Version 1.1. In force from (to be completed: publication date). Last updated: 20 October 2026.
For the emails, CRM data and store data you connect, ChatStaff acts as a processor: we process them only to run the work you set up. For your account and the use of the website, we are the controller. This page details the data, purposes, retention periods, sub-processors and your rights. The French version of this policy prevails.
1. Who we are and how to contact us
ChatStaff is a service published by Startbiz LLC, a limited liability company under the laws of the United Arab Emirates, with its registered office at (to be completed: address), Dubai, United Arab Emirates ("we").
- Privacy contact: contact@chatstaff.app
- Representative in the European Union (article 27 GDPR): (to be completed: name, address and email). You can send any request to our representative or directly to us.
- Data protection officer: we have not appointed one, as it is not mandatory for our processing (to be verified).
2. Two distinct roles
Controller. We determine the purposes and means of the following processing:
- management of accounts, organisations and Users;
- billing;
- support;
- security of the service;
- public website and audience measurement;
- service communications.
Processor. When our customer connects their Gmail mailboxes, their calendar, their HubSpot CRM, their store (Shopify, WooCommerce, PrestaShop), their WordPress site or their Meta accounts, the customer is the controller of the data they contain, including data about their contacts. We process it on their behalf, on their instructions, under the Data Processing Agreement (article 28 GDPR). If you are a contact of one of our customers, please address your requests to that customer first. We will help them answer.
3. Data processed
| Category | Examples | Role |
|---|---|---|
| Account and identity | name, business email address, organisation, role, Google profile photo if provided, preferences | Controller |
| Authentication and security | session identifiers, sign-in logs, IP address, browser type, security events, staff access keys | Controller |
| Billing | company name, billing address, VAT number, billing contact, invoice history. Card data is processed by Stripe and never shared with us | Controller |
| Support | exchanges with support, logged support actions and access | Controller |
| Website and audience measurement | pages viewed, journeys, device, approximate country, without direct identification data. Only after your consent | Controller |
| Data connected by the customer | metadata and content of emails in authorised labels, attachments useful to the file, calendar events, selected HubSpot contacts, companies, deals and properties, store products, inventory and orders, website posts, posts and statistics of Meta Pages and accounts (sections 5 to 11) | Processor |
| Data produced by the service | files, extracted facts with their source, drafts, proposals, approvals, action history, the User's writing style profile | Processor |
| Usage and credits | credit consumption, operations performed, technical costs | Controller and processor |
We do not ask for special categories of data (article 9 GDPR). Our customers undertake not to process such data with the service, unless agreed in writing.
4. Purposes and legal bases (processing for which we are the controller)
| Purpose | Legal basis |
|---|---|
| Create and manage the account, provide the subscribed service | Performance of the contract (article 6.1.b) |
| Invoice, collect payment, keep accounts | Performance of the contract and legal obligation (articles 6.1.b and 6.1.c) |
| Ensure security, prevent fraud and abuse, keep logs | Legitimate interest in protecting the service and our customers (article 6.1.f) |
| Support and service communications (Free plan, billing, incidents, changes) | Performance of the contract and legitimate interest |
| Improve the service from aggregated and anonymised statistics | Legitimate interest |
| Audience measurement of the website and the application | Consent (article 6.1.a), which can be withdrawn at any time |
| Commercial information about our offers sent to business contacts | Legitimate interest, with the option to object at each message |
| Answer requests from authorities, defend our rights | Legal obligation and legitimate interest |
For the data we process as a processor, the legal basis is the responsibility of the customer as controller.
No decision producing legal effects or significantly affecting you is made solely on the basis of automated processing (article 22 GDPR). The agents prepare proposals. A human approves sends and external writes, except only the reversible fields the customer has expressly allowed to be updated automatically.
