Privacy Policy

The Service is operated by ChatHey.

For anything concerning your personal data — a question, a request to access or delete it, or a complaint — write to support@chathey.com. We answer within 30 days.

The Service is used by businesses to communicate with their customers over WhatsApp, Instagram, Facebook Messenger and email. Personal data of two different groups passes through it, and our role towards each is different.

Businesses that use the Service ("Customers")

When you create an account, invite team members, connect a messaging account or use the Service, we decide how and why that data is processed. For this data we are the data controller.

People who message a Customer ("Contacts")

When a person sends a message to a business that uses the Service, the content of that conversation and the details of that person are processed on the business's behalf and on its instructions. For this data the business is the controller and we are its processor. If you are a Contact and want to exercise a right over your data, the business you were in touch with is the first place to go; we help it respond, and we will also forward a request sent to us.

Account data

• Email address, name and password (stored hashed) when you sign up, and the same for each team member you invite.
• Your role and permissions within each organisation you belong to, and which connected accounts you may access there. One sign-in can belong to several organisations; an organisation's owner does not see which others you belong to.

Connection credentials

• The access tokens, verification tokens and application secrets required to connect your WhatsApp Business, Instagram or Facebook accounts or your Gmail or Microsoft mailbox, and the password of a mailbox you connect with its password. These are encrypted before they are stored and decrypted only on our servers at the moment a message is sent or received. Nobody, including our staff, can read them from the database.

Messaging data

• The messages, media, reactions, comments and delivery statuses exchanged between a Customer and its Contacts through the connected accounts, including the sender's phone number or platform identifier, display name and profile picture where the platform provides them.
• Emails in a mailbox the Customer connects, as described in section 15.
• Contact records the Customer creates or imports: names, phone numbers, email addresses, tags, groups, notes and custom fields.
• Message templates, campaigns and their per-recipient results.

Automation and AI data

• Chatbot configurations, conversation flows and instant-reply rules the Customer builds.
• Knowledge-base material the Customer attaches for its AI assistant: website pages, files and text, and the searchable representations derived from them.
• When AI features are on: the messages needed to generate a reply, and the reply itself. We record the volume of such use (tokens) for metering; if you use our managed AI engine we do not expose to you which underlying provider or model served a given request.

Usage and technical data

• Sign-in events, the pages and features you use, error reports, and the IP address and browser details sent with every request. We do not use advertising trackers.

Billing data

• Your plan, its limits and its renewal dates. We do not currently collect payment card details; if we introduce online payment, it will be handled by a payment provider and this policy will be updated first.

• To provide the Service: route messages between you and Meta's platforms, show them in your inbox, run your campaigns, chatbots and automations.
• To keep the Service secure: authenticate sign-ins, enforce your team's permissions, detect abuse and investigate incidents.
• To operate AI features you have enabled, including generating replies and reading the knowledge base you attached.
• To support you when you contact us, and to notify you of changes that affect your account, your plan or this policy.
• To understand how the Service is used, in aggregate, so we can improve it.
• To meet our legal obligations and to establish, exercise or defend legal claims.

We do not sell personal data, and we do not use the content of your conversations to build advertising profiles or to train AI models.

We process personal data under the Protection of Privacy Law, 5741-1981 and the regulations made under it. Where the General Data Protection Regulation (EU) 2016/679 applies to a Customer or a Contact, our legal bases are:

• Performance of a contract — everything needed to provide the Service you signed up for.
• Legitimate interests — security, fraud prevention, service improvement and our own record-keeping, where those interests are not outweighed by your rights.
• Consent — where we ask for it specifically, for example when you turn on an optional feature. You can withdraw it at any time.
• Legal obligation — where the law requires us to keep or disclose data.

We share personal data only with the providers listed below, each of which processes it on our instructions and under a written agreement, and only to the extent needed for the purpose stated.

• Meta Platforms, Inc. — WhatsApp Business Platform, Instagram Messaging and Messenger APIs — every message the service sends or receives passes through Meta. (United States and worldwide)
• Hostinger International Ltd. — Hosting of the server that runs the Service: the web application at chathey.com, the database, file storage, sign-in and server-side functions (your account and message data). (European Union)
• Supabase, Inc. — A copy of the database and files as they were before our move to our own servers on 25 September 2026, kept temporarily as a backup and then deleted. No new data is sent there. (United States / European Union)
• Google LLC — Gmail API and Google Cloud Pub/Sub: reading and sending email in Gmail mailboxes a Customer connects, and notifying us of new email. (United States and worldwide)
• Microsoft Corporation — Microsoft Graph: reading and sending email in Microsoft 365 and Outlook.com mailboxes a Customer connects. (United States and worldwide)
• Third-party AI model providers — Only when you enable AI features. The text needed to answer a message, and the knowledge-base material you attached, is sent to a model provider to generate the reply. If you connect your own provider key, that provider processes the data under your agreement with it. (United States and worldwide)

Messages you send and receive are governed also by Meta's own terms and privacy policies, which apply to your relationship with Meta directly; we do not control what Meta does with data on its platforms.

