Privacy Policy

Last updated: July 2026

1. About This Policy

This Privacy Policy explains how Pirsum-Mi Ltd, operating as Chat4U ("Chat4U", "we", "us", or "our"), collects, uses, discloses, stores, and protects personal data when you visit https://chat4u.ai, contact us, create or use a Chat4U account, use our dashboard, interact with a hosted demo, deploy or interact with the Chat4U widget, configure agents, upload or scrape content, or use Pro Agent features.

Company details
Pirsum-Mi Ltd
Israeli company number: 514452028
Tel Aviv, Israel
Website: https://chat4u.ai
Privacy contact: privacy@chat4u.ai

This Policy distinguishes between data we process as controller and data we process as processor for our customers. In many cases, the customer using Chat4U is the controller of visitor chat data, knowledge-base content, uploaded files, scraped material, and other project data submitted to the Service, while Chat4U processes that data on the customer's behalf under our Data Processing Addendum ("DPA").

If you are a visitor interacting with a Chat4U-powered assistant on a customer website, you should also read that website owner's privacy notice.

2. Our Roles

Chat4U generally acts as controller for:

  • account registration, authentication, workspace membership, profile, and organization administration;
  • billing, plan administration, credits, add-ons, subscription records, invoices, and payment-related operations;
  • marketing website visits, contact forms, sales inquiries, and support communications;
  • platform security, abuse prevention, operational monitoring, and service diagnostics;
  • legal notice publication, workspace Agreement acceptance records, privacy request handling, and compliance evidence;
  • aggregated and operational product analytics relating to use of the Service.

Chat4U generally acts as processor for:

  • visitor messages sent through customer chat widgets or demos;
  • customer project, agent, prompt, widget, and datasource configuration where that data includes personal data;
  • scraped pages, uploaded files, raw text, extracted content, chunked content, structured fields, embeddings, retrieval context, and related indexing metadata;
  • Pro Agent snapshots, element reads, tool parameters, tool results, and tool-approval metadata;
  • lead-capture form submissions collected by customer-configured agents.

If a customer is itself acting as a processor for another controller, Chat4U may act as a sub-processor.

3. Personal Data We Collect

3.1 Account, Workspace, and Authentication Data

We may process names, email addresses, user identifiers, authentication metadata, workspace and organization memberships, roles, permissions, invitation data, account status, and related profile information.

3.2 Project, Agent, and Configuration Data

We may process project names, domains, allowed domains, country settings, business context, plan assignment, usage settings, prompts, model/provider selections, guardrail settings, widget configuration, demo settings, and other dashboard configuration data.

If this data contains personal data, the customer is responsible for ensuring it is lawful to submit and process.

3.3 Visitor Chat, Widget, and Demo Data

When a visitor interacts with a Chat4U widget or hosted demo, we may process:

  • visitor and session identifiers created on first message send (not when the widget is merely opened);
  • messages sent by the visitor;
  • assistant responses;
  • timestamps and message metadata;
  • sanitized page context limited to origin plus pathname (query strings, fragments, and credentials are removed);
  • coarse device category and locale when widget privacy minimization is enabled;
  • conversation continuity and retry state stored in browser storage;
  • feedback and source-reference metadata where available.

When widget privacy minimization is enabled, we do not collect referrer, user-agent, timezone, screen dimensions, or fingerprint-like fields in widget session payloads. Server security and operational logs are separate from widget payload collection.

Chat4U provides a mandatory in-widget AI and privacy disclosure. Customers decide whether to deploy the widget and what content powers the assistant, and remain responsible for any additional website-specific notices, consent requirements, and visitor-rights handling.

3.4 Data Sources, Uploaded Files, and Scraped Content

When customers add knowledge-base content, we may process submitted URLs, sitemap URLs, page titles, extracted text, markdown, citations, structured fields, source URLs, file names, file contents, raw text, embeddings, chunk metadata, retrieval metadata, and related operational information.

Customers are responsible for having authority to submit, crawl, store, transform, index, embed, and use that content.

3.5 Lead Capture and CRM Delivery Data

If a customer enables agent-triggered lead capture, we may process lead fields selected by that customer, including name, email address, phone number, company, and custom form fields.

