Privacy Policy

• Visitor / Prospect: Interacts with our public-facing surfaces without an authenticated account. ChatBucket operates as an independent data controller for all session, analytics, and contact data collected in this context.
• User (Developer / Merchant Admin / Operator): Holds an authenticated ChatBucket account and interacts directly with the platform, APIs, or dashboard. ChatBucket is the data controller for account, usage, telemetry, support, and billing data.
• Customer (Merchant / Developer Organisation): A business entity under a commercial agreement with ChatBucket. ChatBucket is the data controller for personal data we independently collect about the Customer's authorised representatives.
• End User (processed on behalf of a Customer): A natural person whose personal data is ingested into ChatBucket's processing infrastructure by a Customer through our platform interfaces or APIs. In this context, ChatBucket operates exclusively as a data processor acting under the Customer's documented instructions, governed by our Data Processing Agreement (DPA). The Customer retains the role of data controller and bears primary compliance accountability for the lawfulness of that processing.

• Visitors / Prospects: Individuals browsing our website, developer documentation, or marketing surfaces
• Users: Authenticated individuals operating ChatBucket's platform, SDKs, APIs, or mobile applications
• Customers (Merchant / Developer Orgs): Authorised company contacts administrators, developers, billing contacts, and technical liaisons
• End Users of Customer Deployments: Natural persons whose conversational data traverses ChatBucket's AI processing infrastructure via a Customer's integration. ChatBucket processes this data strictly as a sub-processor; the originating Customer remains the data controller accountable under applicable law.
• Enquirers: Any individual who submits data via a contact form, support ticket, or direct privacy correspondence
• Candidates: Job applicants whose personal data is provided in the context of a recruitment process
• Third-party sourced data: Identity verification results from authorised KYC partners, enriched contact data from B2B intelligence services where lawfully permitted, and telemetry signals relayed by cloud infrastructure, CDN, and communications sub-processors bound by data processing agreements.

• Consent (Art. 6(1)(a)): Where you have freely given, specific, informed, and unambiguous consent for example, when subscribing to marketing communications or enabling optional analytics integrations.
• Contractual Necessity (Art. 6(1)(b)): Where processing is required to perform a contract to which you are party, including account provisioning, platform delivery, billing, and API access management.
• Legal Obligation (Art. 6(1)(c)): Where we are subject to a binding legal duty including KYC/AML obligations, tax record-keeping, court orders, or regulatory disclosure requirements.
• Legitimate Interests (Art. 6(1)(f)): Where processing is necessary for purposes that are not overridden by your fundamental rights including fraud prevention, platform security, abuse detection, and service analytics. We conduct a Legitimate Interests Assessment (LIA) / balancing test before relying on this basis for any non-trivial processing activity.

Data You Actively Provide

• Identity & Contact: Full name, verified email address, phone number, postal address, organisation name, and professional role
• Account & Credential Data: Username, hashed authentication credentials, MFA configuration, and user preference state
• KYC / AML (when mandated): Government-issued identity document details, biometric liveness samples, proof-of-address documentation, and sanctions-screening outcomes
• Financial / Billing: Billing contact details, invoice records, and payment instrument metadata. ChatBucket does not store Primary Account Numbers (PANs) or full card credentials at any layer of its infrastructure.
• Developer & Integration Configuration: API key identifiers, Webhook endpoint URIs, OAuth scopes, and third-party channel integration settings
• Conversational & Content Data: Messages, media attachments, and structured data payloads transmitted through your ChatBucket-powered agents. ChatBucket does not use Customer or End User conversational data to train shared foundation models without explicit, opt-in contractual consent.
• Support & Communications: Helpdesk tickets, feature requests, survey responses, and inbound correspondence

Data Generated Automatically

• Log & Device Telemetry: IP address, device fingerprint, OS and application version, screen/page views, HTTP referrers, error traces, and crash diagnostics
• Platform Observability Data: API call volumes and latency distributions, SDK initialisation events, authentication event streams, agent resolution rates, and infrastructure reliability metrics collected to maintain the operational integrity and performance SLAs of the platform.
• Security & Fraud Signals: Anomalous access pattern indicators, brute-force detection events, IP reputation signals, and immutable audit trail records
• Approximate Location: Coarse geolocation inferred from network IP or device locale settings, where permitted by user configuration
• Voice / Media Streams (feature-specific): When voice, video transcription, or accessibility features are active, we transiently process the media payload necessary to deliver the feature.

Data Received from Authorised Sub-Processors

• Identity Verification Partners: KYC verification outcomes, document authenticity scores, and AML screening results
• Payment & Financial Infrastructure: Transaction status signals and reconciliation metadata (never full PANs)
• Cloud, Security & CDN Providers: Service delivery telemetry from AWS (primary compute), Cloudflare (edge security), and Google Workspace
• Connected Third-Party Integrations: Data exchanged with messaging platforms, CRM systems, and e-commerce connectors that you explicitly authorise

ChatBucket may derive aggregated, irreversibly de-identified analytics from platform usage data for product development and performance benchmarking.

Cookie Classification

You may configure browser-level cookie controls or use our in-platform preference manager at any time. Disabling non-essential cookies does not affect your ability to use core ChatBucket features. Visit allaboutcookies.org for independent guidance.

