Privacy Policy

i-Chat (hq.i-chat.eu) is run by the i-Chat team. For anything about your data, write to support@i-chat.eu.

We handle two kinds of personal data, in two different roles:

• Businesses that use i-Chat. For your own account, billing details and support chats, we decide how the data is used. We are the controller.
• People who write to those businesses on Instagram, WhatsApp or Threads. Their messages and contact details belong to the business they wrote to. The business is the controller, and we process this data only on its behalf and on its instructions. We are the processor.

If you wrote to a business that uses i-Chat, please ask that business first about your data. We help the business answer you, and you can also write to us.

• Your account: email address, a hash of your password (never the password itself), your name, optional billing details (phone, address, VAT number), sign-in sessions and devices, and your notification settings.
• Channels you connect. Their access tokens are encrypted at rest.
  • Instagram professional account: ID, username, name, profile picture, follower count, the account’s own posts and their statistics.
  • WhatsApp Business Account: account and phone number IDs, the display number, verified name, quality rating, message templates and their status, and whether a payment method is set up.
  • Threads profile: ID, username, name and profile picture.
• Conversations with your customers: comments, direct messages, story replies and mentions, WhatsApp messages and the files in them, Threads replies and mentions, and the replies sent by you or your automations. For each contact: name, username, phone number, tags, consent and opt-out status, and the notes you write.
• What you set up: auto-replies, automations, broadcasts and saved replies.
• Technical records: webhook deliveries from Meta, the send history, taps on links you send (time, browser, and a one-way hash of the IP address, never the address itself), and diagnostics.
• Support: the messages and screenshots you send to i-Chat support.
• Cookies: only the ones that keep you signed in and remember your language. No advertising or analytics cookies, and no third-party trackers.

Only to provide the service you set up:

• receive Meta’s notifications (webhooks) and match your keywords;
• send your replies and broadcasts through Meta’s official APIs;
• show your Chats, Contacts, History and Stats;
• sign you in, send you the notifications you chose, and answer your support questions;
• prevent duplicate sends, fix problems and keep the service secure.

We do not sell data, use it for advertising, build profiles, or use data from Meta for any other purpose.

For your own account, the legal basis is our contract with you, and our legitimate interest in keeping the service secure. For your customers’ data we act on your instructions, as described in the Terms of Service; you, as the controller, are responsible for having a legal basis to message them.

i-Chat never asks for your Instagram, Facebook, WhatsApp or Threads password, does not scrape, and does not use browser automation. It only accesses the accounts you connect through Meta’s own login screens, and only for the features above. You can disconnect an account at any time.

i-Chat runs on its own server in the European Union. The application, its database and its queue are all on that server.

These service providers process data for us, only as far as each one needs to:

• A hosting provider in the European Union: the server described above, where i-Chat and its database run.
• Meta Platforms Ireland Limited (Ireland): the Instagram, WhatsApp and Threads APIs, which deliver your customers’ messages to us and send your replies.
• An email delivery service in the EU: sign-in codes and notification emails, which can include a contact’s name and the details they left.
• An AI service in the EU: the support assistant inside the panel. When you ask support a question, it sees your messages, any screenshots you attach, and what it looks up in your own account to answer you: connected account usernames, auto-reply texts, and short excerpts of messages that were sent. The data is processed in the EU and is not used to train AI models.
• Encrypted backup storage in the EU: encrypted copies of the database and of uploaded files, so the service can be restored after a failure.

A current list of our service providers is available on request at support@i-chat.eu.

AI replies are optional and off unless you turn them on. To use them, you connect your own account with an AI provider you choose (Anthropic, OpenAI, Google Gemini, or any provider with an OpenAI-compatible API) using your own API key. i-Chat does not choose, provide or pay for that AI.

When AI replies are on, i-Chat sends your provider the message the person wrote, the most recent messages of that conversation, and the description you wrote about your business, so that it can write an answer. You choose the provider and are the controller for that choice; your own agreement with the provider governs how it handles the data, including where it is processed. Your API key is stored encrypted and used only for these requests. Nothing is sent to any AI provider for a business that has not turned AI replies on.

• Your account, channels, contacts, conversations and send history: while your account is active, or until you delete them.
• Disconnecting a channel deletes its connection, its access token and its auto-replies at once.
• Raw webhook deliveries from Meta (which contain names and message text): 30 days.
• Requests made with your API keys: 30 days.
• Deleted auto-replies and automations stay in “Deleted” for 30 days, then are erased with everything they recorded.
• Records of new-follower notifications (account IDs and usernames, no message text): 365 days.
• Sign-in codes: 24 hours after they expire.
• Screenshots sent to support: 90 days (24 hours if never sent).
• Support chats close after a day without activity and are then kept as your support history while your account exists.
• When you ask us to delete your account, we delete its data within 30 days, except what the law makes us keep, such as invoices.

Connections are encrypted (HTTPS). Access tokens and AI provider keys are encrypted at rest with AES-256-GCM. Every notification from Meta is checked against Meta’s signature before we act on it. Each business sees only its own workspace.

You can ask for a copy of your data, its correction or deletion, restrict or object to its processing, or take it to another service. Write to support@i-chat.eu from the address you sign in with. We answer within one month. If you wrote to a business that uses i-Chat, the business answers these requests, and we help it.

How to disconnect a channel or delete everything is on the Data Deletion page. Deletion requests made from Facebook, Instagram or Threads reach us through our data deletion callback, and that page shows their status.

You can also complain to the data protection authority in your country.

i-Chat is a service for businesses and is not meant for children.

When this policy changes, we update this page and its date. We tell businesses that use i-Chat about important changes by email.

Email: support@i-chat.eu