Privacy Policy

1. Introduction

Chatsettu ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our AI agent platform.

2. Information We Collect

From Business Owners (Clients):

• Name, email address, and business name during signup
• Website URLs, documents, images (a menu or price-list photo, for example — we keep only the text read from it, after you check it) and text you provide for AI training
• Branding images — the logo and welcome banner, if you choose to upload them for your chat
• Payment records — online payments are processed by our payment gateway, Razorpay, when enabled; otherwise plan upgrades and add-ons are arranged manually over email (UPI/bank transfer). Card and UPI credentials never pass through or are stored on our servers; we keep only a record of each payment (amount, date, plan or add-on, and the gateway's reference).
• Notification email preferences and, if you turn on WhatsApp Lead Alerts, the WhatsApp mobile number you give us and the date you agreed to receive them. If you turn on phone notifications, we also keep a secret delivery address for each device you enable (from your browser's push service) and your notification choices, until you turn them off or sign out on that device
• Hostel and PG owners who use the Hostel Register: the names, mobile numbers, room numbers, course and year of the students you add, the PINs we generate for them, and a record of each time a student goes out and comes back (time, reason, who noted it), plus the name, email and hashed password of each warden you add (and, if you choose, a warden's WhatsApp number, which you confirm the warden agreed to). A warden sees only the hostel(s) you give them, and — unless you switch it on for that warden — cannot add or change students, see their PINs or download the lists. If you switch on the students' page, a student types their own mobile number and PIN on that page to see their own status and to send a request to go out; the page shows a student only their own first name and trips, remembers nothing on our servers between visits, and keeps the number only in that student's own browser. You are responsible for adding only residents who know about the register; Chatsettu acts on your instructions and only to run the register for you. Late alerts and the daily roll-call note are e-mailed, with the names and rooms of the students concerned, to the owner and the wardens of that hostel, and the phone notification to the owner carries only counts. Out / In records are deleted automatically after the period you choose (3, 6 or 12 months, 6 by default); students you remove from the list and wardens you delete are deleted with the account
• Mess / tiffin owners who use Meal Check-in: the names, mobile numbers, places (hostel, PG or office) and meal choices of the members you add, and the "I'll eat" / "Skip" answers they give. You are responsible for adding only people who know and agree; we use this only to count meals for you and never to message those people. Members you remove are deleted together with their answers
• If you use the Ad Planner: the short description you type (what you sell, your city, your goal and budget) and whether you let it use your agent's knowledge, the plans it makes, and the names, links and spend amounts of the ads you track. A lead's ad is recorded only when a customer used that ad's link or QR
• Information you add to Chatsettu's business tools: contacts you import as leads, appointments, internal notes, staff accounts (name, email, and a hashed password) with their task and attendance records, and Business Diary entries (see section 5)

From End Users (Visitors chatting with your AI agent):

• Chat messages and conversation history
• Phone numbers and emails voluntarily shared, and the name, service, and time of any appointment they book
• Files they choose to upload in chat — these are relayed to the business owner's email and are not stored permanently by us
• Voice input is optional: if a visitor taps the 🎤 button, their browser turns the speech into text using its own speech service (in Chrome, that is Google). Chatsettu never receives or stores the audio — only the text that appears in the message box, which the visitor can edit before sending
• If a mess uses Meal Check-in, a member who opens that mess's check-in page types their mobile number (and a PIN if the mess asks for one) so the mess can count them for each meal. The number is only compared with the list the mess already holds, nothing is stored when it does not match, and the page remembers the number in that member's own browser only so they do not have to type it again
• Session identifiers (no personal identification)
• Spam protection: to stop bots flooding a business with messages, a visitor's internet (IP) address is used to limit how fast chat and "talk to a human" requests can be sent. For "talk to a human" chats we keep only a one-way scrambled (salted hash) form of it, not the address itself, so a business can count repeat requests and block a spammer; nobody can read the address back from it.

3. How We Use Your Information

• To provide and improve our AI agent services
• To send lead notifications to business owners
• To generate daily analytics reports
• To send follow-ups and appointment reminders on a business owner's behalf, by email or (where the business has set it up) SMS
• To show a business owner their own Business Diary totals, charts, and CSV exports — and, only if they switch on AI entry, to sort the text they type into diary entries
• To warn you by email when your message balance is running low or has run out
• To maintain platform security
• To communicate important service updates

4. Data Storage & Security

Your account, leads, and chat data are stored securely on MongoDB Atlas cloud servers. Website content for AI training is stored in Pinecone vector database. Logo and welcome-banner images you upload are stored with Cloudinary, an image-hosting service. Business Diary entries are kept in a separate, private PostgreSQL database, apart from your chatbot data. We implement industry-standard security — encryption, HTTPS, hashed passwords, and access controls.

5. Business Diary

The Business Diary is an optional add-on. It stores the income and expense entries you type in — date, amount, category, and an optional party name and note.

