1. Who is responsible for your data
Chatduct is the data controller for personal data used to operate this website, create and administer accounts, provide support, secure the service, and manage subscriptions. Privacy questions and requests can be sent to help@chatduct.com. This address is our privacy contact and is not presented as a formally appointed Data Protection Officer.
When a business customer uses Chatduct to process messages or records relating to its own customers, that business normally determines why and how those records are used and acts as controller. Chatduct processes that customer content on the business customer's documented instructions and acts as processor. Business customers remain responsible for their own notices, lawful basis, instructions, and responses to their data subjects.
2. Scope
This policy applies to visitors to chatduct.com, account holders, authorized users of a customer workspace, people who contact support, and individuals whose information is submitted to Chatduct through a customer's connected messaging channels and work applications.
3. Personal data we process
Depending on how Chatduct is used, we may process:
- Account and onboarding data: first and last name, business name, email address, account identifiers, and authentication credentials. We do not include passwords in analytics.
- Service configuration: projects, connected channels and workapps, relation identifiers, configuration state, and user preferences.
- Customer content: messages, chat identifiers, usernames, message metadata, and records that a customer chooses to route through Chatduct.
- Technical and security data: IP address, timestamps, request and error logs, browser and device information, authentication events, and security signals.
- Support data: the content of emails or other communications sent to us and the contact details used to reply.
- Billing data: plan, subscription, invoice, and transaction references when paid plans are enabled. Full payment card details are handled by the payment provider, not Chatduct.
- Analytics data: page URL, route, referrer, approximate location, device type, operating system, browser, and event time, but only after analytics consent. Dashboard paths and URL query parameters are removed before analytics events are sent.
We do not intentionally request special-category data such as health, biometric, political, or religious information. Customers should not submit such data unless they have confirmed a lawful basis, necessity, and appropriate safeguards.
4. Where data comes from
We receive data directly from you, from an organization that authorizes your account, from the messaging channels and workapps that a customer connects, automatically from your device and requests, and from service providers involved in authentication, hosting, support, and future billing.
5. Purposes and legal bases
- Account creation and service delivery
- We process account, configuration, and requested integration data because it is necessary to enter into or perform our contract with the customer (GDPR Article 6(1)(b)).
- Customer content
- We process customer content to provide the service under the customer's documented instructions. The customer determines the lawful basis for its underlying use of that content.
- Security, reliability, and abuse prevention
- We use technical and security data for our legitimate interests in protecting users, preventing fraud, diagnosing faults, and maintaining the service (GDPR Article 6(1)(f)). We assess those interests against the rights and freedoms of affected individuals.
- Support and service communications
- We process communications to perform our contract or take requested pre-contract steps, and for our legitimate interest in responding to questions and maintaining customer relationships.
- Billing and records
- When payments launch, we will process subscription and transaction references to perform the contract and meet tax, accounting, and other legal obligations (GDPR Articles 6(1)(b) and 6(1)(c)).
- Optional website analytics
- We use Vercel Web Analytics only after consent (GDPR Article 6(1)(a)). You can refuse or withdraw consent without losing access to the service.
- Legal claims and compliance
- We may process limited data to comply with law or establish, exercise, or defend legal claims (GDPR Articles 6(1)(c) and 6(1)(f)).
We will not silently change from consent to another legal basis if you withdraw analytics consent.
6. Cookies and device storage
Chatduct uses strictly necessary cookies and browser storage for authentication, security, interface state, and saved preferences. Optional analytics is disabled until you consent. Details and controls are available in our Cookie Policy and through the “Cookie settings” control available throughout the site.
7. Who receives data
We disclose only the data reasonably necessary for the relevant purpose to:
- Vercel: website hosting, delivery, security, and consent-based Web Analytics;
- Google Workspace: support communications sent to help@chatduct.com;
- backend and infrastructure providers: application hosting, storage, authentication, monitoring, and security;
- connected providers: messaging channels and workapps selected by the customer, to carry out the customer's requested integration;
- payment providers: checkout, subscription, tax, fraud-prevention, and transaction services when paid plans launch; and
- authorities or advisers: where disclosure is required by law or reasonably necessary to protect rights, users, or the service.
We do not sell personal data or use it for cross-site targeted advertising.
8. International transfers
Some providers may process data outside the European Economic Area. Where GDPR transfer rules apply, we use an applicable safeguard such as an adequacy decision or the European Commission's Standard Contractual Clauses, and supplementary measures where needed. You may request information about the applicable safeguard at help@chatduct.com.
9. Retention
We keep personal data only while it is needed for the purpose described above. We determine the period using account status, contractual necessity, the customer's documented instructions, security needs, legal limitation periods, and tax or accounting duties. We then delete or irreversibly anonymize data unless a legal hold requires preservation.
- Browser-side authentication and preference periods are listed in the Cookie Policy.
- Customer content is retained while the customer account or relevant integration requires it, then handled under the customer's deletion instructions and the applicable service agreement.
- Security logs are retained only for the period reasonably needed to investigate incidents, prevent abuse, and meet legal obligations.
- Support and billing records are retained for the period needed to resolve the request, maintain necessary business records, and meet applicable legal duties.
- Vercel states that its Web Analytics visitor-identification hash is discarded after 24 hours; only consented, aggregated analytics is used by Chatduct.
10. Security
We use proportionate technical and organizational safeguards designed to protect confidentiality, integrity, availability, and resilience. These include access controls, authenticated API requests, encrypted transport, security headers, restricted browser connections, and incident investigation. No online service can guarantee absolute security. Please keep credentials confidential and report suspected unauthorized access to help@chatduct.com.
11. Your GDPR rights
Subject to the conditions and exceptions in applicable law, you may request:
- access to your personal data and a copy of it;
- correction of inaccurate or incomplete data;
- deletion of data;
- restriction of processing;
- data portability for eligible data;
- objection to processing based on legitimate interests; and
- withdrawal of consent at any time, without affecting earlier lawful processing.
Send a request to help@chatduct.com. Tell us which account or organization is involved and what you want us to do. We may request proportionate information to verify identity. We normally respond within one month, or explain any lawful extension or refusal. If Chatduct is processing data only for a business customer, we may forward the request to that customer or help it respond.
12. Automated decisions
Chatduct does not currently make decisions based solely on automated processing that produce legal or similarly significant effects about website visitors or account holders.
13. Children
Chatduct is a business service intended for people aged 18 or older. We do not knowingly create accounts for children.
14. Complaints
Please contact us first so we can investigate. You also have the right to complain to the data protection authority in the EEA country where you live, work, or believe an infringement occurred. The European Data Protection Board publishes a list of supervisory authorities.
15. Changes and contact
We may update this policy when our processing, providers, or legal duties change. Material changes will receive additional notice where required. The current version and date remain available here. Contact help@chatduct.com with privacy questions, rights requests, or security concerns.