Privacy Policy

This Privacy Policy explains what personal data chatacus (“chatacus”, “we”, “us”) collects, why, and what your rights are. It covers both our customers (businesses who subscribe to a chatacus assistant) and the visitors who chat with an assistant embedded on a customer’s website. chatacus is the data controller for the data described in this policy. We can be reached at marc@chatacus.co.

1. Data we collect from customers

When you subscribe to chatacus, we collect:

• Business details you give us during onboarding (business name, description, contact email, phone number, brand preferences, and any other information you choose to give the assistant);
• Billing information, processed directly by our payment provider, Stripe — we don’t store your card details ourselves;
• Correspondence with us, such as support emails.

2. Data we collect from your visitors

When someone chats with an assistant embedded on a customer’s website, we process the content of that conversation in order to generate a response, and — if the visitor chooses to give it — their name, email address, and/or phone number, along with a short summary of what they’re asking about. This is passed on to the business as a “lead”. We act as a data processor on behalf of the business for this visitor data; the business is the data controller responsible for how it’s used once received.

3. How we use data

• To provide and operate the Service, including generating assistant responses and delivering leads to the relevant business;
• To process payment and manage your subscription;
• To respond to support requests and important service communications (including your purchase confirmation and embed code);
• To maintain the security and reliability of the Service.

We do not sell personal data, and we do not use visitor conversation data to train AI models.

4. Who we share data with

We use a small number of service providers to operate chatacus, each acting as a processor on our behalf:

• Anthropic — to generate the assistant’s responses to conversations;
• Stripe — to process subscription payments;
• Resend — to deliver transactional emails, including lead notifications and purchase confirmations;
• Supabase — to store account, subscription and lead data.

Some of these providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as Standard Contractual Clauses. We don’t share personal data with anyone else except where required by law.

5. Legal basis for processing

We process customer account and billing data to perform our contract with you. We process visitor conversation and lead data on the basis of the legitimate interests of our customer (the business the visitor is contacting) in responding to enquiries, and to perform our contract with that customer.

6. Data retention

We keep customer account data for as long as your subscription is active, and for a reasonable period afterwards for legal, accounting and support purposes. We keep lead and conversation data for as long as reasonably necessary to provide the Service to the relevant business. You can ask us to delete data associated with your account at any time, subject to what we’re legally required to retain.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Ask us to delete your data, subject to legal exceptions;
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you think we’ve mishandled your data.

To exercise any of these rights, contact us at marc@chatacus.co. If you’re a visitor who has chatted with a chatacus-powered assistant and want to exercise a right over your data, we’ll direct your request to the relevant business, or handle it directly where we act as the data controller.

8. Security

We use reasonable technical and organisational measures to protect personal data, including access controls restricting who and what can read stored data, and encryption of data in transit.

9. Children

The Service is intended for use by businesses and their adult visitors. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify customers by email.

11. Contact

Questions about this policy, or requests relating to your personal data, can be sent to marc@chatacus.co.