Privacy Policy

1. Who we are and when this policy applies

פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ, company number 514452028, of 4 Jasmin Street, Or Akiva, Israel, operates Chat4U. Contact privacy@chat4u.ai about personal data, or support@chat4u.ai for service help.

This policy covers our website, accounts, hosted Service, demos and processing connected with Chat4U-powered assistants. It explains information we obtain directly, through customers and integrations, and from use of the Service. It is a notice, not a request for blanket consent or a waiver of rights.

If you use an assistant on another organization's website or channel, that organization normally decides why its conversation and related customer information is processed. Its privacy notice is also relevant. You may still contact us: we handle our own records and help coordinate requests about customer-controlled data.

2. Our roles

We act as controller where we decide the purposes of account administration, billing, our own support and enquiries, defined security and operational processing, legal evidence and proportionate product measurement.

We act as processor, or as a customer's subprocessor, for the customer's assistant conversations, knowledge sources, leads, configured analysis and supported store or channel processing. That processing follows documented instructions under our Data Processing Addendum. The actual purpose determines the role: conversation content does not become our unrestricted information merely because it appears in a log or analysis. Pseudonymous identifiers remain personal data where they can be linked to a person.

Payment providers, social platforms and customer-selected systems can have their own controller or processor roles. They are not all our subprocessors. See section 7 and the Subprocessor List.

3. Information, sources and purposes

Not every feature processes every category. The customer's enabled services, permissions and actual interaction determine the relevant scope. We do not collect all listed information merely because someone opens a page.

4. Legal bases and provision of information

Where applicable law requires a legal basis for our controller processing, we use the basis appropriate to the particular purpose:

• Contract necessity: providing an individual's professional account, requested purchase or support, and taking requested pre-contract steps. Where a user represents an organization rather than being our contracting party, necessary business-contact processing generally relies on legitimate interests instead.
• Legitimate interests: administering business relationships, securing and maintaining the Service, preventing fraud and duplicate transactions, dealing with appropriate enquiries and claims, and proportionate product improvement. We assess necessity, impact and safeguards; this is not an unrestricted basis for all tracking or content reuse.
• Legal obligation: required accounting, regulatory, security, rights-handling and lawful disclosure duties, for the records and law that actually apply.
• Consent: optional device tracking, communications or other processing where consent is required. Consent is specific to the purpose and may be withdrawn; an account agreement or a customer's integration setting is not another person's consent.

Customer-controlled processing follows the customer's lawful basis and instructions. Each party remains responsible for its own duties. Where Israeli law requires informed consent or collection information, we provide the applicable information and obtain consent as required; the European legal-basis labels do not replace Israeli requirements.

Providing information is generally voluntary, rather than a statutory duty on you, unless a particular collection explains otherwise. Some information is needed for the function you request: without necessary account details we cannot create or secure an account; without billing information the provider may be unable to complete a purchase; without sufficient request information we may be unable to locate the relevant record or safely respond. Optional analytics permission is not required for ordinary shopping assistance. Avoid sending irrelevant sensitive information.

5. AI processing, analysis and training

Selected AI processors receive the messages, relevant source passages, instructions, supported media and tool results needed for the enabled feature. Embedding and ranking services process relevant text and queries. Conversation analysis and owner assistance can process previously retained conversations under customer instructions. Authorized customer users can see their permitted results; necessary Chat4U personnel may access information for scoped support, safety or operations.

We do not use customer content or Output to train general-purpose or shared AI models and require that restriction from AI suppliers processing it for us. Providing customer-specific retrieval, agreed summaries or analysis is different from training a shared model. No-training does not mean that a provider holds no data: temporary files, abuse/security records or necessary service state may have their own bounded retention.

Conversation insights are probabilistic and can be wrong. We do not use these insights to make solely automated decisions producing legal or similarly significant effects about individuals. Our standard offering does not authorize customers to use them for prohibited high-impact decisions or sensitive profiling. Contact the responsible customer or us to seek correction or challenge relevant personal information. See Privacy Rights.

6. Shopping, verification and optional measurement

Public product knowledge is separated from private order information. Native checkout, merchandise payment, fulfilment and returns remain with the merchant and its payment and delivery systems.

For supported WooCommerce order assistance, dedicated guest email, order number and verification-code fields go directly to the merchant's WordPress installation; its configured mail provider sends the code. Chat4U receives an expiring opaque proof for a signed-in shopper or one verified guest order, not the password, login cookie or code. A cart token or supplied email alone does not establish order ownership.

Minimized verified order results can be sent to the configured AI processor for the current answer. The delivered private answer is replaced by a neutral verification message in durable Chat4U chat history. This does not remove personal information a visitor separately types into ordinary chat, or eliminate the AI supplier's applicable temporary processing and retention. Fresh authorization is checked before the private answer is released.

Optional WooCommerce purchase measurement is off unless enabled by the merchant and supported by the visitor's explicit allowed consent signal. An opaque correlation can pass from the native cart to private order metadata. Only qualifying payment/refund evidence updates the relevant totals; a checkout link, cart change or unpaid order is not a paid purchase. Withdrawal stops attribution and removes associated evidence, with minimal revocation/recovery records retained for their separate protective purposes. A later permission does not revive revoked references.

