Privacy Policy
Last updated: 16 October 2026
1. Introduction
BobOffice, LLC, operator of ChatSales ("ChatSales", "we", "us"), runs the websites chatsales.app and my.chatsales.app and related services (the "Service"). This Privacy Policy explains how we collect, use, disclose and protect personal data when you use the Service. For the contacts and conversations you manage in ChatSales, you are the controller and we act as your processor under our Data Processing and Security Addendum.
2. Information we collect
2.1 Information you provide
- Account information: name, email, phone number, company name and billing details when you register or subscribe.
- Communication data: messages, files and media you send or receive through the Service, including WhatsApp Business API, Instagram and Messenger messages.
- Support requests: information you give us when you contact support.
- Payment information: card details and billing addresses, processed by our payment processor (Stripe); we do not store full card numbers.
2.2 Information collected automatically
- Usage data: pages visited, features used, actions taken, timestamps and session duration.
- Device data: IP address, browser, operating system and device identifiers.
- Log data: server logs, error reports and API call metadata.
- Cookies: as described in Section 8.
2.3 Information from third parties
- Meta (WhatsApp, Instagram, Messenger): data provided through Meta's official APIs for your connected channels, including advertising referral data (ad ID and title) when a customer writes from an ad.
- Sign-in providers: profile information from Google or other identity providers you use to sign in.
- Integrations you connect: data from tools you link (for example forms, e-commerce or payment apps), only as you configure.
3. How we use your information
- Provide, operate, maintain and improve the Service.
- Process payments and send billing information.
- Send transactional notices (account confirmations, technical notices, security alerts).
- Respond to support requests.
- Analyse usage to improve the product.
- Detect and prevent fraud, abuse and unauthorised access.
- Comply with legal obligations and enforce our terms.
- Send marketing communications where you have opted in; you can opt out at any time.
We never sell personal data and never share it for third-party advertising.
4. Legal basis for processing (GDPR and similar laws)
| Purpose | Legal basis |
|---|---|
| Providing the Service and performing our contract with you | Contract (GDPR Art. 6(1)(b)) |
| Processing payments | Contract (Art. 6(1)(b)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
| Analytics and product improvement | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
5. Data storage and security
Your data is stored on Amazon Web Services (AWS) infrastructure. We apply industry-standard technical and organisational measures, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control, multi-factor authentication for administrative access, monitoring and regular security assessments, on cloud providers certified to SOC 2 and ISO 27001. Details: Data Processing and Security Addendum. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
6. Data retention
- Account data: for the life of your account and up to 30 days after deletion, unless the law requires longer.
- Contacts and messages in your account: while your account is active; deleted within 30 days after the service ends or on request. You can export them at any time.
- Billing records: up to 7 years, for tax and accounting obligations.
- Logs and analytics: up to 12 months.
7. Third parties we share data with
Only as needed to run the Service: cloud infrastructure (AWS, Google Cloud), Meta (WhatsApp, Instagram, Messenger APIs), our AI model provider (OpenAI, only where AI is enabled), AI service hosting (Render), website and security (Cloudflare), payments (Stripe), analytics (Google Analytics), and authorities when required by law. Each must protect personal data under applicable law and our instructions. Full list: sub-processors.
8. Cookies and tracking
- Strictly necessary: session and authentication.
- Performance and analytics: how visitors use the website.
- Functional: your preferences, such as language.
- Marketing: only with your consent.
You can manage cookies in your browser settings. Disabling some cookies may affect how the Service works.
9. Your rights
Depending on where you live, you may have the right to: access your data; rectify it; erase it; restrict or object to processing; receive it in a portable format; withdraw consent; and complain to your data protection authority. In Mexico these include the ARCO rights; in Brazil, the data subject rights under the LGPD; in California, the rights to know, delete, correct and opt out of sale or sharing (we do not sell or share). Email info@chatsales.app; we answer within 30 days. If your request concerns data a ChatSales customer manages about you, we will forward it to that customer, who controls it.
10. International data transfers
Your data may be processed outside your country, including in the United States and Hong Kong. Where required, we use appropriate safeguards, such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent mechanisms under other laws.
11. Children
The Service is not directed at anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy. We will post the new version with its date and, for material changes, notify you by email or in the Service.
13. Contact
BobOffice, LLC (ChatSales) · info@chatsales.app · WhatsApp +1 302 314 2292 · chatsales.app