• Provisioning, operating, and continuously improving the ChatBucket platform and its conversational AI runtime
• Managing account lifecycles, subscription entitlements, and platform access authorisation
• Delivering timely, context-aware technical and customer support
• Conducting quantitative and qualitative research including A/B experimentation, agent resolution benchmarking, and model quality assessments to advance the reliability and intelligence of the platform
• Verifying user and merchant identity and operationalising fraud prevention, abuse detection, and AML compliance controls
• Discharging legal and regulatory obligations including KYC/AML requirements, tax record-keeping, and mandatory regulatory reporting
• Asserting and enforcing contractual rights under our Terms of Service and Data Processing Agreements
• Transmitting service-critical communications including security incident notifications, API deprecation alerts, policy change disclosures, and platform status updates through authenticated, permission-scoped notification channels

• With Your Explicit Consent: We disclose personal data to third parties only where you have provided a clear, affirmative, and freely revocable authorisation.
• Authorised Sub-Processors: Cloud compute infrastructure (AWS India ap-south-2, Hyderabad), edge security and CDN (Cloudflare), and internal productivity tooling (Google Workspace). All sub-processors are vetted, contractually bound by a Data Processing Agreement, and listed in our public Sub-Processor Register. We provide 30-day advance notice of material sub-processor changes.
• KYC / Identity Verification Partners: Verification data is transmitted exclusively to RBI-authorised identity verification providers for the limited purpose of identity authentication and AML screening.
• Payment & Financial Infrastructure Partners: Only tokenised payment status signals and reconciliation metadata are exchanged. Full card PANs are never transmitted to or stored within ChatBucket's systems.
• Legal & Regulatory Authorities: Disclosure to competent legal authorities where compelled by valid court order, statutory obligation, or to protect the life, safety, or fundamental rights of individuals.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or divestiture, personal data may be transferred as part of the transaction subject to (i) advance notice to affected users, (ii) data continuity assurances, and (iii) the successor entity's assumption of equivalent privacy obligations.

• Active Service Tenure: Personal data is retained for the full duration of your active account or subscription relationship and for the period required to deliver contracted services.
• Post-Termination Operational Buffer: A minimum 60-day retention window applies following account termination, providing a recovery period for dispute resolution, final billing reconciliation, and statutory audit trails.
• KYC / AML Records: Identity verification records are retained for a statutory minimum of 5 years post-account closure, in compliance with PMLA and equivalent requirements.
• Conversational Payload Data: End-user message data processed through the ChatBucket runtime is subject to a 90-day rolling retention window by default, configurable by the Customer in their DPA supplement. End-to-end encrypted messaging payloads are not stored server-side beyond the in-flight processing window.

At the expiry of each applicable retention window, personal data is subject to secure, irreversible deletion or technical anonymisation through a verified data destruction protocol.

Cross-Border Transfer Mechanisms

• EU / UK: Transfers to third countries rely on European Commission-approved Standard Contractual Clauses (SCCs, 2021 edition) and the UK International Data Transfer Addendum (IDTA).
• California (CCPA): Downstream sub-processors serving California residents are contractually required to honour all CCPA consumer rights and maintain equivalent privacy standards.
• India (DPDP Act 2023): KYC and sensitive personal data is stored exclusively within Indian sovereign territory. All other processing adheres to data-minimisation and proportionality principles under DPDP Act obligations.
• China (PIPL): Where ChatBucket processes personal information of Chinese data subjects, we obtain required statutory consents and rely on PIPL-compliant cross-border transfer mechanisms, including standard contracts approved by the CAC.

• Encryption in Transit: TLS 1.3 is enforced across all API endpoints, dashboard interfaces, and Webhook delivery channels. Downgrade attacks to TLS 1.2 or below are blocked at the edge.
• Encryption at Rest: AES-256 encryption is applied to all persistent data stores, encrypted backup volumes, and KYC document archives.
• Zero-Trust Access Controls: Production system access is governed by role-based access control (RBAC) implemented on a principle of least privilege. Privileged access requires just-in-time (JIT) authorisation, session recording, and mandatory MFA including hardware security keys for engineering staff with database access.
• Continuous Security Assurance: We conduct quarterly penetration testing by independent security researchers, monthly automated vulnerability scanning, and continuous SAST within our CI/CD pipeline.
• Incident Response & Breach Notification: ChatBucket maintains a documented incident response plan with defined escalation paths. In the event of a personal data breach meeting the GDPR notification threshold, we notify the relevant supervisory authority within 72 hours of confirmed detection and affected individuals without undue delay.
• Privacy by Design: New platform features and infrastructure changes undergo mandatory privacy impact review before deployment, ensuring that data protection obligations are embedded at the architectural level.
• Employee Security Training: All staff with access to personal data complete annual data protection and information security training.

• Customers are independently responsible for establishing and maintaining a valid lawful basis for all personal data processing activities they orchestrate through ChatBucket's infrastructure.
• Where ChatBucket acts as data processor, our obligations including sub-processor management, security controls, breach notification timelines, and data subject request facilitation are codified in the executed Data Processing Agreement (DPA). Customers who require a DPA should contact hello@chatbucket.business.
• Customers must implement privacy notices that accurately describe ChatBucket's role as a processing sub-contractor and obtain all legally mandated consents from their end users before routing personal data through the platform.
• ChatBucket accepts no liability for a Customer's independent data controller obligations, including non-compliant data collection, unlawful secondary processing, inadequate notice provision, or failure to honour data subject rights arising outside the scope of our contracted services.