Privacy Policy

1. Who is responsible

ChatHive is operated by Paulo Marques, operating as ChatHive, in British Columbia, Canada. Paulo Marques is ChatHive's privacy officer. Privacy questions and requests go to contact@chathive.ca.

There are two roles:

• Customers. For the account, billing and team information of the people who sign up, ChatHive is responsible for the information.
• Visitors. When a visitor chats on a customer's website, the customer decides why and how that visitor's information is collected. ChatHive processes it on the customer's behalf to run the chatbot. Visitors should contact the business whose chatbot they used first.

2. Information we collect

From customers and their team:

• Account details: name, email address, the language you use ChatHive in (so our emails to you are written in it), a password (stored only as a one-way hash), and an optional profile image.
• Company details: company name and website address, chatbot settings (name, colours, language, image), and the documents and topics you upload, with the text extracted from them and numerical representations of that text (embeddings) used to find relevant passages.
• Your landing page, when you ask us to: ChatHive reads the single web page whose address you gave us (never the links on it) and keeps its text, and numerical representations of it, so your chatbot can answer from it. The visit is made by a crawler called ChatHiveBot, at most once a day.
• Team members you invite: name, email address, time zone and availability for meetings.
• Plan and billing records: plan, status, billing dates, message usage per period and top-up purchases. Card details are handled by Stripe and are not stored by us; we keep Stripe's customer and subscription identifiers.
• Technical, diagnostic and security logs about service use and errors. These logs may include IP addresses, timestamps, request details and device or browser information collected by our hosting provider or infrastructure, even if ChatHive's application code does not directly read all of those fields. The precise fields and retention periods depend on the services and logging configuration in use.

From visitors, depending on how the customer set up the chatbot:

• Chat messages. Conversation text is retained for up to 24 hours to allow the conversation to continue. For usage counts and statistics, we retain message role (visitor or chatbot), message length and timestamp. If a visitor becomes a lead by providing contact details, the visitor's messages from that conversation, but not the chatbot's replies, may also be saved with the lead so the customer can understand the enquiry. Customers must ensure they have an appropriate legal basis and provide any required notice for this use. ChatHive processes this information on the customer's behalf and retains it with the lead until the lead is deleted, subject to the retention and deletion rules in this policy.
• Contact details a visitor gives the chatbot (lead): name, email address, phone number and reason for contact.
• Meeting details when a visitor books a meeting: name, email address, phone number, time zone, subject and time.
• The chat widget keeps its session token in the page's memory only. It does not save anything in the visitor's browser storage or cookies.

3. How we use it

• To provide the service: sign you in, answer visitor questions from your documents, capture leads and book meetings.
• To send service emails: account and password-reset emails, trial and billing notices, message-limit warnings, and meeting confirmations, reminders and calendar invitations.
• To process payments, count usage against your plan, keep the service secure and fix problems.
• To meet legal obligations.

We do not sell personal information and we do not use it for advertising. We do not send marketing emails. If that ever changes, we will ask for your consent first and update this policy. Service emails (account, billing, limit warnings, meetings) are sent regardless.

4. Who we share it with

We use these service providers to run ChatHive. They receive only what they need for their part:

• Microsoft Azure: hosting, the database, file storage and logs. Our data is stored in the Canada Central region.
• Azure OpenAI: generates chatbot answers and embeddings. Visitor messages and relevant passages from customer documents are sent to the model to generate a reply. Our Azure OpenAI resource is hosted in the United States (Azure East US 2), which means prompts and responses are processed in the United States, outside Canada, although ChatHive's stored application data is kept in Azure Canada Central. Microsoft states that prompts, completions and embeddings are not used to train or improve foundation models without permission or instruction. This does not mean that no data is ever retained for any purpose: depending on Microsoft's applicable service terms, deployment configuration and abuse-monitoring settings, prompts or responses flagged for potential abuse may be retained for review. We do not promise a specific Microsoft-side retention period beyond Microsoft's then-current commitments and documentation.
• Stripe: payments, subscriptions and receipts. Stripe may process data in the United States and other countries.
• Microsoft 365: sending our emails.

