Privacy notice

Who we are

Chatsoro is operated by Archibald John Blades Collinson, a sole trader based in Arrawarra, New South Wales, Australia. In this notice, “we” and “us” means Archibald John Blades Collinson. You can reach us at contact@chatsoro.com.

For the information described here that we use for our own purposes, we are the organisation responsible for it, which some laws call the controller.

What this notice covers

This notice covers the chatsoro.com website, pilot requests, our customers’ account and billing details, and the Chatsoro chatbot that runs on this website.

When Chatsoro runs on another business’s website, that business decides what the chatbot is used for and is responsible for the information its visitors share. We handle that information on the business’s behalf, under our data processing addendum, and the business’s own privacy policy applies. This notice describes how that handling works, so visitors can see what happens to what they type.

Pilot requests sent through this website

When you send the pilot request form, your browser sends it directly to the Chatsoro application, where it is stored as a pilot request for us to review. It contains:

• your name, email address and business name
• your website address, unless you said your website is not live yet
• a message made up of the topic you selected, the plan and billing period you indicated, if any, and anything you chose to write
• the time it arrived, and a note that it came from this website

Your website address is stored for us to look at. The application does not fetch anything from your site unless you go ahead with a pilot. The details of your request are also emailed to us, through our email provider, so it is seen promptly. There is no automatic confirmation email to you; we reply to you personally.

Customers and billing

When you sign up for a plan on this website, we store your email address, business name, website address, the plan you chose and any notes you add for your chatbot, before you are sent to Stripe to pay, so your details are kept if you do not finish.

When your business becomes a customer, we keep the details needed to run your chatbot and your account: the names, email addresses and phone numbers of the people we deal with, your business and website details, your chatbot’s instructions and settings, the logo, documents and notes you give us, and our correspondence with you.

Subscriptions are paid through Stripe. Stripe collects and holds your card or bank details; we never see them in full. We receive what we need to manage the subscription: the billing name, email and address, the plan, payment dates and status, and the type and last digits of the payment method.

Information in chatbot conversations

Chatbot conversations are recorded against the chatbot they took place on, so that what visitors asked and what was answered can be reviewed with the business that runs it. A conversation record holds the messages, the page the conversation started on, the referring page, the browser’s user agent and a random visitor identifier. A conversation may include anything a visitor chooses to type.

To write an answer, the question, the conversation so far and the relevant parts of that business’s indexed content are sent to our AI model provider. Every chatbot tells visitors that its answers are generated by AI and may be inaccurate.

A visitor can choose to leave contact details, either when the chatbot offers to pass a question on or through the short contact form the widget offers. Depending on how the chatbot is set up, that can include a name, email address, phone number and company. They are saved as a lead with the conversation they came from, for the business that runs the chatbot.

Please do not type sensitive personal information into a chatbot. A chatbot is not a secure channel for medical, financial, identity or account details, and conversations may be reviewed by people working on the service.

The chatbot on this website

This website runs the Chatsoro chatbot, operated by us. It loads from the Chatsoro application, and when a page loads it fetches the chatbot’s settings from there, so the application receives ordinary request details such as your IP address and browser.

The chatbot does not set cookies. It stores nothing in your browser until you send it a message. Then it keeps a random visitor identifier and the identifier of your conversation in your browser’s local storage, so the conversation can carry on from page to page. This is strictly necessary for the chat you started, so we do not ask for separate consent. You can clear both by clearing this site’s data in your browser.

Anything you type into it is handled as described above for chatbot conversations, with us as the business that runs the chatbot.

Technical information

Like most websites and services, ordinary technical information is processed when pages and the chatbot are used. This includes request details such as an IP address, the browser and device reported by your software, and the pages or endpoints requested.

This is used to operate the service, to keep it available, and to apply rate limits and other abuse protections. Rate limits are counted against a salted hash of the IP address or the chatbot’s visitor identifier rather than the value itself. The pilot request form also contains a field people never see, which automated submissions tend to fill in; no third-party bot check is used.

This website does not use analytics or advertising trackers.

Why we use information, and our legal basis

We use information only for the purposes below. Where data protection laws such as the GDPR and UK GDPR apply, each purpose relies on the legal basis shown.

• Replying to enquiries and arranging pilots: taking steps you asked for before a contract, or our legitimate interest in answering business enquiries.
• Providing the service and managing subscriptions and payments: our contract with you.
• Running chatbots on customers’ websites: on the customer’s instructions, under the customer’s own legal basis.
• Keeping the service secure and preventing abuse: our legitimate interest in protecting the service and its users.
• Keeping billing and tax records: our legal obligations.

We do not sell personal information, and we do not use it to send unrelated marketing. Nobody is subject to a decision with legal or similarly significant effects made solely by automated means.

Who we share information with

We use the following providers to run Chatsoro. Each handles information only to provide its part of the service.

• Vercel, in the United States: hosting for this website and the Chatsoro application.
• OpenAI, in the United States: generating chatbot answers, and storing each chatbot’s indexed content so answers can draw on it. Chatsoro asks OpenAI not to store the answers it writes, and keeps conversations in its own database instead.
• A managed PostgreSQL database host: storing pilot requests, customer settings, conversations, leads and usage records. Its name and location are available on request.
• Resend, in the United States: delivering new pilot requests to us by email.
• Stripe: processing subscription payments. Stripe handles payment details under its own privacy policy.

We may also disclose information where the law requires it, to professional advisers under a duty of confidentiality, or to a new owner if the Chatsoro business is transferred, who would be bound by this notice.

Where information is processed

We are based in Australia, and our main providers process information in the United States. Information may also be processed in other countries where our providers operate. Where data protection law requires safeguards for these transfers, we rely on our providers’ data processing terms, including standard contractual clauses approved for that purpose.

How long information is kept

• Pilot requests, and sign-ups that are never paid for: 24 months after our last contact with you, then deleted, unless you become a customer.
• Customer accounts, chatbot content, conversations and leads: while the account is open, and deleted within 30 days of it closing. A customer can ask us to delete particular conversations or leads sooner.
• Usage records: 2 years.
• Billing and tax records: for as long as tax law requires, which in Australia is five years.
• Technical logs held by our hosting provider: for a short period set by that provider.

If you want information deleted sooner, ask and we will do it where there is no legal reason to keep it.

Security

Information travels over encrypted connections, and our providers encrypt it where they store it. Access to enquiry and conversation records is limited to the people who need it to run the service, behind a password-protected operations dashboard. Each chatbot’s content and records are kept separate from every other chatbot’s, and credentials for third-party services are held on the server, never in a browser.

No service can promise that information will never be exposed. Chatsoro does not claim any security certification it has not been through. If a breach puts your information at risk, we will tell you and the relevant regulator where the law requires it.

Your rights

You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, restrict how we use it, or provide it in a portable format. You can also object to how we use it. To make a request, email contact@chatsoro.com. We may need to confirm who you are, and we aim to reply within 30 days.

If your details were given to a chatbot on another business’s website, that business is responsible for them. Contact them first; we will help them answer your request.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to a regulator: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Union, the data protection authority in your country.

Children

Chatsoro is a business product and is not intended for anyone under 18. We do not knowingly collect information from children through this website. If you believe a child has submitted personal information, email contact@chatsoro.com and we will remove it.

Changes to this notice

This notice will be updated as the service develops. The effective date at the top of this page shows when the current wording took effect, and we will tell customers about material changes by email.

Contact

For anything relating to this notice, email contact@chatsoro.com. Chatsoro is operated by Archibald John Blades Collinson, a sole trader based in Arrawarra, New South Wales, Australia.