1. Who is responsible
MIRINFO LLC, Uzbekistan, operates ChatVendor and decides how the data described here is handled. Write to info@chatvendor.net about anything in this policy.
Your customers
For the people who write to you in Telegram, WhatsApp, Instagram, Messenger, Viber, the website chat, e-mail or SMS, and for the people you message, you are the responsible party (the controller). We process their data on your behalf and on your instructions, as your processor. Consent, notices and honouring their requests are your obligations; the panel gives you the tools (export, erasure, retention, opt-out tags) to meet them.
2. What we collect
Your account and team
- Name, e-mail, hashed password, two-factor secret and recovery codes (encrypted), optional Telegram id for one-tap sign-in.
- Sign-in history (time, IP address, rough device description; for app sessions the device name and last sign-in IP), active sessions, the workspace's IP allow-list.
- Workspace name, plan, settings, branding, team members, roles, shifts, section restrictions, and the audit log of who changed what.
Channels you connect
- Telegram accounts: the session key that lets us act as your client (encrypted at rest), your profile data, the list of your chats.
- Bots, WhatsApp, Instagram, Messenger, Viber, e-mail, payment gateways, CRM integrations: the tokens, access keys and credentials you enter, stored encrypted and used only to talk to that service on your behalf.
- Android phones (SMS): model, app version, battery, network and SIM details reported by the app so the dashboard shows whether a phone can send. We do not read the phone's contacts, call log or inbox.
ChatVendor - Business Agent app (iOS, Android, macOS)
- Sign-in: your work e-mail and password are sent once to get a session token, which is kept in the device's secure storage (Keychain or Android Keystore). The app has no sign-up; accounts are created on chatvendor.net.
- Notifications: a push token from Apple Push Notification service or Google Firebase Cloud Messaging, the Firebase installation id, the platform, app version and a device name, used only to deliver notifications to that device. They are deleted when you sign out.
- Files you attach: the app opens the photo library, music library or file picker only when you choose a file to send; only that file is uploaded.
- Activity: when you were last active (shown to your team as online status), quick-reply usage counts, your own work statistics shown to the workspace owner, and the AI summaries you request.
- Plan payments: the workspace owner can choose a plan in the app. The billing country picked for tax is stored, and payment happens on the provider's page in the browser. We receive the payment result, never card details.
Conversations and contacts
- Messages in both directions: text, media files, voice transcripts, translations, reactions, delivery status, sender name and id, timestamps.
- The contact card you build: tags, variables (including a phone number if you record one), points, notes, internal team notes, AI summaries, sentiment, language, assignment, ratings (CSAT), tasks and reminders.
- Contacts linked across networks by phone number, when you use that feature.
Sales, bookings and public pages
- Products, orders, pay links, promo codes, payment confirmations from gateways (never card numbers), loyalty points.
- Services, bookings, the customer's name and phone given when booking.
- Submissions of your lead forms, orders placed on your shop page, and the referring page.
- Visitors of your website widget: a random visitor id, pages viewed, the data they enter in the pre-chat form.
AI features
- The API keys of the AI providers you connect (encrypted), the prompts you write, the knowledge base you upload, and the model's answers, quality reviews and insights, together with token usage.
Technical
- API request logs (endpoint, status, timing, key id, IP address and user agent), webhook deliveries, job and error logs, rate-limit counters.
- Payments to us: plan, amount, provider reference, invoice details you entered (company name, tax id).
3. Why we hold it
- To provide the Service you signed up for — receiving and sending messages, running your automations, taking orders and bookings (contract).
- To keep accounts secure and detect abuse — sign-in history, IP checks, audit log, abuse reports (legitimate interest).
- To bill you and keep the records the law requires (legal obligation).
- To improve the Service using aggregate, non-identifying usage statistics (legitimate interest). We never use your content to train AI models.
- To send you service e-mails and, where you opted in, product news. Marketing e-mails have an unsubscribe link.
4. How long we keep it
- Chat history: as long as the workspace exists, or shorter if you set a retention period (from 30 days) — older messages and their files are deleted nightly.
- SMS: message bodies 90 days, delivery records 365 days, phone telemetry 7 days.
- Contacts, leads, orders, bookings, products: until you delete them, erase the contact, or delete the workspace.
- API logs 30 days; audit log 365 days; sign-in history one year.
- Billing records: as long as tax law requires.
- Workspace deletion: everything is removed 7 days after the owner confirms; encrypted server backups age out within 30 days.
5. What we never do
- Sell or rent personal data.
- Read your conversations, except when you ask support to look at a specific problem or when investigating abuse reported to us.
- Use your content or your customers' messages to train our own or anyone's AI models.
- Store card numbers: payments to us and to you are handled by the payment providers.
6. Who else sees it
Data leaves our systems only where the Service needs it to:
- Messaging networks — Telegram, Meta (WhatsApp, Instagram, Messenger), Viber, your e-mail server, your mobile carrier: the messages you send and the actions you take go to them, under their terms.
- AI providers you connect — the conversation context needed for an answer, summary or translation goes to the provider you chose, under its terms.
- Payment providers — Stripe (your e-mail and the amount), Payme, Click, Telegram, inPAY / MirPay: amount and reference, never card details.
- Integrations you enable — CRM systems, Google Sheets, Zapier/Make/n8n, your own webhook endpoints receive the events you configured.
- Infrastructure — hosting, e-mail delivery, and push notifications through Google Firebase Cloud Messaging and Apple Push Notification service, which receive the notification text (contact name and a message preview), bound by contracts.
- Your team — members see what their role and section settings allow; the owner can see everything in the workspace.
- Authorities — when a valid legal order requires it; we tell you unless forbidden.
7. Where it is held
The platform is hosted in Uzbekistan. Messaging networks, AI providers and payment systems process data in their own regions; connecting them means your data reaches those regions.
Push notifications pass through Google and Apple, which process data in the United States and other countries.
8. How it is protected
- TLS everywhere; passwords hashed; session keys, tokens, API keys and credentials encrypted at rest.
- Two-factor authentication, session management, workspace IP allow-lists, role and section restrictions, audit log.
- API keys are shown once and stored hashed; webhooks are signed.
- Access to production is limited to staff who need it, and logged.
- If a breach affects you we notify you without undue delay with what happened and what to do.
9. Your choices and rights
- See and export: a full workspace backup from the panel; per-contact JSON export from the contact card.
- Erase: erase one contact everywhere (messages, files, leads, orders, bookings, notes) from the contact card; delete the workspace from its settings.
- Limit: set chat retention, disconnect any channel or integration, revoke API keys, remove team members.
- Correct: edit your profile and workspace details in the panel.
- Object / withdraw consent: unsubscribe from marketing mail; write to us for anything else. We answer within 30 days.
- Delete your account: see Data deletion. We delete your user account, sessions, push tokens and sign-in history within 30 days.
- Device permissions: notifications and photo or music library access can be turned off at any time in the device settings.
Requests from your customers about data you hold should go to you; we help you fulfil them through the panel tools.
10. Cookies and browser storage
The panel uses a session cookie, a CSRF cookie, a language cookie and a "remember me" cookie when you ask for it. Public pages (shop, booking, forms, widget) store a visitor id, the cart and the language in the visitor's browser. We do not run third-party advertising trackers; anonymous, aggregate analytics may be enabled by the operator.
11. Children
The Service is for businesses and is not directed at children under 16; we delete accounts we learn belong to a child.
12. Changes
We update this policy when the Service changes. Material changes are announced in the panel or by e-mail before they apply; the date at the top shows the current version.