We also disclose information when the law requires it, to protect the service and its users, or as part of a sale or reorganisation of the business, with notice to you where the law requires. Customers see the leads and meetings their own chatbot collected, and team members see what their role allows.

5. Where information is kept

ChatHive stores its application data in Azure Canada Central. However, some processing by our AI provider and payment provider may occur outside Canada, including in the United States, and may be subject to the laws of those jurisdictions. Our providers' handling of information is governed by their applicable terms, privacy commitments and security practices. We use these providers to deliver the service and take reasonable steps to select and manage them appropriately.

6. Cookies and browser storage

Customers get one cookie that keeps them signed in (it is not readable by scripts on the page and lasts 24 hours). Everyone who picks a language gets a second cookie that remembers it (it holds only the language code and lasts one year); the same choice is kept in the browser's storage. We do not use advertising or tracking cookies, and we do not use an analytics tool. If we add one, we will update this policy first.

7. Keeping and deleting information

• Chat conversation text: 24 hours. The exception is what a visitor wrote in a conversation that became a lead: it is kept with the lead for as long as the lead exists, and deleted with it.
• Service logs: 30 days.
• Activity log (who changed what in an account, with their name and email): 365 days.
• Answer-match measurements (how close a visitor's question was to the company's content, as a number, never the question itself): 90 days.
• Database backups: up to 7 days, after which they are overwritten or deleted through the normal backup cycle. Data in a backup may remain until that cycle completes and may not be immediately accessible for ordinary use.
• Account, chatbot, leads and meeting records: while the account is active. After cancellation or account deletion, these records are disabled for ordinary service use and retained for up to 365 days for account recovery, dispute resolution and security, unless you make a valid deletion request or we must retain them by law. They are then permanently erased or anonymized, subject to backup cycles and legal retention requirements.
• Payment and tax records: retained for the period required by applicable tax and accounting laws, generally six years from the end of the relevant tax year where that rule applies, and then deleted or anonymized when no longer needed.

If you want information erased sooner than the standard retention period, write to contact@chathive.ca. We will assess and respond to a valid request within the time required by applicable law, generally within 30 days where that deadline applies, subject to lawful extensions and exceptions. We may need to retain certain information to meet legal obligations, resolve disputes, enforce agreements or protect the service. Visitors should normally contact the business whose chatbot they used first; ChatHive will assist the customer as appropriate.

8. Your rights

Subject to applicable privacy law and its exceptions, you may request access to personal information we hold about you and request correction of information that is inaccurate or incomplete. Where consent is the legal basis for a use or disclosure, you may be able to withdraw that consent, subject to legal or contractual restrictions and reasonable notice. Applicable laws may include British Columbia's Personal Information Protection Act (PIPA) and, where applicable, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). The rights available to you depend on the law that applies and the circumstances.

If you are a customer, you can sign in and open Data & Activity, then Your data, to download the account and company data made available by the product (one account-data file and a leads spreadsheet, each available once per hour). Data & Activity, then Activity, shows recorded account activity. You can correct many account details in Setup. The export does not include chat conversations, passwords or the secret key for your chat widget. The export is a self-service convenience and may not include every item responsive to a formal privacy access request. You may also contact us to make a privacy request, and we will handle it under the applicable law and its deadlines.

For anything else, such as a correction or deletion you cannot make in the product, a request from a team member or a visitor, or if you cannot sign in, write to contact@chathive.ca. We may need to confirm who you are first. If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

9. Security

We use reasonable safeguards: passwords are stored as one-way hashes; connections to the service are encrypted; the sign-in cookie cannot be read by scripts on the page; customers can only reach their own company's data, and team members only what their role allows; and Azure encrypts stored data. No system is completely secure. If a breach creates a real risk of significant harm, we will notify the people and authorities the law requires.

10. Children

ChatHive is for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.

11. Changes to this policy

We will update this policy when our practices change. For a material change we will email customers and ask them to accept the new version. The date or version of the text you accepted is recorded.

12. Contact

contact@chathive.ca