5. Google data
Data from Google services. When you connect a Google account (Gmail, Google Calendar, Google Drive, Search Console, Google Analytics), ChatStaff only accesses the data needed for the task you ask your agents to do. This data is used only to prepare the work you approve in the application; it is never sold, never used for advertising, and never used to train general-purpose artificial intelligence models. No email is sent and no event is created without your approval.
| Service | Permission | Use |
|---|---|---|
| Gmail | gmail.readonly | Read messages to find your customers' requests and prepare a reply, only for a task you ask for |
| Gmail | gmail.compose | Create drafts and, after you click "Approve", send the reply you approved |
| Google Calendar | calendar.readonly | Read your availability to suggest real time slots |
| Google Calendar | calendar.events | Create or move an event, only after your approval |
| Google Drive | drive.readonly | Read the documents you point to (price list, terms of sale) |
| Google Drive | drive.file | Save in your Drive the documents prepared by ChatStaff, and only those |
| Google Analytics | analytics.readonly | Read your website traffic, read only |
| Search Console | webmasters.readonly | Read the search performance of your website, read only |
| Google account | openid, email | Identify the connected Google account |
With "Sign in with Google", we receive your name, your email address and, if you have one, your profile photo.
Storage and retention. Access tokens are encrypted and stored in our production databases (section 14). Data read is kept as described in section 12.
Revocation and deletion. You can disconnect a service at any time in Settings › Connected tools, which removes our access. You can also remove access from the Security page of your Google account (myaccount.google.com/permissions). To delete data already processed, follow the Data deletion page.
Limited Use. ChatStaff's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- we use Google data only to provide and improve the user-facing features of the service the User has turned on;
- we do not transfer it to third parties, except to provide these features, to comply with the law, for security, or as part of a merger or acquisition with prior notice;
- we do not use it for advertising, to build advertising profiles, or to resell it;
- we do not use it to train general-purpose artificial intelligence models;
- no member of our staff reads this data, except with the User's explicit consent for specific messages, for security reasons, to comply with the law, or when the data is aggregated and anonymised for internal operations.
6. Artificial intelligence
Model provider. The excerpts needed for a task are sent to our artificial intelligence model provider, DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China), through its business API. It is never a whole mailbox. We minimise the data sent and mask secrets. The use of data sent through the API and its retention are governed by the terms of the DeepSeek API platform (to be verified: no use for model training and the retention period actually applicable).
Agent improvement. So that our agents learn from their mistakes, we collect anonymous signals, for example that a piece of work was found too long or that the tone did not fit. These signals contain neither your texts nor your customers' data. This processing is based on our legitimate interest. You can object at any time in Settings › Privacy, with the "Help improve ChatStaff" setting. Raw signals are kept 90 days; the anonymised lessons drawn from them are kept. Signals linked to your account are deleted with it. We train no model on our customers' data.
7. HubSpot data
Data read. With the HubSpot app or connection, your agents read the contacts, companies, deals, owners and list of contact properties linked to your files, and HubSpot quotes if you allow it. Requested permissions: oauth, crm.objects.contacts.read, crm.objects.contacts.write, crm.objects.companies.read, crm.objects.deals.read, crm.objects.deals.write, crm.schemas.contacts.read, crm.objects.owners.read and, optionally, crm.objects.quotes.read. We do not ask to write to companies.
Why. To prepare follow-ups, pipeline reviews and CRM updates. Writes (notes, contact fields, stage, amount or date of a deal) only happen after your approval.
Storage and retention. Access tokens are encrypted. Data read and work produced are kept in our production databases (section 14), as described in section 12. The HubSpot app also keeps your portal identifier and the hash of its installation token.
Revocation and uninstall. Uninstall the app in HubSpot, or disconnect HubSpot in Settings › Connected tools: the installation is deactivated, tokens are deleted and access is revoked. Your work stays in ChatStaff until it is deleted, as described on the Data deletion page.
8. Shopify data
Data read. With the Shopify app, your agents read the products, the orders of the last 60 days, the inventory levels and the locations of your store. Requested permissions: read_products, read_orders, read_inventory, read_locations, plus write_products and write_discounts. Orders may contain personal data of your customers (name, address, order content): for this data, you are the controller and we act as a processor (section 2).
Why. To flag orders to watch, low stock and incomplete product pages, and to prepare customer replies, promo codes, search titles and descriptions and the weekly summary. ChatStaff changes your store only after your approval (search titles, promo codes): write_products is only used to apply an approved title or description, write_discounts only to create an approved promo code. No price and no order is ever changed. The app is billed through Shopify, at the same prices as on our Pricing page.
