Privacy Policy

We collect only what the service needs to work. There are two groups of people involved: the customer (the business using AvroChat) and the visitor (someone chatting on the customer's website).

• Account data — name, email address, workspace name, role and authentication identifiers.
• Billing data — plan, subscription state and customer identifiers from our payment provider. We never see or store full card numbers.
• Website data — the domains you register and their verification state.
• Conversation data — messages, attachments you send, status, assignment, tags and internal notes.
• Visitor data — a generated visitor identifier, page URL where the chat started, browser locale, coarse technical metadata, and any details a visitor voluntarily types (such as name or email).
• Operational logs — request errors, delivery attempts for notification emails and audit records of sensitive workspace actions.

We do not sell personal data, and we do not use conversation content for advertising.

AvroChat uses a small number of browser storage entries: a session for signed-in users, a widget session identifier so a visitor's conversation survives a page reload, and preference storage such as language and notification sound settings.

The cookie policy describes each category, including analytics and future marketing cookies, in more detail.

Chat content is stored in the workspace it belongs to and is visible only to members of that workspace, subject to their role. Internal notes are never shown to visitors.

When a conversation is escalated to a human and email notifications are enabled, a transcript may be emailed to the workspace's verified support recipients so the request is not lost. That email is sent through our email provider on the customer's behalf.

When the AI agent is enabled, the visitor's question and the relevant passages retrieved from the workspace's own knowledge base are sent to our model provider to generate a reply. Retrieval is always scoped to a single workspace.

• We do not use customer conversations or knowledge sources to train our own models.
• Answers are generated from retrieved content; when nothing relevant is found the agent declines to answer.
• Customers can disable the AI agent, and can delete indexed knowledge sources at any time.
• Visitors are told when they are talking to an AI assistant and can ask for a person.

For customer accounts we rely on performance of a contract (providing the service you signed up for) and legitimate interests (security, abuse prevention and service improvement). Where required, we rely on consent — for example for non-essential analytics or marketing cookies.

For visitor conversation data, the business operating the website is the controller and decides why the data is collected. AvroChat acts as a processor and follows that customer's instructions.

• Account and workspace data — kept while the account is active.
• Conversations and transcripts — kept while the workspace is active, so your team keeps its history.
• Billing records — kept for the period required by applicable accounting and tax law.
• Notification delivery logs — kept for a limited troubleshooting window, then removed.
• Audit logs — retained as an immutable record of sensitive workspace actions.

When an account is closed we delete or anonymise personal data that we are not legally required to keep.

Workspace owners can delete websites, knowledge sources and their workspace from inside the product. Deleting a workspace removes its conversations, notes, tags and configuration.

Visitors should contact the business they were chatting with, because that business controls the conversation. If you contact us directly, we will forward the request to the relevant customer.

• Access — request a copy of the personal data we hold about you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — ask for data to be deleted where no legal obligation requires us to keep it.
• Restriction and objection — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — where processing is based on consent.

We respond to verified requests within one month. You may also complain to your local data protection authority.

Privacy requests and questions go to support@avrochat.com. Please include enough information for us to identify your account or conversation.

We update this policy when the product changes. Material changes are announced to workspace owners by email.