Privacy Rights and Requests

1. Contact us

To ask about your personal information, write to privacy@chat4u.ai. Chat4U is operated by פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ, company number 514452028, 4 Jasmin Street, Or Akiva, Israel. Ordinary support at support@chat4u.ai can route a privacy request too.

You do not need a paid plan, a new account, a special form or legal wording. We recognize valid requests received through available channels and do not require you to restart them through our preferred mailbox. Explain the action you want and provide enough information to help us locate the relevant data. Please do not send passwords, verification codes, payment-card details or identity documents unless a proportionate secure verification step is actually needed.

2. Which rights may apply

Depending on the relevant law and processing, you may have rights to:

• Obtain information and access to personal data, and a copy where applicable.
• Correct inaccurate or incomplete personal data, including relevant inaccurate inferences.
• Request deletion or restriction of processing, subject to lawful exceptions.
• Object to processing based on legitimate interests and to direct marketing; withdraw consent without affecting earlier lawful processing.
• Receive qualifying data in a portable form and have it transmitted where the applicable conditions are met.
• Obtain the safeguards or review required for certain solely automated decisions, and challenge relevant personal information.
• Exercise applicable United States state rights concerning sale, sharing, targeted advertising, sensitive-data use or profiling, and appeal a refusal where that law provides an appeal.
• Complain to the controller where that right applies, complain to a competent regulator, or pursue another available remedy.

These rights have different conditions. We do not sell personal data or share it for cross-context behavioral advertising. We do not disadvantage you for exercising a protected right. Israeli law includes applicable access rights and correction or deletion of information that is not correct, complete, clear or up to date; other Israeli or applicable overseas rules can provide additional rights. This notice does not reduce them to the examples above.

3. Who handles the request

For Chat4U account, billing, our own support, security and legal records, we handle our controller responsibilities directly. For a conversation or lead on another organization's website or channel, that organization normally controls the data; we notify and assist it under the DPA and applicable law. If it cannot be identified, give us the website or channel so we can help locate the responsible customer.

A request can involve both kinds of records. We separate and coordinate the relevant work rather than make you identify each database or supplier. The customer's role is not an unlimited veto over your rights, and internal coordination does not itself extend a legal deadline. We do not assume that an unanswered customer email authorizes us to disclose or erase its data without an appropriate instruction or other lawful authority.

Independent merchant orders, payment-provider records and social-platform copies may require action by those parties. We explain that boundary and handle Chat4U's relevant copies. You need not contact every Chat4U subprocessor yourself.

4. Finding a conversation without a named account

An account-free chat can still contain personal data and have a conversation reference. A reply email you provide now does not automatically identify all your earlier conversations.

Useful starting information can include the website or channel, approximate date and time with time zone, and a short relevant excerpt or screenshot if needed. Provide the minimum useful information first; not every item is compulsory. A safe conversation reference can help. Do not email raw authentication tokens or browser secrets.

In the chat's privacy area, Request deletion of this conversation securely attaches the current conversation reference and submits a request. Its receipt means the request was received, not that all data has already been erased. Clearing or restarting the visible chat is a different action and is not server deletion.

If the original tab or device is gone, email remains available. A lost tab is not an automatic refusal, and there is no guarantee that one browser reference identifies every device, website or shared-device user. We assess available additional evidence without collecting unnecessary identity information. If information genuinely cannot be linked to you, we explain what is missing and consider useful further evidence; we do not dismiss all unnamed chats as anonymous.

5. Verification and other people's information

Locating a record and confirming authority to act are separate steps. We use existing account or communication evidence where adequate and request further information only where reasonably needed for the risk and action. Routine passport collection is not our default. A supplied conversation or visitor identifier alone is not proof that someone may receive or erase all its contents.

An authorized representative may act for you with proportionate evidence of authority. If a conversation discusses you but was written by another person, we consider your information and rights without automatically disclosing or deleting that person's entire conversation. Shared devices, third-party information and the sensitivity of the proposed disclosure may require different checks.

We use secure delivery for fulfilled requests and minimize the information retained to demonstrate handling. Identity checks are not a device for unnecessary delay. Where the applicable law permits a timing adjustment for genuinely necessary identification or clarification, we apply that rule specifically rather than restarting every request clock automatically.

6. Timing, cost and explanations

We respond within the period required by applicable law and without avoidable delay. For EU GDPR requests this is normally one month, with a permitted extension of up to two further months for complexity or number of requests; where used, we explain the reason within the initial period. UK timing follows its applicable rules, including any lawful adjustment for genuinely needed identification or clarification. Applicable United States state requests commonly have a 45-day substantive-response period with limited extensions, while certain opt-outs, acknowledgments and appeals have different or shorter requirements. We use the rule applicable to the request, not a universal “30 days after we verify you” standard.

Ordinary individual rights requests are free. A fee or refusal is used only where the applicable law permits it and with the required explanation. A business customer's optional custom report or extensive consultancy request is different from an individual's statutory right and cannot be used to put ordinary rights behind a paid plan.

We explain the action taken or, where appropriate, the reason for a limitation, refusal, extension or outstanding step, together with the applicable complaint or appeal route. An initial response does not necessarily mean every requested action must be granted. Where a right of appeal applies, you can ask us through the same contact to review the decision; we handle it within the applicable requirements and explain further recourse.

7. What deletion and access cover

We consider relevant content and linked personal information, including summaries and inferences, supported media, relevant exports and provider copies. We may need to protect another person's rights, maintain legally required financial evidence, or preserve narrowly justified legal or security records. We identify the relevant ground and scope where lawful, rather than treating a whole account as permanently exempt.

Expiry of a credential, blocked access, removal from a visible interface, a received request and physical deletion are different events. Protected backups follow a bounded lifecycle and restoration controls, subject to stricter requirements. We do not confirm all-copy deletion while known work remains incomplete. The Retention Schedule explains these distinctions.

For WooCommerce, dedicated order-verification forms operate on the merchant's host. Its WordPress privacy tools can address Chat4U-specific native metadata but do not automatically delete the underlying purchase. Unreachable or removed plugins may require merchant action to complete host-side work. Chat4U still handles its own relevant copies, including conversation and attribution data. A merchandise-order reference does not prove ownership of every chat.

8. Complaints and further help

You can contact us for an explanation or review. Where UK data-protection law applies to our processing as controller, you have a statutory right to complain to us if you believe our handling of your personal data infringes that law. Use either contact in section 1; no special form or legal terminology is required. We acknowledge such complaints within the 30-day acknowledgment period prescribed by that law, take appropriate steps to investigate, and provide progress information and the outcome without undue delay as required. That acknowledgment period is separate from the response periods for access, deletion or another rights request, which continue to be handled under their own rules.

Where another organization is the controller, we notify and assist it with the relevant complaint under our DPA and applicable law. We handle complaints about our own controller processing directly and coordinate mixed matters; routing does not itself extend a legal deadline.

You may also complain directly to a competent supervisory authority, including the Israeli Privacy Protection Authority, the relevant EEA data-protection authority, or the UK Information Commissioner's Office, as applicable. We do not require you to exhaust our support process before exercising a statutory complaint right.

If accessibility makes a request difficult, tell us what assistance would help through either contact above. We will consider appropriate assistance without requiring extra sensitive information unnecessarily. This notice does not promise every requested format or an additional voluntary response deadline.