Summary: ChatMox AI ("we", "us", "our") is committed to protecting your privacy. We collect only what we need, we never sell your data, and we never use your data to train AI models. This policy explains exactly what we collect, why, and how you can control it.
1. Information We Collect
1.1 Account Information
When you register for ChatMox, we collect your name, email address, company name, and a hashed password. We use this information solely to authenticate you, communicate with you about your account, and provide the service.
1.2 Usage Data
We automatically collect certain information when you use ChatMox, including:
- IP address and approximate geographic location
- Browser type, version, and operating system
- Pages visited within the dashboard and time spent
- Features used and actions taken within your account
- Error logs and crash reports
1.3 Chat Widget Data
When visitors interact with your ChatMox chat widget, we collect conversation transcripts, visitor IP addresses (for rate limiting and fraud detection), and session metadata. This data is tied to your tenant account and processed on your behalf.
1.4 Knowledge Base Content
Any documents, website content, or files you upload to train your bot are stored securely in your tenant's isolated storage environment. This content is only accessible by you and the AI model assigned to your plan.
1.5 Billing Information
Payment card details are processed and stored by our third-party payment processor (Stripe). ChatMox never stores raw credit card numbers. We retain billing records including transaction amounts, dates, and plan details.
2. How We Use Your Information
We use your information only for the following purposes:
- Service delivery: Providing, operating, and improving ChatMox
- Authentication: Verifying your identity and securing your account
- Customer support: Responding to your inquiries and resolving issues
- Product improvements: Analyzing aggregated, anonymized usage patterns to improve features
- Billing: Processing payments and sending invoices
- Legal compliance: Meeting our obligations under applicable law
- Security: Detecting and preventing fraud, abuse, and security incidents
We never: sell your data to third parties, use your knowledge base content or conversations to train AI models, or share your data with advertisers.
3. Data Storage & Security
Your data is stored in SOC 2 Type II certified data centers. We apply the following security controls:
- AES-256 encryption at rest for all stored data
- TLS 1.3 encryption in transit for all API and dashboard traffic
- Multi-tenant data isolation: your data is logically separated from all other tenants
- Role-based access controls limiting employee access to customer data
- Regular third-party penetration testing
- Automated vulnerability scanning and intrusion detection
4. Data Retention
We retain your data for as long as your account is active or as needed to provide the service. Specific retention periods:
- Account data: Retained until you delete your account, plus 30 days for backup recovery
- Conversation history: Retained per your plan (30/90 days or unlimited)
- Knowledge base content: Retained until you delete it or close your account
- Billing records: Retained for 7 years as required by tax law
- Usage logs: Retained for 90 days for security and debugging purposes
Upon account deletion, all data except legally required billing records is permanently deleted within 30 days.
5. Third-Party Services
We use a limited set of trusted third-party services to operate ChatMox:
- Stripe: Payment processing (PCI DSS Level 1 compliant)
- Google (Gemini API): AI model inference (your content is processed but not retained by Google for training)
- Anthropic (Claude API): AI model inference (subject to Anthropic's API usage policy)
- Amazon Web Services: Cloud infrastructure and data storage
- Cloudflare: DDoS protection and CDN
We have Data Processing Agreements (DPAs) with all sub-processors. We do not permit them to use your data for any purpose other than providing services to us.
6. Your Rights (GDPR & CCPA)
Depending on your location, you have the following rights regarding your personal data:
- Right of access: Request a copy of all personal data we hold about you
- Right to rectification: Correct inaccurate personal data
- Right to erasure: Delete your personal data ("right to be forgotten")
- Right to portability: Export your data in a machine-readable format (JSON or CSV)
- Right to restrict processing: Limit how we use your data
- Right to object: Object to certain processing activities
- Right to opt out of sale: We don't sell data, but you can request confirmation
To exercise any of these rights, use the data export feature in your account settings or submit a request through our contact form. We will respond within 30 days.
8. Children's Privacy
ChatMox is not intended for use by children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, contact us immediately through our contact form and we will delete it promptly.
9. International Data Transfers
ChatMox is operated from the United States. If you are accessing ChatMox from the European Economic Area (EEA), United Kingdom, or Switzerland, your data may be transferred to and processed in the United States. We ensure this transfer is legal by:
- Participating in the EU-U.S. Data Privacy Framework
- Using Standard Contractual Clauses (SCCs) approved by the European Commission
- Maintaining Data Processing Agreements with all EU-based customers
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email and post a notice in your dashboard at least 14 days before the changes take effect. Your continued use of ChatMox after the effective date constitutes acceptance of the updated policy.
11. Contact Us
For any privacy-related questions, requests, or concerns:
For EU/EEA inquiries, you may also contact your local data protection authority.