Privacy Policy
Last updated: August 4, 2026
Chatbu Privacy Policy
Last updated: 1 October 2026
This Privacy Policy explains how DATALONGA SOLUTIONS LTD (Company No. 16372088, United Kingdom), which operates the Chatbu platform ("Chatbu", "we"), processes your personal data. It is also our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. Who this policy covers
Covered. Businesses that open and use a Chatbu account and the members of their teams ("our customers"), visitors to chatbu.io and app.chatbu.io, and anyone who contacts us. We are the controller of this data.
Not covered. The data of people who talk to our customers' chatbots. We process that data on behalf of, and on the instructions of, the business that set up the chatbot: that business is the controller and we are its processor. Our Data Processing Agreement governs that processing. If you talked to a chatbot, see that business's privacy notice about your data and send your requests to that business. Requests that reach us are forwarded to the business concerned.
2. What data we process
- Account data: name, email address, phone number, password (only as a one-way bcrypt hash) and, if you sign in with Google or Apple, the identifier of that account.
- Team and business data: team and business name, team members and their roles, bot settings, opening hours.
- Content data: files you upload for your chatbots, web pages you add, Q&A entries and texts.
- Usage data: your chatbots' conversation history, token usage, session records.
- Payment and billing data: plan, billing address, company name and tax number (if you enter them), payment history. Card details are entered on and kept by Stripe; your full card number never reaches us.
- Contract records: the version of each agreement you accepted, the time of acceptance, IP address and browser information.
- Communications: your support requests and correspondence with us.
- Technical data: IP address, browser and device information, access times, error logs.
- Analytics data (only if you consent): your account identifier, name, email address, and which screens and features you use in the app.
How we collect it. Electronically, through the sign-up and payment forms, your actions in the app, email correspondence, cookies, and the services you connect (Google, Apple, Meta, Google Calendar).
3. Purposes and legal bases
| Purpose | UK GDPR (Art. 6) | KVKK (Art. 5) |
|---|---|---|
| Opening your account, verifying your identity, providing the Service (including generating your chatbots' answers from your content) | Performance of a contract — 6(1)(b) | Establishment or performance of a contract — 5(2)(c) |
| Managing your subscription, payments and invoices | Performance of a contract and legal obligation — 6(1)(b), (c) | Performance of a contract and legal obligation — 5(2)(c), (ç) |
| Service messages (verification codes, security alerts, invoices, changes to our terms) | Performance of a contract — 6(1)(b) | Performance of a contract — 5(2)(c) |
| Answering your support requests | Performance of a contract or legitimate interests — 6(1)(b), (f) | Performance of a contract or legitimate interests — 5(2)(c), (f) |
| Keeping the Service secure, preventing abuse and fraud, fixing errors | Legitimate interests — 6(1)(f) | Legitimate interests — 5(2)(f) |
| Aggregate usage statistics to improve the Service | Legitimate interests — 6(1)(f) | Legitimate interests — 5(2)(f) |
| Keeping records of the agreements you accepted and defending legal claims | Legal obligation and legitimate interests — 6(1)(c), (f) | Establishment, exercise or defence of a right — 5(2)(e) |
| Product analytics (Mixpanel) | Consent — 6(1)(a) | Explicit consent — 5(1) |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms; we will share that assessment on request. Where processing is based on your consent, you can withdraw it at any time (see section 8); this does not affect processing carried out before you withdrew it.
We do not make decisions that produce legal effects about you by automated decision-making or profiling.
4. AI processing
Chatbot answers are generated by AI models running on Amazon Bedrock in AWS regions of the European Union. Your content and chat data are not used to train AI models, neither by us nor by our model provider. The model service does not store prompts or answers and does not share them with the model developer. Where enabled in the service configuration, answers may alternatively be generated by OpenAI (EU / US); the default and primary provider is Amazon Bedrock. We only work with AI providers that do not use the data we send them to train their own models.
5. Who we share data with
- Our service providers (sub-processors): Amazon Web Services for hosting, databases, email and AI (OpenAI as an alternative AI provider where enabled in the configuration); Stripe for payments; Twilio and NETGSM for SMS and WhatsApp; Mixpanel for product analytics (only with your consent). The current list, with the purpose and location of each, is on our Sub-processors page: https://app.chatbu.io/sub-processors. Each provider is bound by written data protection obligations.
- Services you connect: when you connect Meta (WhatsApp, Instagram, Messenger), Google (sign-in and calendar) or Apple, the data the connection needs is shared with that service.
