Privacy policy

2.Our two roles

In short: for your account and invoices we are the controller; for your customers' data we work on your instructions.

The GDPR knows two roles, and we fulfil both — but for different data:

• Controller. For your data as a customer: your account, payments, invoices and support conversations. That's what this policy covers.
• Processor. For the personal data your site visitors and WhatsApp customers leave behind — leads, bookings, chat messages and voice notes. We process those only on your instructions. The arrangements are in the data processing agreement.

Meta (WhatsApp) is an independent controller for delivering messages. We have no influence over Meta's own processing; that is covered in WhatsApp's privacy policy.

3.What data we use

In short: only what's needed to build your site, help you and handle your payment.

• Account and contact — your name, business name, WhatsApp number and email address.
• Chat content — your messages with ChatBuild, including chat transcripts and voice notes (the audio and the text derived from it).
• Content for your site — uploads such as photos and logos, and the site content we create together.
• Business details — public Chamber of Commerce data, such as your registration and business address.
• Payment details — payments run through Mollie; we receive the payment status and invoice details, not your full bank details.
• Technical data — IP address, log files and device and browser data, for security and troubleshooting.

4.Purposes and legal bases

In short: per purpose, this shows why we may use data and how long we keep it.

5.AI and your data

In short: AI builds your site, but doesn't train on your data — unless you choose to allow it.

ChatBuild uses AI models from Anthropic to understand your messages and build your site, and Dutch speech recognition from Deepgram to turn voice notes into text. Both parties process your data exclusively as a (sub-)processor for us, under the arrangements in articles 6 and 7 below.

We do not train AI models on your data — not on your chats, your voice notes or your site content — unless you explicitly consent via [[OPT_IN]]. You can withdraw that consent at any time.

Transparency is part of the deal: in line with article 50 of the AI Act, you're told at first contact that you're talking to AI — no hide-and-seek.

6.Who we share with

In short: we never sell data. We only share with parties needed to keep ChatBuild running.

These sub-processors help us deliver the service:

Two parties are not sub-processors but independent controllers: Mollie (payments, NL) and Meta/WhatsApp (message delivery). They decide themselves how they process personal data; see their own privacy policies.

Beyond that we only share when legally required, for example with the Dutch tax authority or on demand of a competent authority.

7.Transfers outside the EEA

In short: your data lives in the EU; anything going to the US only travels under European model contracts.

Our primary storage is in the EU (database in Frankfurt). Some sub-processors — such as Anthropic, Deepgram, Cloudflare and Google — process (partly) in the United States. With them we conclude the European Commission's standard contractual clauses (SCCs), supplemented with technical measures such as encryption. You can request a copy of these arrangements via [[FG_OF_PRIVACY_CONTACT]].

8.How long we keep data

In short: no longer than needed. The retention periods are in the table under article 4.

We keep data while you are a customer and afterwards only as long as needed for the purpose we received it for, or as long as the law requires (invoices, for example, 7 years for the tax authority). Data we manage for you as a processor — such as your customers' leads and bookings — is deleted or returned after your subscription ends, following the data processing agreement.

9.Security

In short: encryption, access control and European storage — the full overview has its own page.

We take appropriate technical and organisational measures: encryption in transit and at rest, strict access control with MFA and separated customer environments. How we approach this is on GDPR and security.

10.Your rights

In short: you may view, correct, delete or take your data with you. One message is enough.

Under the GDPR you have the right to:

• Access — see what data we hold about you;
• Rectification — have mistakes corrected;
• Erasure — have your data deleted;
• Restriction — temporarily pause the processing;
• Objection — to processing based on legitimate interest or for marketing;
• Portability — receive your data in a common file format.

Send your request via WhatsApp or to [[FG_OF_PRIVACY_CONTACT]]. We respond within one month; for a complex request the law allows up to two months longer, and we'll tell you within the first month. To make sure it's you, we verify you via the WhatsApp number we have on file.

Not happy with how we handle your data? You always have the right to file a complaint with the Dutch Data Protection Authority.

11.Are you on a ChatBuild site?

In short: booked with or messaged a business that uses ChatBuild? Then that business is your point of contact.

Did you leave details on a website made with ChatBuild, or message a business owner who uses ChatBuild? Then that business owner is the controller for your data and we are only the processor. To view or delete something, contact that business — we then help the business carry out your request quickly.

12.Cookies

In short: chatbuild.com uses only necessary cookies by default.

Which cookies we set, why and for how long, is in the cookie policy. It also covers cookies on the websites we build for customers.

13.Changes

In short: if something important changes, you'll hear it from us — simply via WhatsApp.

We may update this policy, for example when we engage a new sub-processor. For important changes we inform you in advance via WhatsApp or email. The date of the latest version is always shown at the top.