Privacy Policy

Introduction

This policy explains what Chatty, operated by Coolsoftware Web Solutions ("we", "us"), collects, why, who helps us process it, and the choices you have. Terms not defined here mean what they mean in our Terms of Service.

This website

The public website uses an analytics service at analytics-ops1.coolsoftware.io to understand aggregate visits and page usage, improve the site and measure which public content is useful. The analytics property is separate from the signed-in Chatty application, which is not instrumented with this script.

Website analytics. The analytics script may process technical visit information such as the page viewed, referrer, browser or device details and network information, according to the analytics service's configuration. We use the data for the public website and do not use it to identify the people who use the Chatty application.
Previous launch updates. If you signed up for launch updates, we stored your email address, the date, and which form you used. We use it only for those updates. New signups for launch updates are closed. Ask us and we will delete it.
Theme. If you choose light or dark, the choice is kept in your own browser. It is never sent to us.
Server logs. Like any website, our servers record requests, including IP addresses, to keep the site running and to stop abuse.

Using Chatty

Your account

Your name and email address, from the Microsoft or Google account or email address you sign in with, and the organisations you belong to with your role in each. Sign-in is handled by Microsoft Entra.

Your organisation's content

The websites, files and videos you add, the text we extract from them and the search index we build; Chatty's settings and your skills; the conversations it has; and your tickets. You control this content, and we process it on your behalf.

Your customers' data

When people talk to Chatty we store the conversation. Inside your app, your backend tells us who the person is (for example their name, email, plan and role) and which page they are on. If a conversation is passed to your team, we also keep the email address, and any name or phone number, that the person gives so your team can reach them. For this data you are the controller and we are your processor.

Voice dictation

Where a chat offers the microphone, a visitor can speak their message instead of typing it. Nothing is recorded until the visitor presses the microphone button and allows their browser to use the microphone. The browser then records a short clip, up to one minute, and sends it to us. We turn it into text with a speech-to-text model on Microsoft Azure AI Foundry, and send the text back to the visitor, who can change it before sending. We do not store the recording. The text is kept only if the visitor sends it as a message, like any other message.

Some chats use the visitor's own browser for dictation instead. Then the audio goes to the company that makes the browser, under its own terms, and not through us.

Usage and billing

Which models were used, how many tokens, what each answer cost, and your plan and payments. Card and bank details are handled by PayPal; we never see or store them.

How we use it

To provide, secure and support the Service, and to bill for it.
To show you what Chatty did and what it cost.
To prevent abuse, and to meet legal obligations.

We do not sell personal data, and we never use your content or your customers' messages to train AI models.

Who processes it for us

AI models. Microsoft Azure AI Foundry runs the models included in plans, builds the search index and, where voice dictation is offered, turns short recordings into text.
File storage. Cloudflare R2 stores the files you upload.
Reading websites and videos. A web fetching service reads the pages you add, and a transcript service reads YouTube transcripts.
Sign-in. Microsoft Entra.
Payments. PayPal.

Each of them may only use the data to provide their service to us.

Legal basis (GDPR)

Where the GDPR applies, we process personal data to perform our contract with you, on our legitimate interests in running and securing the Service, to meet legal obligations, and, for launch updates, with your consent.

Retention and deletion

We keep data for as long as your account or organisation exists. Deleting a source removes its files, its text and its search index. When an organisation is closed its data is deleted, except records the law requires us to keep, such as invoices.

Security

Every organisation's data is kept separate, members only see what their role allows, model keys are stored encrypted, and changes are recorded in an audit log. No system is perfectly secure, and we cannot promise absolute security.

Transfers

Our providers may process data outside your country. Where that happens we rely on the safeguards the law requires, such as standard contractual clauses.

Your rights

You may ask to see, correct, export or delete your personal data, to restrict or object to its processing, and to withdraw consent. Write to [email protected]; we may need to confirm who you are first. If you are a customer of one of our customers, write to them, and we will help them answer you. You may also complain to your data protection authority.

Children

The Service is not meant for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We will post any change here and update the effective date. For a material change we will also tell account holders.

Contact

Questions about privacy: [email protected].