Lead capture is controlled by the customer. The customer configures the form fields, the associated privacy notice shown to visitors, and whether submissions are routed to an external CRM. Where configured, we may deliver lead data to HubSpot or Salesforce on the customer's behalf. Lead personal data is deleted after successful delivery. Under the current default, personal data retained in any non-delivered lead state is scrubbed after 30 days.

3.6 Pro Agent and Tool Data

Pro Agent features may process page snapshots, element text, tool parameters, tool results, navigation events, approval events, and related tool metadata. Browser-side deny selectors and redaction are used as risk reducers for common sensitive fields, but they are not guarantees.

3.7 Technical, Diagnostic, and Security Data

We may process IP addresses, request metadata, user-agent strings received in requests, API metadata, error logs, rate-limit events, queue events, security signals, timestamps, and related diagnostic data needed to operate and secure the Service.

For workspace Agreement acceptance, we retain limited pseudonymized evidence needed to demonstrate acceptance. The acceptance record does not contain the full network address or a full user-agent string.

3.8 Contact, Sales, and Support Data

If you contact us, request support, submit the marketing-site form, or communicate with us about billing or legal matters, we may process your contact details, company information, request content, attachments, and communication history.

3.9 Answer Metadata and Inferences

For customer analytics and product features, we may process conversation and answer analytics associated with chat interactions, including whether an answer was complete, the apparent intent and topics, language and sentiment, question type, confidence, and details about possible knowledge gaps.

This metadata is used to help customers understand conversation outcomes, identify content gaps, and review assistant performance. It does not mean AI outputs are accurate or suitable for high-risk use.

4. Cookies and Browser Storage

We use cookies, localStorage, sessionStorage, and similar technologies for authentication, session continuity, consent preferences, language selection, security, dashboard operation, widget continuity, and related functionality.

On the Chat4U marketing website, the chat widget is consent-dependent and loads only after functional chat consent is granted. The consent object used for this purpose is versioned separately in our Cookie Policy.

On customer websites, customers are responsible for disclosing the Chat4U widget, visitor/session identifiers, and any required consent model under their own notices and banners.

For more detail, see our Cookie Policy.

5. How We Use Personal Data

We use personal data to:

  • provide, operate, maintain, and troubleshoot the Service;
  • authenticate users and manage workspaces, roles, and permissions;
  • provide AI chat, retrieval, indexing, demos, and Pro Agent functionality;
  • process file uploads, scraped content, text ingestion, embeddings, and retrieval;
  • enforce plan limits, credits, add-ons, rate limits, and subscription entitlements;
  • collect and deliver lead submissions where customers enable that functionality;
  • provide support, respond to inquiries, and communicate with users and customers;
  • detect, investigate, prevent, and respond to abuse, fraud, security issues, and misuse;
  • maintain legal evidence, workspace Agreement acceptance records, privacy-request records, and operational logs;
  • generate customer-facing analytics and operational metrics, including answer metadata and knowledge-gap signals;
  • comply with legal obligations and enforce our contractual terms and policies.

We do not sell personal data. We do not state that all AI providers use data identically; provider handling depends on the configured provider, service terms, customer configuration, and applicable contractual settings.

6. Legal Bases

Where Chat4U acts as controller and GDPR, UK GDPR, or similar laws apply, our legal bases may include:

  • Contract: to provide the Service, manage accounts, authenticate users, and administer subscriptions;
  • Legitimate interests: to secure the Service, prevent abuse, improve reliability, support customers, maintain legal evidence, and analyze operational performance;
  • Consent: where required for certain cookies, marketing communications, or optional technologies;
  • Legal obligation: to comply with accounting, tax, legal-process, recordkeeping, and regulatory duties.

Where Chat4U acts as processor, we process customer-controlled personal data on the customer's documented instructions under the DPA. The customer is responsible for determining the legal basis for visitor, lead-capture, datasource, and other customer-controlled processing.

7. Disclosure and Service Providers

We may disclose personal data to service providers and partners that help us host, authenticate, operate, support, secure, improve, or bill for the Service. These may include infrastructure providers, identity providers, AI providers, payment providers, email providers, CRM-delivery providers, website-hosting providers, and optional proxy or brand-extraction providers where configured.