• Diary data is visible only to your owner account — never to staff accounts or to other Chatsettu clients.
• It is used only to show you your own totals, charts, and CSV downloads.
• Saved diary entries, totals, and charts are not shared with any third party and are never sent to an AI service. We do not use your diary data to train any AI model.
• AI entry (optional, off until you switch it on): if you turn it on, the text you type into the AI box is sent to OpenAI so it can be sorted into entries. Before sending, Chatsettu hides phone numbers, bank account numbers, Aadhaar, PAN, UPI IDs, and emails, but names and amounts you type are sent as written. Nothing is saved until you review and confirm it. We do not store the text you type into the AI box — only the entries you confirm are saved (plus a simple per-day counter of AI requests, to limit usage). OpenAI handles that text under its own terms. You can switch AI entry off at any time from the diary page.
• Please do not enter bank account numbers, PAN, Aadhaar, or passwords in diary notes.
• Entries are kept as long as your account exists — including after a free trial or paid access ends, so you can still view and download them — and are deleted when your account is deleted.

6. Data Sharing

We do NOT sell your data. We only share with:

• OpenAI — for AI response generation and understanding chat messages, for reading text out of an image you choose to upload as training material (a menu or price-list photo) — the picture is sent to OpenAI only for that reading, is not stored by Chatsettu, and you review the text before it is saved — for the Ad Planner (the description you type, your business type and address/timings, and — unless you switch it off on the Ad Planner page — the services, prices and offers from your agent's knowledge base, all with phone numbers and e-mail addresses removed first), and for the optional Business Diary AI entry (only the text you type into the AI box, after you switch it on)
• Your browser's speech service (for example Google, in Chrome) — only if a visitor taps the 🎤 voice button in a chat. This is the visitor's own browser sending their voice for transcription, under that provider's privacy policy; the audio does not pass through Chatsettu
• Your browser's push service (Google, Apple, Mozilla or Microsoft, depending on your browser) — only if a business owner turns on phone notifications. It delivers short alerts to the owner's own device — a lead's first name, an appointment time, or "a customer is waiting in live chat" — never phone numbers or chat messages. The alerts are encrypted so the push service cannot read them
• Pinecone — for storing knowledge base vectors
• Cloudinary — for storing and delivering the logo and welcome-banner images a business uploads for its chat. These images are shown to everyone who opens that business's chat, so please upload only images you are happy to be public. Nothing else is sent to Cloudinary — not chat messages, leads, diary entries, or files visitors attach in a chat
• Brevo — for sending email notifications, follow-ups, and reminders
• WhatsApp "Continue on WhatsApp" button — only if a business owner turns it on. After a visitor has shared a phone number, the chat shows a button that opens WhatsApp on the visitor's own device with a message already typed (the AI assistant's name, the business, the visitor's name and what they asked for). Nothing is sent by Chatsettu; the visitor chooses whether to press Send, and what happens next is between the visitor and the business on WhatsApp, under WhatsApp's own terms and privacy policy. We do not record that the button was pressed
• WhatsApp (Meta) — only if a business owner turns on WhatsApp Lead Alerts. For each new lead we send a short message to the owner's own WhatsApp number through the WhatsApp Business Platform, containing the lead's name, phone number and a one-line summary (such as the table number or order); for mess owners using Meal Check-in it can also carry the daily plate count (numbers only, no member names). It is never sent to the lead or to any other customer — including the members of a mess. Hostel owners can also receive, and give a warden's number to receive, a short WhatsApp message when students are late or at roll call — it carries only the hostel's name and counts, never a student's name or number. Meta handles it under its own terms and privacy policy
• MSG91 — for delivering SMS, only if a business uses SMS follow-ups or appointment reminders (the recipient's mobile number and the message text are shared for delivery)
• Razorpay — our payment gateway, once online payment is enabled
• Render — our hosting provider (including the Business Diary database); also used for temporary caching of common AI answers (no phone numbers or emails are ever cached, and cached answers auto-expire within 24 hours)

7. Cookies

We use session cookies to keep you logged in. The chat widget uses localStorage for session continuity. We do not use tracking or advertising cookies.

8. Your Rights

• Access your data anytime via dashboard
• Delete any individual AI agent (and its knowledge, leads, and chat history) yourself, anytime, from your dashboard
• Request deletion of your entire account and all associated data — email chatsettu@gmail.com and we'll process it within a few days
• Request an export of your leads and chat data — email chatsettu@gmail.com
• Download your Business Diary entries as a CSV yourself, anytime, and edit or delete individual entries from the diary page — and switch AI entry off whenever you like
• Opt out of daily email reports and lead alerts anytime — clear the notification email field in your dashboard and save

9. Data Retention

Leads, appointments, Business Diary entries, and account/billing data are retained as long as your account is active. If you delete your account, all data will be permanently deleted within 30 days.

Logo and banner images stay on Cloudinary until you remove them, delete the AI agent, or your account is deleted — at which point we delete them from Cloudinary as well.

Ad Planner: your plans, tracked ads and spend entries are kept while your account is active and are deleted when you delete the agent they belong to or your account.

Mess Meal Check-in: the member list and settings are kept while your account is active. Members' daily answers and the daily summary records are deleted automatically after 60 days.

Hostel Register: the student list and warden accounts are kept while your account is active; Out / In records are deleted automatically once they are older than the retention period you set for that hostel (3, 6 or 12 months, 6 by default). Removing a hostel hides it, and its records are deleted on the same schedule. If you delete your account, everything in the register is deleted with it.

Raw chat message transcripts (the individual back-and-forth text of each conversation) are kept for 30 days and then automatically deleted — dashboard statistics and any leads captured from those conversations are not affected and remain available for the life of your account.

10. Contact Us

Email: chatsettu@gmail.com

Website: https://chatsettu.in