Your data rights

Your data, your control

The GDPR and similar laws give people rights over their personal data. Here is how those rights work with BizChat, and the tools you can use yourself.

Last updated: 20 October 2026

Who is responsible for what

For BizChat customers: CenoDigital (Pvt) Ltd is the controller of your account and billing data.

For website visitors: the business whose website you chatted on is the controller of your conversation and any details you shared. CenoDigital processes that data on their behalf under our Data Processing Agreement. Please contact that business first; we will help them respond.

Your rights

Available where the GDPR, UK GDPR or similar laws apply.

Access

Ask for a copy of the personal data we hold about you.

Rectification

Correct personal data that is inaccurate or incomplete.

Erasure

Ask us to delete your personal data, subject to legal record-keeping duties.

Portability

Receive your data in a machine-readable format.

Objection and restriction

Object to, or ask us to limit, certain processing.

Withdraw consent

Withdraw consent you have given, such as for marketing emails, at any time.

Self-service tools

Handle most requests yourself, straight from the dashboard.

Export your account data

Account page (/account)

Download the personal data linked to your user account.

Export your organisation

Settings

Download your organisation's data in a machine-readable format.

Delete your organisation or account

Settings and Account

Permanently delete an organisation and its data, or your user account.

Delete conversations

Inbox

Delete individual conversations, for example when a visitor asks you to erase their chat.

Set a retention period

Business plan

Automatically delete conversations older than the period you choose.

How we handle data

  • We don't sell personal data.
  • We don't use your content to train AI models. It is sent to the AI provider you choose (OpenAI or Anthropic) only to answer questions.
  • Data is encrypted in transit with HTTPS, and AI provider keys are stored encrypted.
  • Each customer's data is isolated from other customers.
  • Role-based access and an audit log help you control who can see and change data.

The service providers we use are listed in our Privacy Policy and DPA. CenoDigital is based in Sri Lanka; where the law requires it, we use safeguards such as standard contractual clauses for international transfers.

Need help with a request?

If you can't do what you need with the tools above, email us and we will respond within the time the law requires.