Emails are governed also by the terms and privacy policies of the mailbox's own provider (such as Google, Microsoft or your hosting company), which apply to your relationship with them directly.

We may also disclose personal data when the law requires it, to protect the rights, safety or property of the Service, our Customers or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the transferred data.

Our providers store and process data in the United States and other countries. Where data of a person in the European Economic Area or the United Kingdom is transferred outside those areas, we rely on the standard contractual clauses approved by the European Commission or equivalent safeguards offered by the provider.

• Account and organisation data: for as long as the account exists. When an account is deleted, we keep an account record for seven years after the deletion, for accounting, legal and support purposes: the account holder's name, email address and phone number, the organisation's name, its subscription history and the answers given in the sign-up questionnaire. Everything else is deleted at the moment of deletion.
• Messaging data, contacts, campaigns and automations: while the Customer's subscription is active, for as long as the Customer keeps them. A Customer can delete conversations, contacts, sources and bots at any time from within the Service, and deletion of the account deletes everything under it immediately and permanently.
• After a subscription ends and is not renewed: conversations, messages and media, contacts, campaigns and AI knowledge sources are kept for 30 days after the end of a free trial that was never paid for, and, for an account that has paid, for 60 days after the later of the end date and the last sign-in by anyone in the organisation, but no longer than 180 days after the end date. They are then deleted, and connected channels are disconnected. We email the account holder 14 days and again 3 days before the deletion. The account, its plan history, its settings (such as bots, quick replies, tags and custom fields), billing records and purchased AI tokens are kept. Renewing before the deletion date cancels it.
• One free trial per business: to prevent repeated free trials, we keep hashed identifiers of each trial (email address, phone numbers, and WhatsApp, Facebook, Instagram and TikTok account identifiers) for three years after they were last seen. They are stored as one-way hashes, which is pseudonymisation rather than anonymisation, and are used only to recognise a business that has already had a trial.
• Connection credentials: until you disconnect the account or close your account, whichever comes first.
• AI usage metering and billing records: for the period required by tax and accounting law, typically seven years, in a form that no longer identifies the content of any message.
• Security and access logs: up to 12 months.

Backups are retained for a limited rolling period and are overwritten in the ordinary course; data deleted from the live Service disappears from backups within that period.

• All traffic between your browser, our servers and our providers is encrypted in transit.
• Connection credentials are encrypted at rest with a key that is not stored in the database, and are decrypted only inside our server-side functions.
• Every record is isolated per organisation at the database level, so one Customer's data is never visible to another, and each team member sees only what their permissions allow. A person who belongs to several organisations works in one at a time, and every request is checked against their membership in that organisation.
• Access to production systems is limited to the people who operate the Service and is logged.

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you, and any authority the law requires, without undue delay.

Under the Protection of Privacy Law, and where it applies the GDPR, you have the right to:

• know whether we hold personal data about you, and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted, subject to our legal obligations to keep some of it;
• object to, or ask us to restrict, certain processing;
• receive the data you provided in a portable format;
• withdraw a consent you gave;
• complain to a supervisory authority — in Israel, the Privacy Protection Authority.

To exercise any of these, write to support@chathey.com. We may ask you to verify your identity first. If you are a Contact of one of our Customers, we may refer the request to that Customer, who controls that data, and assist it in responding.

If you are a Customer

You can delete individual conversations, contacts, knowledge sources, bots and campaigns from within the Service. To delete your account and everything in it, use the account settings (Settings → Account → Delete organization) or write to us at the address below. We keep only the account record described in section 8. Deleting an organisation also deletes the sign-ins of its team members who belong to no other organisation; a sign-in that still belongs to another organisation is kept, and only its access to the deleted one ends. Disconnecting a WhatsApp, Instagram or Facebook account from the Service removes the stored credentials for it immediately; disconnecting an email account also deletes the emails imported from it (see section 15). If a subscription ends and is not renewed, its content is deleted automatically after the periods in section 8.

