Chatti Privacy Policy

Welcome to Chatti ("we," "us," or "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application, website, and services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you agree to the terms of this Privacy Policy. If you do not agree with the terms, please do not access or use the Service.

This Privacy Policy should be read in conjunction with our Terms of Service.

Where the General Data Protection Regulation (GDPR) or similar laws apply, we process your personal data only when we have a valid legal basis. The bases we rely on are set out below.

Contract: We process personal data to perform the contract you have with us, including creating and managing your account, delivering the Service, and processing your prompts and outputs through our AI providers.

Legitimate interests: We process personal data for our legitimate interests, including keeping the Service secure, preventing fraud and abuse, and improving and developing the Service. We balance these interests against your rights and freedoms.

Consent: Where we rely on consent, we process personal data only after you give it. This includes non-essential analytics, error monitoring, and marketing emails. You can withdraw your consent at any time.

Legal obligation: We process and retain certain data, such as payment and transaction records, to comply with our legal and tax obligations under Tunisian law.

We may collect information about you in a variety of ways. The information we may collect via the Service includes:

Personal Data You Provide to Us: We collect personally identifiable information, such as your name, email address, profile picture, and any other information you voluntarily give us when you sign in with Google or GitHub or otherwise interact with the Service (e.g., contacting support). We use OAuth and do not receive or store your Google or GitHub password.

User Content: We collect the content you create, upload, or post to the Service, such as messages, photos, or other materials ("User Content"). Messages are stored until you delete them or your account, and are not end-to-end encrypted. While we have the technical ability to view messages, we do not actively monitor or moderate user messages unless required by law or for safety investigations. Your messages remain private between you and your AI assistant.

Information Collected Automatically: When you access or use the Service, we may automatically collect certain information, including:

• Log and Usage Data: IP address, browser type, operating system, access times, pages viewed, actions taken within the app, and error logs.
• Device Information: Information about the computer or mobile device you use to access the Service, such as the hardware model, operating system version, unique device identifiers, and mobile network information.
• Cookies and Tracking Technologies: We may use cookies, web beacons, pixel tags, and other tracking technologies to collect information about your interaction with the Service. See the Cookies and Tracking Technologies section below for more details.

Payment card details are entered directly with our payment provider, Flouci, and are handled by that provider. We do not receive or store your full card details.

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Service to:

• Create and manage your account.
• Provide, operate, and maintain the Service.
• Improve, personalize, and expand the Service.
• Understand and analyze how you use the Service.
• Develop new products, services, features, and functionality.
• Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the Service, and for marketing and promotional purposes (where permitted by law and subject to your opt-out rights).
• Process your transactions through our payment provider Flouci.
• Find and prevent fraud and abuse.
• Ensure security and integrity of the Service.
• Comply with legal obligations and enforce our terms and policies.

When you use AI features, your prompts and the resulting outputs are sent to third-party model providers so they can generate a response. We route these requests through OpenRouter.

We do not train our own models on your conversations, and we do not sell your conversations. Your messages remain private between you and your AI assistant and are not used for advertising.

We prioritize model providers that do not retain your prompts and outputs or train on them, and we prefer providers that offer such commitments. We cannot guarantee the practices of every third party, so we encourage you to review the applicable provider's terms and our Subprocessors list.

We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

• With Service Providers: We may share your information with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work (e.g., cloud hosting, data analytics, payment processing through Flouci, customer support tools). These providers are obligated to protect your data.
• By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• With Your Consent: We may disclose your personal information for any other purpose with your consent.
• Aggregated or Anonymized Data: We may share aggregated or anonymized information that does not directly identify you.
• User Content Sharing: Your messages are private between you and the AI assistant and are not shared by us unless required by law or for safety investigations. We do not sell or share your messages with third parties for any commercial purposes.

Our service providers fall into the following categories: hosting and infrastructure, file storage, caching and rate limiting, AI inference, web search, payments, analytics, error monitoring, feedback, and email. See our Subprocessors for the named list.

