Privacy Policy

Account information. When you sign up or sign in, we collect your name and email address. If you set a password, we store only a hashed form of it, never the password itself. If you sign in with Google, we receive your name and email address from Google. We also keep basic account records such as your plan, usage counts and sign-in times.

Content you provide. Documents you upload (such as PDF and Word files) and the text extracted from them, and the content of websites you ask us to crawl. We fetch only the public web pages of the website address you submit.

Chat conversations. Messages sent to your chatbots — from your dashboard or from visitors using a chatbot embedded on your website — and the chatbot's replies.

Visitor contact details (lead capture). If a chatbot owner turns on lead capture, a visitor on their website may be offered a short form to share their name, email address and phone number. These details are saved only if the visitor fills in the form and agrees to share them, and they are shown only to that chatbot's owner in their dashboard.

Usage information. Information about how the Service is used, such as message counts, chatbot activity and error information, used to run the Service and enforce plan limits.

Payment information. Payments are processed by our payment providers (see section 6). We do not receive or store your full card number, UPI PIN or bank login details. We keep records of your payments, such as the plan purchased, amount, currency, status and the payment provider's reference IDs.

Support communications. Information you send us in support tickets or emails.

Technical information. Like most websites, our servers and hosting providers process technical data such as IP addresses and browser information when you connect, including for security and to prevent abuse (for example, rate limiting).

We use Google Analytics on our public website pages to understand how visitors use the site. It sets cookies and collects information such as the pages you visit, your approximate location, and your device and browser type. Google Analytics is not used inside the signed-in dashboard or on the password-reset page, and we do not use advertising cookies.

The Service also uses your browser's storage for essential functions:

• Local storage to keep you signed in (a login token) and to remember your light/dark theme preference.
• Session storage to keep a chat conversation going while a chat window is open. This applies to the chat widget on our site and on our customers’ websites.

Third-party services we load for specific features, such as Google Sign-In and our payment checkout, may set their own cookies under their own privacy policies.

• To provide the Service: creating and training your chatbots, answering chat messages from your content, and showing your dashboard and analytics.
• To manage your account, plan, usage limits and payments.
• To send service emails, such as sign-in codes, password resets, payment and account notices, and replies to support requests.
• To keep the Service secure, prevent abuse and fix problems.
• To comply with legal obligations.

We do not sell your personal information.

To answer a chat message, relevant parts of your uploaded or crawled content and the conversation are sent to a third-party AI model provider to generate the reply. These providers process the data to deliver the response under their own terms. Please do not upload content you are not permitted to share, or highly sensitive personal data.

Your data is stored with our hosting and infrastructure providers. Connections to our website and service use HTTPS. Passwords are stored only in hashed form. Access to administrative functions is restricted to authorised accounts.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your login details private and contact us if you believe your account has been compromised.

We use trusted third parties to operate the Service, and they process information on our behalf only as needed:

• Hosting and database providers, which store and serve our application and data.
• AI model providers, which generate chatbot replies (see section 4).
• Payment processors — Razorpay, and Stripe where offered — which process your payments.
• Google, if you choose Google Sign-In.
• An email delivery provider, for service emails.
• Google Analytics, for statistics about how visitors use our public website pages.
• A business messaging service, for internal operational alerts to our team. These may include basic account details such as your email address and plan, but never the content of chat conversations.

When you buy a paid plan, you complete payment through the payment processor's secure checkout. Your payment details are handled by the processor under its own terms and privacy policy. We receive confirmation of the payment and the related reference details listed in section 1.

If you place a Chitibot chatbot on your website, conversations with your visitors are processed and stored as described in this policy so they can be answered and shown in your dashboard. You are responsible for telling your website visitors how their chat messages are handled, for example in your own privacy policy.

If you turn on lead capture, you are the one collecting your visitors' contact details, and Chitibot stores them on your behalf. Use them only to respond to the visitor's request, keep them secure, and delete a lead from your dashboard when a visitor asks you to.

• You can delete your chatbots and documents from your dashboard at any time. Deleting a chatbot also deletes its knowledge index and its stored conversations. Deleting a document removes the uploaded file and its extracted text.
• To delete your account and associated data, email us at connect@chitibot.com. We will process deletion requests within a reasonable time.
• We keep account and content data while your account is active, unless you delete it earlier.
• We may keep limited records, such as payment and transaction records, where needed for accounting, tax, legal or fraud-prevention purposes.

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may withdraw consent where processing is based on consent. You can update your name and email from your account settings. For other requests, contact us at connect@chitibot.com. We may need to verify your identity before acting on a request.

The Service is intended for businesses and individuals aged 18 or older. It is not directed at children, and we do not knowingly collect information from children.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and for significant changes we may also notify you by email or in the Service.

For questions about this Privacy Policy, contact Satheesh Siva at connect@chitibot.com or visit our Contact page.