Privacy Policy

This Privacy Policy explains how PersonaliAI (“PersonaliAI”, “we”, “us”) collects, uses, stores, shares, and protects information when you use Chatty (the “Service”), including the optional Chatty Bookings integration for Zoom. It is written to comply with applicable data-protection laws and clarifies your rights over your personal information.

Information we collect

• Account data: name, email address, and authentication identifiers when you sign up.
• Chatbot content: the files, website URLs, and text you provide to train your assistant.
• Conversation data: messages exchanged with your chatbot and any lead details visitors submit.
• Integration data: OAuth access and refresh tokens, and the email address of the connected account, for services you choose to connect (Google, Microsoft, Zoom).

Zoom integration data

If you connect your Zoom account, Chatty requests only the permission required to create meetings on your behalf (meeting:write). We use this access for a single purpose: to schedule a Zoom meeting and generate a join link when a visitor books a call through your chatbot. We access:

• Your Zoom account email address (to confirm which account is connected).
• Meeting objects we create (topic, start time, duration, and the resulting join URL and meeting ID).

We do not read your existing Zoom meetings, recordings, contacts, or chat history, and we never join your meetings. Zoom OAuth tokens are stored encrypted at rest and are used only to create meetings you initiate through bookings.

Google user data

If you choose to connect your Google account, Chatty requests access to specific Google services (Google Calendar and Google Drive) strictly to provide user-facing features you configure:

• Google Calendar (.../auth/calendar, .../auth/calendar.events): Used to check host availability (free/busy slots) so website visitors can schedule appointments without double-booking, to create calendar events with Google Meet conference links upon booking confirmation, and to display upcoming customer meetings in the dashboard calendar.
• Google Drive (.../auth/drive): Used only when you explicitly connect and select a Google Drive folder or file in your Knowledge Base settings. Chatty reads the designated documents (such as PDFs, Docs, Sheets, and text files) solely to extract content and create search embeddings so your AI assistant can accurately answer customer inquiries based on your business documentation.

Google Limited Use Compliance: PersonaliAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use Google user data to train, retrain, or improve generalized or foundational AI/ML models.
• We do not sell Google user data or transfer it to third parties for advertising or profiling.
• Google OAuth access and refresh tokens are encrypted at rest using AES-256 and transmitted exclusively via encrypted TLS/HTTPS.
• You can disconnect your Google account at any time in your dashboard settings, which immediately revokes tokens and purges stored credentials.

How we use information

• To operate your chatbot, answer visitor questions, and capture leads.
• To schedule meetings and deliver meeting links via chat and email when a booking is made.
• To maintain, secure, and improve the Service.
• To communicate with you about your account and support requests.

We do not sell your personal information or use connected-account data for advertising.

GDPR Legal Bases for Processing (Article 6)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing your Personal Data include:

• Performance of a Contract (Art. 6(1)(b)): To provide the Chatty Service, manage customer accounts, execute appointment bookings, and deliver customer support.
• Legitimate Interests (Art. 6(1)(f)): To secure our systems, prevent fraud, scrub sensitive PII, ensure service stability, and provide business communication tools.
• Consent (Art. 6(1)(a)): For proactive promotional marketing campaigns across SMS, email, and WhatsApp, which strictly require prior affirmative opt-in.
• Legal Compliance (Art. 6(1)(c)): To comply with mandatory statutory and regulatory tax, billing, and accounting obligations.

Data Minimisation & Automated PII Redaction (Article 25)

In accordance with Privacy by Design standards, Chatty includes an automated Data Loss Prevention (DLP) engine that scans incoming customer messages across chat widgets and omnichannel pipelines (WhatsApp, Instagram, Telegram, SMS, Email). Payment cards (Luhn MOD-10 algorithm), Social Security numbers, and bank account numbers (ISO 7064 IBAN MOD-97) are automatically redacted prior to prompt synthesis or persistent database storage.

Sub-processors & Cross-Border Transfers (Articles 28, 44–49)

We share data only with verified sub-processors necessary to deliver the Service (cloud database, LLM inference, and messaging carriers). All sub-processors are vetted for SOC 2 Type II or ISO 27001 certifications. Transfers outside the EEA are governed by the European Commission’s Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework (DPF).

View our full, binding Data Processing Addendum (DPA) and regularly updated Sub-processor Registry.

Data Retention & Storage Limitation (Article 5(1)(e))

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Account owners can configure automated data retention periods (e.g. 30, 60, or 90 days) for their bots, or trigger an on-demand retention purge in dashboard settings. Deleting a bot immediately cascades deletion across all conversational history, leads, session notes, and knowledge base embeddings.

Your Data Subject Rights Under GDPR (Articles 12–23)

Under European data protection laws, data subjects have comprehensive rights regarding their personal data:

• Right of Access (Art. 15): You may request a complete export of all personal data held about you.
• Right to Rectification (Art. 16): You may correct inaccurate or incomplete personal data.
• Right to Erasure / “Right to be Forgotten” (Art. 17): You may request permanent deletion of your data. Website visitors can also trigger instant self-service data erasure directly within the chat widget via the trash icon.
• Right to Restriction of Processing (Art. 18): You may request temporary suspension of automated AI responses.
• Right to Data Portability (Art. 20): You may receive your data in a structured, machine-readable format (JSON/CSV).
• Right to Object (Art. 21): You may object to marketing communications at any time. All marketing emails include one-click cryptographic unsubscribe links.

To exercise any of these rights, contact our Data Protection team at privacy@personaliai.com. You also have the right to lodge a complaint with an EU supervisory authority in your Member State.

Cookies & Local Storage (ePrivacy Directive)

The Chatty embed widget uses strictly necessary terminal storage (localStorage and an HttpOnly session capability token) solely to preserve conversational continuity during an active chat session initiated by the user. Chatty does not use third-party advertising cookies or cross-site tracking pixels.

Security Measures (Article 32)

We implement rigorous safeguards including symmetric Fernet / AES-256 encryption at rest for credentials, TLS 1.3 encryption in transit, multi-tenant Row-Level Security (RLS) isolation in PostgreSQL, and HMAC signature verification across all webhook integrations.

Contact & Data Protection Officer

For inquiries regarding our GDPR compliance, DPA execution, or to reach our Data Protection Officer, email privacy@personaliai.com.