Privacy policy

2.Our two roles

Kurz gesagt: for your account and invoices we are the controller; for your customers' data we work on your instructions.

The GDPR knows two roles, and we fulfil both — but for different data:

• Controller. For your data as a customer: your account, payments, invoices and support conversations. That's what this policy covers.
• Processor. For the personal data your site visitors and chat customers leave behind — leads, bookings, chat messages and voice notes. We process those only on your instructions. The arrangements are in the data processing agreement.

Meta (WhatsApp) is an independent controller for delivering messages. We have no influence over Meta's own processing; that is covered in WhatsApp's privacy policy.

3.What data we use

Kurz gesagt: only what's needed to build your site, help you and handle your payment.

• Account and contact — your name, business name, phone number and email address.
• Chat content — your messages with ChatBuild, including chat transcripts and voice notes (the audio and the text derived from it).
• Content for your site — uploads such as photos and logos, and the site content we create together.
• Business details — public company register data, such as your registration and business address.
• Payment details — payments run through our payment provider; we receive the payment status and invoice details, not your full bank details.
• Technical data — IP address, log files and device and browser data, for security and troubleshooting.

4.Purposes and legal bases

Kurz gesagt: per purpose, this shows why we may use data and how long we keep it.

5.AI and your data

Kurz gesagt: AI builds your site, but doesn't train on your data — unless you choose to allow it.

ChatBuild uses AI models to understand your messages and build your site. Every AI request goes through OpenRouter, routed in the EU only, to models that run on Amazon Web Services (Ireland) and Google Cloud (Europe). These parties process your data exclusively as sub-processors for us, under the arrangements in articles 6 and 7 below.

We do not train AI models on your data — not on your chats, your voice notes or your site content — unless you explicitly consent via via your account settings (a separate choice, not pre-ticked). You can withdraw that consent at any time.

Transparency is part of the deal: in line with article 50 of the AI Act, you're told at first contact that you're talking to AI — no hide-and-seek.

6.Who we share with

Kurz gesagt: we never sell data. We only share with parties needed to keep ChatBuild running.

These sub-processors help us deliver the service:

Beyond that we only share when legally required, for example with the tax authority or on demand of a competent authority.

7.Transfers outside the EEA

Kurz gesagt: your personal data lives in the EU; anything going to the US travels under the EU-US Data Privacy Framework or European model contracts.

Our primary storage is in the EU (database in Frankfurt). Some sub-processors — such as Stripe, Vercel, GitHub, Google and Apple — process (partly) in the United States, under the EU-US Data Privacy Framework. OpenRouter keeps account, billing and request metadata in the US; for that, the European Commission's standard contractual clauses (SCCs) apply, supplemented with technical measures such as encryption. You can request a copy of these arrangements via privacy@chatbuild.com.

8.How long we keep data

Kurz gesagt: no longer than needed. The retention periods are in the table under article 4.

We keep data while you are a customer and afterwards only as long as needed for the purpose we received it for, or as long as the law requires (invoices, for example, 7 years for the tax authority). Data we manage for you as a processor — such as your customers' leads and bookings — is deleted or returned after your subscription ends, following the data processing agreement.

9.Security

Kurz gesagt: encryption, access control and European storage — the full overview has its own page.

We take appropriate technical and organisational measures: encryption in transit and at rest, strict access control with MFA and separated customer environments. How we approach this is on Security and privacy.

10.Your rights

Kurz gesagt: you may view, correct, delete or take your data with you. One message is enough.

Under the GDPR you have the right to:

• Access — see what data we hold about you;
• Rectification — have mistakes corrected;
• Erasure — have your data deleted;
• Restriction — temporarily pause the processing;
• Objection — to processing based on legitimate interest or for marketing;
• Portability — receive your data in a common file format.

Send your request by chat or to privacy@chatbuild.com. We respond within one month; for a complex request the law allows up to two months longer, and we'll tell you within the first month. To make sure it's you, we verify you through the phone number we have on file.

Not happy with how we handle your data? You always have the right to file a complaint with the data protection authority.

11.Are you on a ChatBuild site?

Kurz gesagt: booked with or messaged a business that uses ChatBuild? Then that business is your point of contact.

Did you leave details on a website made with ChatBuild, or message a business owner who uses ChatBuild? Then that business owner is the controller for your data and we are only the processor. To view or delete something, contact that business — we then help the business carry out your request quickly.

12.Cookies

Kurz gesagt: chatbuild.com uses only necessary cookies by default.

Which cookies we set, why and for how long, is in the cookie policy. It also covers cookies on the websites we build for customers.

13.Changes

Kurz gesagt: if something important changes, you'll hear it from us — simply by message.

We may update this policy, for example when we engage a new sub-processor. For important changes we inform you in advance by message or email. The date of the latest version is always shown at the top.