- Authorities: courts, regulators and law enforcement, where the law requires it.
- Corporate transactions: a buyer in a merger, acquisition or asset sale, on condition that it remains bound by the safeguards in this policy.
We do not sell your personal data or share it for advertising.
Google user data (Google Calendar integration)
When you connect a Google Calendar account to a chatbot, Chatbu accesses, through Google APIs, only the data needed for the appointment booking feature:
- Availability (calendar.freebusy): The time ranges in which your calendar is busy. Event titles, descriptions and attendees are not read.
- Event creation (calendar.events): Appointments booked through your chatbot are added to your calendar as events.
- Email address: To show you which Google account is connected.
This data is used only to offer available appointment times to your visitors and to add booked appointments to your calendar. Availability may be passed to our AI provider (Amazon Bedrock) solely to suggest open time slots; this provider does not use it for model training. Google user data is not sold, not used for advertising, not used to develop, improve or train generalized AI or machine learning models, and not shared with third parties for any other purpose. Your access credentials are stored securely; you can disconnect at any time from the Chatbu dashboard or revoke access from your Google account permissions. When you disconnect, your access credentials are deleted from our systems.
Chatbu's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. International transfers
We are established in the United Kingdom; the Service is hosted in the European Union (Frankfurt, AWS eu-central-1). Transfers between the United Kingdom and the European Economic Area rely on the adequacy decisions each has made for the other.
Where a service provider processes data outside these regions (for example Stripe's or Twilio's systems in the United States), the transfer relies on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or on the provider's certification under the EU-U.S. Data Privacy Framework.
If you use the Service from Türkiye, your data is processed abroad because the Service is provided from abroad. For this transfer we rely on the appropriate safeguards provided for in Article 9 of KVKK (including the Board's standard contracts) and make the required notifications.
7. Retention
| Data | Period |
|---|---|
| Account, team and content data, and conversation history | For as long as your account is open. When you delete a chatbot, its data is removed from the active systems immediately. When you delete your account, you can restore it within 30 days; at the end of that period all data is permanently deleted. |
| Working memory the AI uses to follow a conversation | Deleted 90 days after the conversation's last activity. |
| Payment and billing records | 6 years from the end of the financial year concerned (UK tax and company law). |
| Records of accepted agreements | 6 years after the account is closed (for possible disputes). |
| Support correspondence | 2 years after the request is closed. |
| System logs | 30 days. |
| Analytics data | 24 months, or until you withdraw consent and ask for deletion. |
| Backups | Deleted data leaves the encrypted backups within 30 days at the latest. |
At the end of the period, data is deleted or anonymised.
8. Cookies
- Strictly necessary cookies: session, sign-in and the record of your cookie choice. The Service needs them to work; they are always on.
- Analytics cookies: product usage statistics with Mixpanel (EU data residency). They are switched on only if you consent in the cookie banner.
- Marketing cookies: not used at present.
You can change your choice at any time with the "Cookie Preferences" button at the top of this page. The chatbot window embedded on our customers' websites uses no analytics or marketing cookies.
9. Your rights
Under the UK GDPR and the EU GDPR you have the right to access your data, to ask for it to be corrected or erased, to ask for processing to be restricted, to data portability, to object to processing based on legitimate interests, and to withdraw consent.
If you are in Türkiye, under Article 11 of KVKK you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of the processing and whether the data is used for that purpose; to know the third parties to whom it is transferred in Türkiye or abroad; to ask for it to be corrected if it is incomplete or inaccurate; to ask for it to be erased or destroyed under the conditions of Article 7 of KVKK; to ask for corrections and erasures to be notified to the third parties to whom it was transferred; to object to a result against you arising exclusively from analysis by automated systems; and to claim compensation for damage caused by unlawful processing.
How to make a request. Write to support@chatbu.io from the email address registered to your account, or write to the address in section 12. We may need to verify your identity. We answer free of charge within 30 days at the latest.
Complaints. You can complain to the Information Commissioner's Office in the United Kingdom (ico.org.uk), to the data protection authority of your country in the EU, or, in Türkiye, to the Personal Data Protection Board after first applying to us.
10. Age limit
The Service is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. If we become aware of such data, we delete it.
11. Changes
When we update this policy we change the date above. We notify significant changes by email or in the app before they take effect.
12. Contact
- Controller: DATALONGA SOLUTIONS LTD (the company that operates the Chatbu platform), Company No. 16372088
- Address: 338a Regents Park Road, Office 3 and 4, London, N3 2LN, United Kingdom
- Email: support@chatbu.io