The following table lists the third-party subprocessors that Chatti uses to operate the Service, the purpose each one serves, and where each processes data.

We will notify you by email or in-app notification before we add a new subprocessor, so you have an opportunity to review the change. If you object, you may stop using the Service and close your account. We will update this section when the list changes.

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). The table below summarizes our main retention periods. Some providers listed in our Subprocessors may apply their own retention periods.

You can delete your account and selected data from Settings → Account → Danger Zone. On confirmation you immediately lose access, your sessions are revoked, and you cannot sign in or create a new account with the same email until the request completes (within 30 days). Selected categories are deleted immediately; unselected categories are retained but disassociated from your identity.

To request a copy of your data, use 'Request data export' in Settings → General. We prepare your export and notify you when it is ready, within 30 days.

Backups are purged on their normal cycle (within 90 days). Payment and transaction records are retained for 10 years as required by Tunisian law.

Depending on your location and applicable law (e.g., GDPR for EU residents, CCPA for California residents), you may have certain rights regarding your personal information. These may include the right to:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Restrict Processing: Request restriction of processing of your personal information.
• Object to Processing: Object to our processing of your personal information (e.g., for direct marketing).
• Data Portability: Request a copy of your personal information in a structured, commonly used, machine-readable format.
• Withdraw Consent: Withdraw your consent at any time where we rely on consent to process your information.
• Opt-Out of Marketing Communications: You may opt-out of receiving promotional communications from us by following the unsubscribe instructions provided in those communications or by contacting us directly.

To exercise these rights, please contact us using the contact details provided in the Contact Us section below. We may need to verify your identity before processing your request. We will respond to your request within 30 days of receipt.

You have the right to lodge a complaint about our processing with a supervisory authority. In Tunisia this is the Instance Nationale de Protection des Données Personnelles (INPDP). If you are in the European Union or the United Kingdom, you may complain to your local supervisory authority.

In the past 12 months, we have collected the following categories of personal information: identifiers (such as name and email address); commercial information (such as payment and transaction records); internet or network activity (such as usage and log data); and inferences drawn from the above. We use these categories for the purposes described in this Privacy Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. To exercise your rights, please see the "Your Data Rights and Choices" section above or contact us at [email protected].

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorized parties. Therefore, we cannot guarantee complete security if you provide personal information. We implement encryption in transit (HTTPS/TLS) and at rest (via our hosting and storage providers), secure authentication through Supabase, and access controls to protect your data.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and the affected users without undue delay, where required by applicable law. We will describe the nature of the breach and the steps we are taking in response.

Your information, including personal data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. If you are located outside Tunisia and choose to provide information to us, please note that we transfer the data, including Personal Data, to Tunisia (where we are established), to the European Union (our database is hosted in Frankfurt, Germany), and to the United States (our file storage and most of our service providers operate there), and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with our providers' data processing agreements. You can contact us at [email protected] for more information.

Our Service is not directed to individuals under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to remove that information from our servers. If you believe that we might have any information from or about a child under 16, please contact us using the details below.

We use cookies and local storage to operate the Service, keep you signed in, remember your preferences, and understand how the Service is used. For the full list, including provider privacy links, see our Cookie Policy. We use the following categories:

• Essential: Supabase Auth session cookies required to keep you signed in through OAuth.
• Functionality (local storage): your color mode, language (i18n_locale), sidebar state, selected AI model, and your edits to interactive components such as generated charts and tables.
• Analytics: PostHog product analytics. Session recording is disabled.
• Error monitoring: Sentry, which collects errors only. Session replay is disabled.
• We do not use advertising cookies, and we do not use Cloudflare's analytics.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. We may provide additional notice (such as adding a statement to our homepage or sending you a notification) if we make material changes.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

For privacy and data-protection requests, contact us at [email protected].