A current Sub-processor List is published separately. Not every provider processes data for every customer. Provider use depends on the services and integrations enabled.

We may also disclose data:

  • where required by law or legal process;
  • to protect rights, safety, security, or the Service;
  • in connection with a merger, financing, acquisition, restructuring, or sale of assets.

8. International Transfers

We and our providers may process personal data in more than one country. Where required, we rely on contractual and legal transfer mechanisms appropriate to the relationship and processing role, such as data processing agreements and other recognized safeguards.

Customers should review the DPA and Sub-processor List for more information about customer-data processing and transfers.

9. Retention

We retain personal data for as long as needed for the purposes described in this Policy, including to provide the Service, maintain security and legal evidence, support customers, comply with legal obligations, and enforce agreements.

Under current implementation:

  • scrape activity records are retained for 60 days by default;
  • usage records are retained for 365 days by default;
  • non-delivered lead personal data is scrubbed after 30 days by default;
  • visitor widget and demo conversations may be subject to project-configurable inactivity retention (30, 90, 180, or 365 days) when automated conversation retention is enabled platform-wide after a published cutover date. Retention is measured from the last user or assistant message successfully committed to the database; session reads, queue events, analytics, and tool heartbeats do not extend retention. Conversations created before the cutover remain legacy_no_auto_expiry until manually deleted or fulfilled through the privacy-request workflow. See the Retention Schedule notice;
  • privacy-request export archives are marked with an expiry timestamp (default 7 days, configurable) and deletion is attempted from the active object key; versioned object storage may retain prior versions per bucket policy;
  • customer-controlled project data, uploaded files, scraped content, documents, and related knowledge-base data follow customer deletion paths through the dashboard or support workflows;
  • legal evidence, billing records, support records, and security records may be retained longer where reasonably required;
  • RDS automated backup retention is configurable (the development Terraform default is 1 day; production deployments should set longer retention where recovery requires it);
  • deletion from active databases does not immediately erase all backup, versioned object-storage, provider-log, or recovery copies.

We do not promise fixed retention periods for every conversation or project artifact beyond the current implementation described above. Manual privacy rights are described in the Privacy Rights notice.

10. Security

We use technical and organizational measures intended to reduce risk and protect personal data, including access controls, role-based permissions, environment and application controls, logging, and managed cloud services where implemented.

No service can guarantee absolute security. Customers are responsible for configuring their own users, prompts, content, domains, workflows, external integrations, and visitor disclosures appropriately.

For more detail, see our Security Measures notice.

11. Your Rights and Requests

Depending on your jurisdiction, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent for certain processing.

If you are a Chat4U account user or contact, you may exercise privacy rights or ask privacy questions at privacy@chat4u.ai.

If you are a visitor who interacted with a Chat4U-powered assistant on a customer website, the customer is usually the controller of your visitor chat data. In most cases, you should contact that website owner first. We will support our customers in handling requests where required by our DPA and applicable law.

We may need to verify identity and authority before acting on a request. We may decline or limit a request where permitted by law.

Where applicable, you may also lodge a complaint with your local data-protection supervisory authority. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

12. Sensitive Data and High-Risk Uses

High-Risk Use is governed by the Acceptable Use Policy. High-Risk Use is prohibited unless a separately signed Enterprise agreement expressly authorizes the exact use.

Customers remain responsible for determining whether their planned processing is lawful and appropriate, and for avoiding submission of sensitive or regulated personal data unless all required safeguards and contractual arrangements are in place.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, product behavior, providers, or legal requirements. The version and last-updated date identify the current published notice.

14. Contact

Questions, requests, or complaints about this Privacy Policy may be sent to:

Pirsum-Mi Ltd (Chat4U)
Tel Aviv, Israel
https://chat4u.ai
Privacy: privacy@chat4u.ai
General support: support@chat4u.ai

English is the controlling language of this document. Version: 2026-07-data-lifecycle-v1. Immutable URL: /legal/privacy/2026-07-data-lifecycle-v1. SHA-256: 5728e8117efee2d8f08013cb0cb1ed5a46122208cf13a9a87176f2af0e5eb8fe.