix or Chatdek is involved in a merger, acquisition or sale of assets, with notice to affected customers.

When a visitor clicks a WhatsApp, phone or email link offered in the chat, they leave Chatdek and that service's own terms and privacy policy apply.

Our servers are in the United Kingdom, and some providers process data in other countries, including the United States and Pakistan. Where data protection law requires it, we rely on appropriate safeguards for these transfers, such as adequacy decisions or standard contractual clauses offered by our providers.

• Account and customer content: for as long as the account is open. After an account is closed, we delete or anonymise it within 90 days, unless the law requires us to keep part of it. The account owner can also export and delete the account from the portal.
• Chats: deleted, with their messages and files, once they are older than the chat history of the plan plus one month, and never sooner than 13 months. Leads, tickets and bookings that came from a chat stay in the account.
• Visitor counting: per-browser records after 13 months, daily totals after 25 months. What the assistant remembers about a returning visitor goes when its own expiry date passes.
• Account history: in-app notifications 180 days, portal activity 13 months, finished support sessions 13 months, handled website contact messages 24 months, the audit trail 25 months, referral link clicks 180 days.
• Visitor chats, leads, forms and bookings: kept while the customer's account is open so the customer can view, export or delete them. What a customer can view in the portal depends on their plan's chat history period. Customers can ask us to delete specific data at any time.
• Live demo sessions: about two hours. Inquiries from the demo or contact form: up to 24 months after our last contact, unless you become a customer.
• Payment and accounting records: as long as tax and accounting laws require.
• Server and security logs: kept for a limited period for security and troubleshooting, then deleted.
• Encrypted backups: overwritten on a rolling basis, so deleted data disappears from backups after the backup cycle ends.

• All traffic to chatdek.com, the portal and the widget is encrypted with HTTPS (TLS).
• Passwords are stored as one-way hashes; API keys and email server passwords are stored encrypted.
• You can protect your own sign-in with two-factor authentication or a passkey, and password-reset links work once, for a short time, and only in the browser that asked for them.
• Each widget key works only on the website addresses the customer sets, and a chat session is tied to the visitor's browser.
• Files visitors send are checked for type and size, stored privately and opened only after a permission check.
• Backups are taken several times a day, with a nightly encrypted copy kept off-site.
• Our staff accounts use two-factor authentication, and access to customer data is limited to people who need it to run or support the Service.
• Our applications run with restricted permissions, and backups are encrypted before they leave our servers.
• Customer data is separated by account and website, and team members only see the websites they have been given access to.
• Our staff may open your account to give you support. Each of these sessions needs a reason and a second authentication step, is limited in time, cannot change your password, billing or team, and is logged. Changes made this way show in your activity log as "Chatdek support".

No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and, where required, the relevant authorities without undue delay.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• receive your data in a portable format (the portal has exports of your leads, chats, contacts and a full account export);
• object to or restrict certain processing, including direct marketing;
• withdraw consent where we rely on it; and
• complain to your local data protection authority.

To use these rights, email info@chatdek.com. We may need to confirm your identity first, and we aim to reply within 30 days. If you are a website visitor, please contact the business whose website you chatted on; if you contact us instead, we will pass your request to them and help them respond.

California residents: we do not sell or "share" personal information as those terms are defined in California law, and we do not use sensitive personal information to infer characteristics. You may exercise the rights above without being treated differently.

Chatdek is a business service and is not directed at children under 16. We do not knowingly collect personal data from children. Customers should not use Chatdek on services aimed at children without the safeguards the law requires. If you believe a child has given us personal data, contact us and we will delete it.

Our website, portal and widget use a small number of cookies and browser storage entries to work properly. The details are in our Cookie & Storage Policy.

We may update this policy when our Service or the law changes. We will post the new version here with a new "last updated" date and, for significant changes, tell customers by email or in the portal.

For any privacy question or request, email info@chatdek.com. Chatdek is operated by Advergenix. You can also use our contact page.