Privacy Policy

1. About this policy

This policy applies to Chatzora at chatzora.com, the Chatzora Android app, and our agent and messaging services. Chatzora is operated by Muhammad Usama and provides tools for account holders to manage AI agents and customer conversations. For privacy questions, contact support@chatzora.com.

If you speak with an agent operated by another business, that business decides what information to collect and how to use it. Contact that business about your conversation or lead information; we process that information to provide its Chatzora service.

2. Information we process

• Account information: Email address, account identifier, profile information you provide, authentication credentials, and sign-in information from Google if you choose Google sign-in.
• Workspace content: Agent configuration, uploaded knowledge files, website content you ask us to retrieve, text, embeddings, conversation history, replies, feedback and usage records.
• Customer information: Names, email addresses, phone numbers, company details and other lead or message information submitted to an agent. Connected channels may provide channel-specific identifiers and audio messages.
• Billing information: Subscription, order and payment status and billing identifiers. Lemon Squeezy handles checkout and payment details; Chatzora does not directly store full card details.
• Device and technical information: Device push tokens if you enable notifications, app and operating-system information, error reports, network/request information used to operate and protect the service, and authentication or session identifiers. Service providers can process IP addresses and infer an approximate region from network requests; this does not require GPS or precise-location permission.
• Support and integrations: Support requests, connected-account identifiers, integration credentials, and records exchanged with the services you choose to connect.

3. Why we use information

We use information to sign you in, provide agents and conversation management, retrieve knowledge, generate AI responses and embeddings, deliver enabled notifications and service emails, process subscriptions, respond to support requests, and protect and diagnose the service. We use workspace activity and usage records to show account analytics and enforce plan limits.

4. Providers and connected services

We do not sell personal information. Our service providers include Supabase for authentication, database and stored workspace content; Vercel for web hosting, website usage analytics and performance measurements; Resend for email; Lemon Squeezy for billing; Sentry for error diagnostics; and Expo and Google Firebase Cloud Messaging for Android push delivery. These providers receive the information needed for their functions.

Relevant message history, instructions and knowledge excerpts are sent to the configured AI provider to generate responses or embeddings. Supported configurations include OpenAI, OpenRouter, Groq, Google Gemini and GitHub Models for supported embedding configurations. Audio features on connected channels may send audio to the configured transcription provider. Provider availability depends on your account configuration.

When configured, Firecrawl retrieves and processes website content at the URLs you submit as knowledge sources. Only submit URLs and content you are authorized to use.

When you connect channels or integrations, relevant records are exchanged with the chosen provider, such as Meta/WhatsApp, Telegram, HubSpot, Shopify, WooCommerce, Slack, Discord or your configured webhook endpoint. Copies held by a connected service are governed by that service and may need to be deleted there separately.

Providers may process information outside your country. Their locations and retention practices depend on the service and configuration. Information may also be disclosed where required by law or to protect the service and the rights and safety of others.

5. Notifications, local storage and diagnostics

Android notifications require your permission. Expo and Firebase process a push token and notification payload, which can include an agent name, an alert about activity and identifiers used to open the relevant conversation. Notification previews may be visible on your lock screen. You can change notification permissions in Android settings.

The website uses cookies or browser storage for sign-in, security, preferences and conversation continuity. The Android app stores its sign-in session and registered push token using device secure storage. Disabling essential browser storage can prevent sign-in.

Sentry receives filtered error reports to diagnose web and app failures. Our configuration disables session replay and performance tracing and filters user profiles, authentication details, request bodies and conversation breadcrumbs. Error reports can still contain technical details such as stack traces and software versions; service providers also process network information needed to receive requests. We do not use these reports for advertising.

6. Security and retention

When you report unsafe content, we store your account identifier, the report reason, review status and references to the conversation and any selected message. We do not create an extra copy of the message text in the report. Authorized Chatzora staff can inspect the related conversation to review the report manually. Reports are removed when the associated account or conversation is deleted.

We use encrypted network connections, authentication, database access policies and server-side authorization to protect service data. No system can guarantee absolute security. Please keep your credentials private and upload only information you are authorized to provide.

We retain active account and workspace records while needed to provide the service. You can remove supported records through the dashboard or delete your Chatzora account. Once account deletion completes, we remove your active Chatzora account and its associated workspace records and uploaded files. Deletion is permanent and also affects access from the website and Android app.

Billing providers may retain invoices or transaction records for legal obligations. Limited records may be retained where necessary for security, resolving disputes or complying with law. Backup copies age out under the relevant provider backup schedules rather than disappearing immediately. Copies already sent to connected services are subject to their retention policies.

7. Your choices and requests

You can update available account settings, disconnect integrations, manage notification permission and request access, correction or deletion of personal information. Additional rights, including objection, restriction, portability or a complaint to your local regulator, may apply depending on your location and our legal obligations.

Start an account deletion at chatzora.com/delete-account or use the deletion option in the Android app settings. If you cannot sign in, use the contact option on that page. We verify ownership before deleting an account. For other privacy requests, email support@chatzora.com. For data held by an agent owner, contact that business so the request can be applied to the correct workspace.

8. Children and policy changes

Chatzora is intended for business account holders and is not directed to children. Do not knowingly submit children's personal information without the authority and safeguards required by applicable law. Contact us if you believe a child's information was submitted improperly.

We update this policy as the service changes and publish the updated date here. Where required, we provide additional notice of material changes.