Storage and retention. The store access token is encrypted. The app keeps the store address (*.myshopify.com) and the hash of its installation token. Data read and work produced are kept in our production databases (section 14), as described in section 12.
Revocation and uninstall. Uninstall the app in the Shopify admin (Settings › Apps). Shopify notifies ChatStaff: the installation is deactivated, tokens are deleted and the store connection is revoked. Your work stays in ChatStaff until it is deleted, as described on the Data deletion page.
9. WordPress and WooCommerce data
Data read. Right after installation, the WordPress or WooCommerce plugin sends its access to ChatStaff; it keeps the site address and an installation token, never displayed. With the WooCommerce plugin, your agents read the products and orders of the store, which may contain personal data of your customers (section 2). If you connect WordPress.com (WordPress.com sites or sites connected through Jetpack), WordPress.com grants access to the one site you choose: your agents read posts and create drafts.
Why. To prepare pages and posts as drafts, product listings, customer replies and sales reviews. Nothing is published and no order is changed.
Storage and retention. The access sent is encrypted; only the hash of the installation token is kept. Data read and work produced are kept in our production databases (section 14), as described in section 12.
Revocation and uninstall. Deactivate then delete the plugin in WordPress: the installation is deactivated and access removed. You can also disconnect WordPress.com or WooCommerce in Settings › Connected tools. Your work stays in ChatStaff until it is deleted, as described on the Data deletion page.
10. PrestaShop data
Data read. Right after installation, the PrestaShop module creates a Webservice key and hands it to ChatStaff. With this key, your agents read the orders, products, stock, customers and categories of your store. Orders and customers contain personal data: for this data, you are the controller and we act as a processor (section 2).
Why. To prepare promotions, product search optimisation, customer replies, a store summary and message drafts. Every action on the store and every message waits for your approval.
Storage and retention. The Webservice key is encrypted; only the hash of the installation token is kept, with the store address. Data read and work produced are kept in our production databases (section 14), as described in section 12.
Revocation and uninstall. Uninstall the module in PrestaShop, or delete the Webservice key in PrestaShop (Advanced parameters › Webservice): access is removed. Your work stays in ChatStaff until it is deleted, as described on the Data deletion page.
11. Meta data
Data read. When you connect Facebook, Instagram, Meta ads or WhatsApp Business, ChatStaff only accesses what you authorise in the Meta window:
- Facebook Pages: the list of Pages you choose, their posts and statistics (
pages_show_list,pages_read_engagement), and publishing as the Page (pages_manage_posts); - Instagram: the professional account linked to a Page (
instagram_basic) and content publishing (instagram_content_publish); - Meta ads: ad accounts, campaigns and statistics (
ads_read), campaign management (ads_management,business_management,pages_manage_ads); - WhatsApp Business: account management and sending messages (
whatsapp_business_management,whatsapp_business_messaging,business_management), and the messages your customers send to your business number.
We never ask for access to the messages of your Pages or Instagram account, to your personal profile or to your groups.
Why. To prepare your posts, follow their results, prepare your campaigns and replies to your customers. Every post, every campaign or budget change and every message goes out only after your approval.
Storage and retention. Meta issues a token of about 60 days, encrypted and stored in our production databases (section 14). Data read and work produced are kept as described in section 12.
Revocation and deletion. Disconnect the service in Settings › Connected tools: the stored token is deleted. Also remove ChatStaff in your Facebook settings (Settings and privacy › Settings › Business integrations). To delete data already processed, follow the Data deletion page or write to contact@chatstaff.app.
