Privacy Policy

1. Who we are

ChatactorAI is operated by DVM Software Inc., [Registered Address] ("we", "us"). For privacy questions, contact privacy@chatactorai.com. We act as a data controller for personal data about our account holders (the people who sign up with us). We act as a data processor for personal data contained in Customer Conversations and knowledge sources you upload — your organization is the controller for that data, and our Data Processing Addendum (available on request) applies.

2. What we collect

Account & identity

• Email address, password hash, name (if provided).
• Organization name and role.
• Billing information processed by Stripe — we receive billing address, last 4 digits, and brand of card; never the full card number.

Service content (uploaded by you)

• Knowledge sources, Bot configurations, prompts, and persona data you provide.
• Customer Conversations: messages exchanged through your Bots, including metadata (timestamps, session identifiers).

Usage data

• Feature interactions, page visits, click events.
• Diagnostic data: error reports, request logs (with truncated payloads), performance metrics.
• IP address, user-agent, approximate location (city-level) inferred from IP.

Support communications

• Anything you send us when you contact support, including attachments.

3. How we use it & why we're allowed to

For users in regions with a "lawful basis" requirement (e.g. GDPR, UK GDPR), we rely on:

• Performance of contract — to provide the service you signed up for, authenticate you, route requests, store your Bots' data, generate responses, bill you.
• Legitimate interests — to keep the service secure, prevent abuse, debug, improve product reliability, communicate about your account, and (for prospects) reply to inquiries.
• Legal obligation — to comply with tax, accounting, and regulatory requirements.
• Consent — for optional analytics or marketing communications, where applicable. You can withdraw consent at any time.

4. What we never do

• Train our models, or instruct subprocessors to train theirs, on your Customer Conversations or knowledge sources.
• Sell your personal data to third parties.
• Use your Customer Data to advertise to anyone.
• Read individual conversations except as needed to investigate a specific support request, abuse report, or security incident, and only by authorized staff under confidentiality obligations.

5. Subprocessors

We use a small set of vendors to deliver the service. They're contractually bound to security and confidentiality terms at least as protective as ours. The current list:

• Stripe — payment processing, billing.
• OpenAI and Anthropic — large language model inference. By contract, neither trains models on data sent to their APIs.
• Contabo GmbH — compute, database hosting, object storage. Data is processed in the United States.
• Email delivery provider ([Provider Name]) — transactional emails (e.g. session-end summaries, password resets).

We'll provide 30 days' advance notice before adding or replacing a subprocessor that materially changes the picture. The current list is available on request from privacy@chatactorai.com.

6. International transfers

We are a Canadian company, and we store and process personal data in the United States. While it is there it is subject to US law, and may be accessible to US courts, law enforcement, or regulatory authorities under lawful process. We hold it under contractual protections comparable to those we apply in Canada, but no contract overrides a lawful order. If that is material to you, tell us before you upload — we will say so plainly rather than let you assume otherwise.

Our model and payment subprocessors are also US-based. Should we begin offering the service in the EU or UK, transfers out of those regions would additionally rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum; we do not target those regions today.

7. Retention

• Account data: for as long as your account is active.
• Customer Conversations & knowledge sources: for as long as your account is active, or until you delete them from the dashboard.
• Diagnostic logs: 30 days, then deleted.
• Billing records: 7 years, to satisfy tax and accounting obligations.
• After account closure: we delete personal data within 30 days, except billing records (above) and anything we must keep to defend a legal claim.

8. Security

• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
• Passwords are hashed with Argon2; we never store them in plain text.
• Access to production systems is limited to authorized staff and logged.
• We run automated backups and have a documented incident-response process. If a breach affects your data, we'll notify you without undue delay and within the timelines required by applicable law.

9. Your rights

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent (where we relied on it).
• Lodge a complaint with a privacy regulator. In Canada, that's the Office of the Privacy Commissioner of Canada (or your provincial commissioner, where one has jurisdiction). Elsewhere, it's your local supervisory authority.

To exercise any of these rights, email privacy@chatactorai.com. We'll respond within one month (extendable to three for complex requests, with notice).

To exercise any of these rights — including conversation purge, data export, or account closure with deletion within 30 days — email support@chatactorai.com. Self-serve controls in the dashboard are on the roadmap; today these requests are handled by our team.

California residents: we don't sell or share personal data within the meaning of CCPA/CPRA. You have the rights to know, delete, and correct described above; contact us using the email above to exercise them.

10. Cookies & similar technologies

We use a small number of strictly-necessary cookies for sign-in and session management. We don't use third-party advertising or cross-site tracking cookies. If we ever add optional analytics cookies, we'll ask consent first via a banner.

11. Children

ChatactorAI is not directed to children under 16. We don't knowingly collect personal data from them. If you believe a child has given us data, contact us and we'll delete it.

12. Contact

Privacy questions, data subject requests, or DPA copies: privacy@chatactorai.com.