Security Measures

1. Purpose and scope

This notice explains the security approach of פרסום מי סטודיו לעיצוב גרפי והפקות דפוס בע"מ, trading as Chat4U, for systems we operate. The DPA, particularly Annex B, states applicable contractual measures. This notice is not a certification, a guarantee of absolute security or a claim that every control applies identically to every customer-selected provider.

2. Access and separation

Administrative accounts authenticate through the identity service. Role and resource authorization restrict access to the appropriate workspace, project, assistant and data. Operational access is limited to authorized purposes and persons, with revocation when no longer necessary.

Customers share infrastructure. Separation is principally enforced through logical authorization and resource scoping, rather than a dedicated database or physical environment for each customer. Scope checks apply to retrieval, actions and privacy handling as well as visible pages. Customers must manage their own staff, roles, devices and integration permissions appropriately.

3. Encryption and credentials

Public service traffic uses HTTPS/TLS. Managed primary databases and object storage use encryption at rest. Stored integration credentials and platform secrets are protected with restricted access and appropriate secret-management controls.

These statements do not claim end-to-end encryption that excludes Chat4U and its processors, identical protection on every internal network path, or universal encryption in every state across external integrations. Personal data necessary for an AI or other selected function is available to the relevant authorized processing service. The Customer's native store and third-party accounts remain separately controlled.

4. Processing and action safeguards

We minimize data sent to tools, measurement and monitoring, and apply appropriate authorization and recovery controls. Private order data is separated from public knowledge. Native WooCommerce verification secrets remain outside model inputs and durable Chat4U chat history; private answer delivery requires current authorization. Uncertain cart actions are reviewed through recovery state rather than blindly repeated.

AI features can include optional guardrails, source grounding, approval controls and browser-field restrictions. These reduce risks but cannot guarantee detection of unsafe input, prompt injection, sensitive information or incorrect output. Customers must not treat a safeguard as permission for a prohibited use.

5. Logs, changes and suppliers

Operational and security records support diagnosis, abuse detection, billing integrity and incident response. We restrict access, minimize unnecessary content and retain records according to their actual category. Monitoring does not guarantee detection of every incident.

We use controlled source and deployment processes and risk-appropriate checks. We assess applicable supplier protections and maintain contractual and operational responsibilities under the DPA. We do not claim universal test coverage, a specific independent certification or a continuously staffed security team.

6. Recovery and privacy handling

Protected recovery copies and access controls support recovery from incidents. Restoration must preserve deletion restrictions so erased personal information does not simply return to ordinary service. Export and deletion workflows distinguish requested, pending and completed steps, including supplier and merchant-host dependencies.

No fixed recovery-time or recovery-point guarantee is created here. Backups are not a promise to recover every deleted conversation, nor an excuse to exceed a binding deletion deadline. See the Retention Schedule and DPA for applicable obligations.

7. Incidents

We operate an incident-response process to assess reports, contain harm, investigate, preserve necessary evidence and take appropriate corrective action. For a personal data breach affecting customer-controlled data, the DPA requires notice without undue delay after awareness, with available facts and subsequent updates rather than waiting for a final investigation.

Regulator, affected-person and provider duties are assessed separately. In particular, covered actual or suspected Shopify Merchant Data breaches require the applicable immediate report to Shopify, no later than 24 hours after awareness. This is not a universal hourly response promise to every customer. Notification or assistance is not by itself an admission of fault and does not remove actual liability or mandatory duties.

8. Reporting and permitted testing

Report suspected security issues to support@chat4u.ai. Include the affected function, a safe description and minimal evidence; avoid unnecessary personal information or secrets. We review credible reports. We do not operate a promised paid bounty or guarantee a fixed acknowledgment or fix time.

Deliberate live-service testing requires prior written permission for its scope. Reporting an issue itself does not. Lawful local review and testing of GPL-licensed plugin code on systems you control remain permitted under the applicable licence; that is not authorization to access another customer's records or attack the hosted Service. See the AUP.

9. Shared responsibilities and lawful requests

Customers secure their own sites and hosts, manage authorized users, choose appropriate sources and integrations, and provide required visitor notices. Chat4U remains responsible for the components it operates and its legal and contractual duties. A supplier, customer configuration or general disclaimer does not transfer all responsibility to the other party.

Government and law-enforcement requests are assessed for applicable authority, scope and customer-notification duties. Switching Schedule section 8 describes the applicable infrastructure-jurisdiction information and safeguards against conflicting third-country governmental access to non-personal data held in the Union, including its specific advance-notification rule. Those Article 32 safeguards apply within their own statutory scope even where an exception from switching duties applies; personal-data protections remain separate. We do not imply publication of a transparency report or disclose sensitive controls through this public notice. Relevant compliance information is available through the DPA's controlled assistance and audit process.

Security: support@chat4u.ai. Privacy: privacy@chat4u.ai.