7. Recipients and disclosures

We use the suppliers identified in the Subprocessor List for hosting, identity, AI, embeddings/ranking, selected source extraction, communications, monitoring and measurement. Data is limited to the relevant function. Authorized customer staff can access data according to their roles. When a customer connects a CRM, external assistant/client, channel or other tool, its granted scope and instructions determine what is delivered; the recipient's own terms govern its independent handling.

Paddle independently handles its Merchant-of-Record activities. Shopify handles its merchant platform, app billing and related processing. For billing we exchange the identifiers and charge facts needed for the relevant project, rather than conversation transcripts or knowledge documents. Social platforms process their channel records under their own arrangements. A merchant's WordPress host, mail service and native orders remain within its separately controlled environment.

We may disclose necessary information to advisers under appropriate confidentiality, in response to a valid legal requirement, to protect lawful rights and security, or in a corporate transaction with appropriate safeguards. A transaction does not authorize unrelated use inconsistent with applicable law and existing commitments. We do not sell personal data or share it for cross-context behavioral advertising.

8. International processing

Chat4U operates from Israel. Relevant suppliers can process data in the United States, European countries and other disclosed locations, depending on the service and contractual arrangements. A regional hosting or analytics setting is not a promise that every support or subprocessor activity remains in that region.

For a transfer requiring safeguards, we use the applicable lawful mechanism, such as a relevant adequacy decision or completed contractual transfer safeguards with necessary additional measures. The EU's recognition of Israel for covered transfers does not automatically cover every onward supplier transfer. You may request information about the relevant safeguards, and a copy where applicable, at privacy@chat4u.ai, subject to lawful protection of confidential information. We do not claim EU-only processing or universal zero retention.

9. Retention, deletion and security

The Retention Schedule provides category-specific periods and criteria. Customer conversations use the applicable inactivity setting; related analysis and media follow the corresponding lifecycle. Accounts, accounting, contract evidence, support and security records have separate periods. A justified legal hold applies only to relevant information and is reviewed; it is not permission to retain everything indefinitely.

Ending a subscription, closing an account, removing knowledge, uninstalling a plugin and deleting server records are different actions. Backup or provider cleanup can follow active-system removal, subject to bounded retention and stricter obligations. We confirm the scope actually completed and identify outstanding work. Deleting Chat4U copies does not automatically erase a merchant's original order or an independent payment-provider record.

We apply technical and organizational safeguards described in the Security Measures, including access restrictions, scoped encryption and controlled privacy handling. No service guarantees absolute security. Customer-controlled accounts, hosts and integrations also require appropriate safeguards.

10. Cookies and choices

Our Cookie Policy distinguishes necessary functions, optional marketing-site chat, analytics, dashboard preferences and store-side technologies. You can change marketing-site choices through Cookie preferences, and turn off authenticated product measurement through the account setting. Where prior consent is required, optional collection waits for it and stops on withdrawal. Calling a technology cookieless or using our own domain does not exempt it from applicable requirements.

Opting out of optional analytics does not stop necessary security, transaction or service records. Marketing permission, service messages and customer-controlled conversation analysis have distinct purposes. Direct-marketing objections and legally relevant browser preference signals are handled as applicable; ordinary browser clearing does not itself delete server-held conversations.

11. Rights and complaints

Depending on applicable law and the processing, you may request access, correction, erasure, restriction, portability, objection, withdrawal of consent, and review of certain automated decisions. Where applicable, you may opt out of sale, sharing, targeted advertising or specified profiling, limit particular sensitive-data uses, appeal a decision and complain to a competent regulator. We do not disadvantage you for exercising a protected right.

Write to privacy@chat4u.ai. A valid request received through ordinary support or another available route is handled without requiring a restart, paid account or legal terminology. The Privacy Rights notice explains locating unnamed conversations, proportionate checks, timing and exceptions. For an assistant conversation, the deploying customer normally decides the request; we coordinate and handle our own controller records separately. You need not identify every supplier yourself.

Where UK data-protection law applies to our processing as controller, you have a statutory right to complain to us if you believe that handling infringes that law. You can use the contacts above; the Privacy Rights complaint section explains the applicable acknowledgment and investigation process, separately from a request to exercise a data right. Complaints about a customer's own processing are coordinated with that customer as explained there.

You may also complain to the competent authority, including the Israeli Privacy Protection Authority, an applicable EEA supervisory authority or the UK Information Commissioner's Office. Contacting us first can help but does not remove a right to complain directly.

12. Children and sensitive contexts

The hosted account service is for customers with contractual capacity acting professionally. Our standard offering does not support child-directed assistants, professional advice or specialist regulated-data workflows requiring safeguards not agreed for that use. This does not mean every incidental child interaction or sensitive message is unlawful or unprotected.

Do not send passwords, authentication codes or payment credentials through ordinary chat or browser-assistance tools. If unexpected sensitive or child-related information is received, the responsible parties limit unnecessary further use and handle safeguarding and rights according to the facts and law. The AUP's restrictions do not eliminate Chat4U's own obligations.

13. Changes and contact

We keep previous published versions available and date a new policy accurately. Material changes are communicated through a route appropriate to the people affected; a customer-owner email is not automatically notice to every visitor. Where a new purpose needs separate consent or another legal condition, publishing this notice or accepting the Terms does not supply it. Contact פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ (Chat4U), 4 Jasmin Street, Or Akiva, Israel, or privacy@chat4u.ai.