Privacy Rights

1. Overview

This notice explains how individuals can exercise privacy rights related to Chat4U. Chat4U provides AI chat infrastructure; website owners who embed the widget are typically the data controller for visitor conversations, while Chat4U acts as processor for that content and as controller for account, billing, security, and platform-operation data.

2. How to submit a request

Email (primary channel): privacy@chat4u.ai

Send your request by email with enough detail to identify the data subject, the relevant website or Chat4U project (if known), and the right you wish to exercise.

There is no customer-facing privacy intake form, no member dashboard self-service privacy portal, and no widget self-service privacy portal in this release. Requests are triaged from the privacy mailbox and recorded in an internal privacy-request ledger by an authorized operator.

3. Request types

You may ask Chat4U to help with:

• Access / export — a copy of data Chat4U holds about you or a specified conversation scope
• Deletion — removal of conversation content within Chat4U's control, subject to holds and technical limits
• Correction — correction of inaccurate account or request metadata
• Restriction / objection — limitation of certain processing where applicable law requires
• Complaint — escalation about Chat4U's handling of your request

4. Identity and authority verification

Chat4U verifies requesters before fulfilling export or deletion:

• Account holders: identity is verified through reasonable evidence (for example, email control from the registered account address and workspace membership confirmation).
• Visitors / non-account requesters: support verifies identity and authority using reasonable evidence (for example, email control, workspace owner confirmation for customer-controlled content, or other approved procedures).

Chat4U does not fulfill export or deletion solely on unverified email claims.

5. Controller routing

For customer-controlled requests, Chat4U contacts a verified workspace owner or admin using existing support procedures. Chat4U does not provide a customer-facing privacy inbox in this release.

6. Response timeline

Chat4U targets a response within 30 days of receiving a verifiable request. Complex or mixed requests may require additional time; operators record status transitions and communicate delays when needed.

7. Export delivery

When an export is approved:

1. An operator builds a JSON archive from mapped tables (conversation messages and relevant account/project metadata).
2. The archive is stored in Chat4U's encrypted object storage under a dedicated prefix.
3. The operator generates a short-lived download link (15 minutes) and sends it manually through the approved support channel.
4. Export rows carry an expires_at timestamp (default 7 days after build, configurable via PRIVACY_EXPORT_RETENTION_DAYS). A scheduled cleanup job marks expired exports and attempts deletion of the active S3 object key. On versioned buckets, prior object versions may remain until bucket lifecycle rules or manual purge remove them. Chat4U does not guarantee immediate erasure of all storage versions within that window.

Chat4U does not persist download URLs or tokens in the privacy-request ledger.

8. Deletion and limitations

Approved deletion removes conversation-owned relational data in Chat4U databases and best-effort ephemeral Redis keys. Knowledge-base sources, provider logs, and backup copies may remain for limited periods as described in the Retention Schedule.

Conversations under an active legal hold cannot be deleted until the hold is released.

9. No automated DSAR platform

Chat4U does not offer automated cross-system data-subject fulfillment, immediate backup erasure, or full account/project self-deletion in this release. Enterprise customers with additional contractual requirements should contact Chat4U sales.

10. Contact

Privacy rights requests and questions: privacy@chat4u.ai

General product support (non-privacy): support@chat4u.ai