Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, password hash, and your profile name and picture if you sign in with Google.
• Organisation data: organisation name, members, roles and plan.
• Content you upload: documents and website pages you add as knowledge sources for your chatbots.
• Conversation data: messages exchanged with your chatbots, and visitor details such as IP address, browser user agent and the page the chat was opened on.
• Lead data: name, email and phone number that your website visitors choose to submit through the chat.
• Usage and log data: feature usage, AI reply counts, API calls and error logs.
• Payment information: payments are handled by Stripe or PayHere. We do not receive or store full card numbers; we keep subscription status and billing records.

2. How We Use Your Information

We use personal data to:

• Provide the Service, including signing you in, indexing your content and generating chatbot answers.
• Process payments and manage subscriptions.
• Send transactional emails such as password resets, invitations and billing notices.
• Understand how the Service is used so we can improve it.
• Detect and prevent fraud, abuse and security incidents.
• Comply with legal obligations, such as tax and accounting records.

3. AI Processing

To answer a question, relevant parts of your content and the visitor's message are sent to the AI provider used by your chatbot (OpenAI or Anthropic). We don't use your content to train AI models, and it is sent to the AI provider only to answer questions.

If you bring your own OpenAI or Anthropic API key, requests are made with your key and are also subject to your own agreement with that provider.

4. Legal Basis for Processing

Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to secure, maintain and improve the Service and prevent abuse.
• Consent: where we ask for it, for example optional marketing emails.
• Legal obligation: for tax, accounting and lawful requests.

5. Sub-processors and Data Sharing

We do not sell personal data. We share it only with service providers that help us run the Service:

• Our hosting provider: servers that run the Service and store its data.
• OpenAI and Anthropic: AI processing to generate chatbot answers.
• Stripe and PayHere: payment processing.
• Resend: transactional email delivery.
• Google: optional sign-in with Google.
• Our CDN/DNS provider: delivering the website and protecting it from attacks.

6. Other Disclosures

We may disclose personal data where required by law or valid legal process, and only to the extent required. If CenoDigital is involved in a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy.

7. Data Retention

We keep personal data for as long as your account is active or as needed to provide the Service. You can delete conversations at any time, and on the Business plan you can set a retention period so older conversations are deleted automatically.

When you delete your organisation or account, we delete the associated data, except records we must keep for legal, tax or accounting reasons.

8. Security

We protect your data with measures including:

• Encryption in transit using HTTPS.
• Encrypted storage of AI provider API keys.
• Isolation of each customer's data from other customers.
• Hashed passwords.
• Role-based access within each organisation and an audit log of important actions.
• Signed webhooks so you can verify deliveries come from us.

9. Your Rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. You can use the self-service tools described on our Your Data Rights page (/gdpr), or email [email protected]. You may also complain to your local data protection authority.

If you are a visitor to a website that uses BizChat, the business running that website controls your conversation data. Please contact them first; we will help them respond.

10. International Transfers

CenoDigital is based in Sri Lanka, and our service providers may process data in other countries. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses, for these transfers.

11. Cookies

We use cookies and similar browser storage only where needed for the Service to work, such as keeping you signed in and remembering your theme preference. The chat widget stores a visitor ID in the browser so a conversation can continue across pages. We do not use advertising or cross-site tracking cookies.

12. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will tell you by email or in the dashboard before they take effect.

14. Contact

For privacy questions or to exercise your rights, email [email protected]. CenoDigital (Pvt) Ltd, Sri Lanka.