12. Retention periods
| Data | Period |
|---|---|
| Account and Users | duration of the contract, then deletion within 30 days after the end of the export period |
| Imported email content and attachments | as long as strictly needed to handle the file, at most 90 days (to be confirmed) after the file is closed, a period the customer can shorten |
| Files, sourced facts, drafts, action history | duration of the contract, then 30 days for export, then deletion |
| References needed to resolve an action with an unknown outcome | until resolved, at most 90 days (to be confirmed) after the end of the contract |
| Audit log | 12 months (to be confirmed) after the event, or the duration of the contract if longer, up to 3 years |
| Security and sign-in logs | 12 months (to be confirmed) |
| Technical logs and error traces | 90 days (to be confirmed) |
| Anonymous agent improvement signals | 90 days; the anonymised lessons drawn from them are kept |
| Audience measurement | at most 13 months (to be confirmed) after collection |
| Cookie consent choices | 6 months, then asked again |
| Exchanges with support | 3 years after the last exchange |
| Business contacts (prospects) | 3 years after the last contact |
| Invoices, credit notes and accounting records | 10 years, in a separate space without business content |
When an organisation is deleted, a 14-day period allows cancellation. Access to connected services is then revoked and data deleted according to this table. Backups are overwritten according to their rotation cycle, at most 35 days (to be confirmed).
13. Recipients and sub-processors
Your data is accessible:
- to our authorised staff, within the limits of their duties, with strong authentication and logging of support access;
- to our service providers.
The list of our providers, their role, the data concerned and their location is on the Sub-processors page (in French).
Google, HubSpot, Shopify, WordPress.com, WooCommerce, PrestaShop, Meta and the other services you connect are not our sub-processors. They are your own providers, and their privacy policies apply. Stripe also acts as a separate controller for some purposes of its own, such as fraud prevention and its regulatory obligations.
We do not sell your personal data.
14. Location and transfers outside the European Union
Our production databases are hosted in the European Union (to be completed: country). Some processing nevertheless involves a transfer outside the European Union:
- access by Startbiz LLC, established in the United Arab Emirates, for operations and support;
- some providers established in the United States, listed on the Sub-processors page;
- our artificial intelligence model provider DeepSeek, established in China, for the excerpts needed for a task only.
These transfers are governed by the standard contractual clauses adopted by the European Commission (decision 2021/914) and, where the provider is certified, by the EU‑US Data Privacy Framework. They come with additional measures: encryption in transit, encryption of access tokens, minimisation and access control. A copy of the safeguards can be obtained on request from the privacy contact.
15. Security
We apply technical and organisational measures suited to the risk:
- isolation of each organisation's data;
- encryption of communications and of access tokens to connected services;
- role-based access control;
- strong authentication of staff;
- audit log;
- human approval of external actions;
- backups;
- incident management procedure.
These measures are detailed on the Security page (in French). No measure can, however, guarantee absolute security.
In the event of a personal data breach, we notify the competent authority when we are the controller, and inform the people concerned when the law requires it. When we are a processor, we inform the customer concerned within the time limits set by the Data Processing Agreement.
16. Your rights
Under the conditions set by the GDPR, you have the following rights:
- right of access, rectification and erasure;
- right to restriction of processing and to portability;
- right to object to processing based on our legitimate interest;
- right to withdraw your consent at any time, without affecting the lawfulness of prior processing;
- right to set instructions about your data after your death, where French law applies.
To exercise them, write to contact@chatstaff.app or to our representative in the European Union. To delete your account, your organisation or the data of a connected tool, follow the Data deletion page. We may ask you to prove your identity in case of reasonable doubt. We answer within one month, which may be extended by two months for complex requests.
You can lodge a complaint with the supervisory authority of your country of residence, of work or of the place of the alleged infringement. In France, it is the Commission nationale de l'informatique et des libertés (CNIL), www.cnil.fr.
Any User can also revoke at any time the service's access to their Google account, from the service or from the security settings of their Google account.
17. Cookies and audience measurement
We use no audience measurement cookie and no non-essential tracker before your consent. Audience measurement is done with PostHog, hosted in the European Union, without direct identification data, with masking of fields and content. Details are in the Cookie policy (in French).
18. Minors
The service is intended for professionals and adults; it is not intended for minors.
19. Changes
We may change this policy. The date of the last update is shown at the top of the page. Any substantial change is announced to customers by email or in the service before it takes effect.
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | (to be completed: publication date) | First publication |
| 1.1 | 20 October 2026 | Sections Google, HubSpot, Shopify, WordPress and WooCommerce, PrestaShop and Meta data; Data deletion page |