OyeChats, a brand of Digibranders Pvt Ltd ("OyeChats," "we," "us") operates the OyeChats platform. This Privacy Policy describes how we collect, use, store, share, and protect personal information when you interact with the Service. 

1. Introduction

This policy applies whether you are a customer who has signed up for an OyeChats account, an end user ("Visitor") chatting with a bot on a customer's website, or simply browsing oyechats.com. By using the Service, you agree to the practices described here. 

2. Our Role: Controller vs. Processor

Privacy law distinguishes between data "controllers" and "processors." Our role differs depending on whose data is involved: 

• Customer data: Where you have signed up for an account, we act as the controller of the data we collect from you to operate and bill for the Service. 

• Visitor data: Where a Visitor interacts with a bot on a customer's website, our customer is the controller and we act as a processor on their behalf. 

3. Information We Collect

• Account data: Name, work email address, organization name, hashed password, and account role. 

• Bot configuration: Bot name, system prompt, appearance settings, and the knowledge base content you upload or crawl. 

• Conversation data: Chat messages, timestamps, lead-capture form submissions, and qualification signals. 

• Visitor metadata: Truncated IP address, browser/device type, approximate location, page URL, referrer, and UTM parameters. 

• Billing data: Plan tier, billing cycle, invoice history, and last four digits of the payment instrument. Full card details are held by Stripe and Razorpay, never by us. 

• Communications: Contents of emails or support tickets you send us. 

4. How We Use Your Information

• Provide, maintain, and operate the Service, including the RAG pipeline that answers Visitor questions. 

• Authenticate users, enforce plan limits, and prevent abuse. 

• Generate lead-qualification signals (BANT/MEDDIC) and surface them to the customer who owns the conversation. 

• Send transactional emails: account verification, password resets, billing notifications. 

• Process payments, issue invoices, and meet tax and accounting obligations. 

• Improve the Service through aggregated, anonymized analytics. We do not use conversation content to train language models. 

5. Legal Bases for Processing (EEA / UK)

• Performance of a contract: to deliver the Service you have signed up for. 

• Legitimate interests: to secure the Service, prevent abuse, and conduct aggregated analytics. 

• Consent: where required (for example, non-essential cookies on our marketing site). 

• Legal obligation: to retain billing records and respond to lawful authority requests.

6. Sub-processors and Data Sharing

We do not sell your personal information. We share data only with sub-processors engaged to deliver the Service, each under written agreements. Categories include cloud infrastructure, AI model providers, email delivery, payment processors, and observability tooling. The current itemized list is available at www.oyechats.com/legal/subprocessors.  

7. International Data Transfers

OyeChats is operated from India and uses sub-processors in India, the United States, and the EU. Where data is transferred out of the EEA, UK, or India, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms under the DPDP Act, 2023.  

8. Data Retention

• Account data: Retained for the life of the account and deleted within 30 days of account closure. 

• Conversation history: 7 days on Free, 90 days on Pro, indefinitely on Enterprise (configurable). 

• Diagnostic logs: Up to 90 days. 

• Billing records: Retained as required under applicable tax and accounting law, typically 7 years. 

9. Security

We apply encryption in transit (TLS 1.3), encryption at rest for databases and object storage, role-based access controls, audit logging, and dedicated production/non-production environments. Production access requires multi-factor authentication. 

10. Data Breach Notification

If we become aware of a personal data breach likely to result in risk to affected individuals, we will notify customers without undue delay and, where required, the relevant supervisory authority within 72 hours.  

11. Your Rights

EEA / UK (GDPR): Access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your supervisory authority. 

California (CCPA / CPRA): Know, delete, correct, and opt out. We do not sell or share personal information for advertising. 

India (DPDP Act, 2023): Summary of processing, correction, erasure, and grievance redressal. 

To exercise rights, write to [email protected] from the email associated with your account. 

12. Children's Privacy

OyeChats is intended for businesses and is not directed to children. We do not knowingly collect personal information from children under 16 (or under 18 where required by local law, including India under the DPDP Act). 

13. Cookies and Similar Technologies

We use strictly necessary cookies for session management, authentication, and CSRF protection. We do not use third-party advertising or cross-site tracking cookies. The embeddable chat widget does not set cookies. Full details are in our Cookie Policy at www.oyechats.com/legal/cookies. 

14. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. Material changes will be communicated via email or in-product notice at least 30 days in advance where reasonably possible. 

15. Contact Us

For privacy questions or requests, contact us at [email protected]. 

OyeChats is a brand of Digibranders Pvt Ltd, India.