Legal
What we collect, why, where it lives, and how to get rid of it. Short version: your visitors' messages pass through us to a model provider, we keep them for you, and you can delete them whenever you like.
Last updated 22 September 2026 · This is a plain-language draft and not yet reviewed by a lawyer. It will be before launch.
Two different relationships run through this product, and it matters which one you are in.
For your ChatBrace account — your email, your billing details, your settings — we are the controller and this policy governs it.
For the conversations your visitors have with your chatbot, you are the controller and we are your processor. We act on your instructions, we do not decide what to do with that data, and our Data Processing Agreement sets out the terms.
Deliberately little.
To generate an answer we send your knowledge text and the visitor's message to a large language model provider. That provider is named on our sub-processor list, which we keep current, and we notify account holders before it changes.
We do not permit providers to train models on your data. Where a provider offers a zero-retention endpoint, we use it.
Our infrastructure is in the European Union, so data stays in the EU by default. Where a model provider processes data outside the EU, that transfer is covered by Standard Contractual Clauses and disclosed on the sub-processor list.
Conversations are kept until you delete them, or automatically after the retention window you set. Account records are kept while your account is open and for as long afterwards as tax law requires of us. Delete your account and conversation data goes with it.
If you are in the EU or UK you can ask for a copy of your data, correction, deletion, restriction, or portability, and you can object to processing. Write to privacy@chatbrace.com and we will respond within 30 days.
If your visitor asks you to delete their conversation, you can do it yourself from your dashboard without contacting us.