If you are a Contact of a Customer

Send a request to support@chathey.com with the phone number or platform account you used and, if you know it, the name of the business you were in touch with. We will identify the data held for that identifier, confirm the request with the responsible business, and delete it or have it deleted within 30 days, unless the law requires it to be kept. You will receive a confirmation when it is done.

Data held by Meta, Google and Microsoft

Deleting data from the Service does not delete it from WhatsApp, Instagram, Facebook or the connected mailbox itself (Gmail, Outlook or another provider). Those platforms hold their own copies under their own policies, and requests concerning them should be made to the platform concerned.

The Service uses browser storage strictly to keep you signed in and to remember your preferences, such as your language. We do not use advertising or cross-site tracking cookies. Blocking storage will prevent you from staying signed in.

The Service is offered to businesses and may not be used by anyone under 18. We do not knowingly collect personal data from children as Customers. Contacts of a Customer may be of any age; the Customer is responsible for messaging them lawfully.

We may update this policy as the Service or the law changes. The date at the top shows when it was last revised. For material changes we will notify Customers by email or inside the Service before they take effect.

A Customer can connect a Gmail or Google Workspace mailbox, a Microsoft 365 or Outlook.com mailbox, or any other mailbox through its IMAP and SMTP servers, so that its emails appear in the Service alongside its other channels. This section explains exactly what we do with the data we receive from Google, Microsoft and other email providers. It adds to the rest of this policy.

What we access

• Google: permission to read, send and organise email in the connected Gmail account (the gmail.modify permission), and the account's email address and basic profile, to identify it.
• Microsoft: permission to read and change email in the connected mailbox and to send email from it (Mail.ReadWrite and Mail.Send), permission to stay connected (offline_access), and the account's email address and basic profile.
• Other mailboxes, connected with a password: the email address, the mailbox's password (for Gmail, Yahoo or iCloud, an app password the Customer creates for ChatHey) and its server settings. We use them to sign in to the mailbox's own servers: IMAP to read and organise email, SMTP to send it. Signing in this way opens the whole mailbox; we read only the folders needed to show its conversations (inbox, sent, archive and drafts, or Gmail's All Mail) and never its spam or trash.
• We access only the mailbox the Customer connects, and only while it stays connected.

How we use it

• To show the mailbox's emails as conversations in the Customer's inbox, including emails from the 30 days before the mailbox was connected.
• To send the replies and new emails the Customer's team writes in the Service, from the connected address and in the original email thread.
• To keep the read and unread status of emails the same in the Service and in the mailbox.
• Only if the Customer turns on the AI assistant for email: to write automatic replies to incoming emails, using the text of the email and the knowledge base the Customer attached.
• We use this data only to provide and improve these features, which the Customer can see and control in the Service.

What we store

• The content of the emails we show: subject, text, sender, recipients and date, and, when they are opened or needed to display an email, their attachments and images.
• The identifiers needed to keep conversations in sync with the mailbox.
• The access tokens for the mailbox, or the password of a mailbox connected with one, encrypted as described in section 9. A stored password is never shown again, to anyone including the Customer, and is used only to sign in to that mailbox.
• For a mailbox connected with a password, a record of each connection attempt (the address, the server and whether it worked), kept for 24 hours to stop the connection form from being used to guess passwords.

What we never do

• We do not sell email data, and we do not use it for advertising, including retargeting, personalised or interest-based advertising.
• We do not use email data to develop, improve or train generalised artificial intelligence or machine-learning models. The AI model providers we send text to process it only to write the reply.
• We do not transfer email data to anyone except the providers in section 6, and only as needed to provide or improve these features, for security, to comply with the law, or as part of a merger, acquisition or sale of assets after obtaining the Customer's explicit prior consent.
• No one at ChatHey reads the content of emails, unless the Customer asks us to for specific messages (for example in a support request), it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised for internal operations.

Google API Services User Data Policy

ChatHey's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Keeping and deleting it

• Emails follow the retention rules for messaging data in section 8.
• Disconnecting a mailbox in the Service (on the Channels page) immediately deletes its access tokens or password and the conversations, emails and attachments imported from it, and ends all access to it.
• You can also withdraw ChatHey's access at any time: in your Google Account at myaccount.google.com/connections, or in your Microsoft account at account.live.com/consent/Manage (personal accounts) or through My Apps at myapps.microsoft.com or your administrator (work or school accounts). Access stops at once; emails already in the Service stay until you disconnect the mailbox or delete them.
• For a mailbox connected with a password, you can also end access by changing the mailbox's password or deleting the app password (for Gmail, at myaccount.google.com/apppasswords). The Service then asks for the new password and reads nothing until it is given.

ChatHey — support@chathey.com