Privacy Policy

This policy applies to two different people, and we're specific below about which one each section means:

• Account holders — the businesses and individuals who sign up for Chatmeo to build and operate a bot (referred to here as "you," "your bot").
• End users — the customers, visitors, or contacts who chat with a bot built on Chatmeo, whether through an embedded website widget or the business's chat link (which can be installed as an app).

If you're an end user chatting with a Chatmeo-powered bot, the business you're messaging is the one responsible for that conversation and its own privacy practices — Chatmeo processes that conversation on their behalf, as described below.

From account holders

From end users chatting with a bot

• Operate the service: run your bot's flows, generate replies, and deliver them over the channel a conversation came in on.
• Maintain your account: authentication, two-factor verification, password resets, service emails.
• Keep a conversation history so an account holder's inbox reflects what customers actually said.
• Enforce usage limits and prevent abuse of the platform.
• Improve reliability and fix problems — we look at aggregated usage and error data, not individual conversation content, for this.

When a bot uses an AI-generated response, the relevant conversation history and your configured system prompt are sent to a third-party AI provider — currently xAI (Grok) or OpenRouter, depending on how the bot is configured — to generate the reply. That provider processes the request and returns a response; it does not use your conversations to improve models we don't control, beyond whatever that provider's own terms specify.

Uploaded knowledge-base documents attached to an AI-enabled part of a flow are stored as extracted text and included the same way, only when relevant to generating a reply.

Both account holders and end users can turn on notifications for a device. When you do, your browser or device gives Chatmeo a push address, which we store only to send you notifications about your own conversations — a new message or a reply.

• Notifications are opt-in and per device; nothing is sent until you allow it.
• Notifications are delivered through your browser or device maker's push service (for example Google, Apple, or Mozilla), which carries the notification text to your device.
• Turning notifications off — in the chat, or in your browser or phone settings — stops them; a push address the push service reports as no longer valid is deleted automatically.

We share information only with the service providers that make Chatmeo work, under agreements that limit what they can do with it — never for advertising, and never sold.

We may also disclose information if required by law, or to protect the rights, safety, or property of Chatmeo, our users, or the public.

• Account and bot data is retained for as long as the account is active.
• Conversation history is retained so account holders can review it in their inbox, until the account holder deletes it or closes their account.
• Account holders can request deletion of their account and associated data by contacting us below.

• Passwords are hashed, never stored in plain text.
• Authenticator secrets are encrypted at rest (AES-256-GCM).
• Data in transit is encrypted (HTTPS/TLS).
• Optional two-factor authentication (email code or authenticator app) is available on every account.

No system is perfectly secure, but we design storage of anything sensitive — tokens, passwords, verification codes — around the assumption that a breach of the database alone shouldn't hand over anything usable.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing:

• If you're in the European Economic Area or United Kingdom, these rights are given to you under the General Data Protection Regulation (GDPR).
• If you're a California resident, you have similar rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we've collected and to request its deletion.
• Wherever you are, you can ask us what we hold about you, correct it, or ask us to delete it — we don't require you to prove a specific law applies before we'll act on a reasonable request.

To exercise any of these rights, contact us using the details in Contact us. We'll respond within 30 days.

Chatmeo is not directed at children, and account holders must be old enough to enter a binding agreement in their jurisdiction. We don't knowingly collect personal information from children through account registration.

Chatmeo is based in Nigeria, and the infrastructure and service providers we rely on — hosting, database, AI providers, push services — are located in other countries, including the United States. Your information may be processed outside the country you're in as a result. Where required, we rely on standard contractual protections and our providers' own compliance commitments to safeguard data that crosses borders this way.

If we make material changes to this policy, we'll update the effective date above and, where required, notify account holders directly.

Questions about this policy, or a request to access, export, or delete your data:

Chatmeo
novapixelstudios001@gmail.com
Port Harcourt, Nigeria