Privacy Policy
Last updated: 5 October 2026
Chatloom is a product of Frontbits LLC, a limited liability company registered in Sharjah Media City (Shams) Free Zone, Sharjah, United Arab Emirates ("we", "us"). This policy explains what personal data we handle, why, and your choices. Questions: [email protected].
Two kinds of data
- About our customers (businesses that use Chatloom and their team members). Here we decide how data is used: we're the controller.
- About our customers' website visitors, collected when they use a chatbot on a business's website. Here we handle data on the business's behalf and under its instructions: the business is the controller and we are its processor, under our Data Processing Agreement. If you chatted with a business's chatbot, the business's own privacy policy applies, and you should contact the business first about your data.
Data about our customers
| What | Examples | Why |
|---|---|---|
| Account | Name, email, password (stored only as a secure hash), profile photo | To create and secure your account |
| Workspace | Workspace name, team members and roles, chatbots and their settings, the knowledge you add | To provide the Service |
| Billing | Plan, payment status. Card details are handled by Stripe; we never see or store them | To charge for paid plans |
| Activity and security | Changes made in the dashboard (Activity log), views and exports of customer data (access log), sign-in attempts | Security, accountability, and preventing abuse |
| Support | Messages you send us | To help you |
| Your email address and the alerts and reports you choose to receive (Profile → Email) | To send account emails (password reset, invites) and the emails you've chosen | |
| Notifications | Device notification subscriptions, if you turn them on | To send alerts to your devices |
Legal bases (where GDPR or similar laws apply): performing our contract with you, our legitimate interests in securing and improving the Service, your consent for device notifications, and legal obligations (such as keeping billing records).
Data we process for businesses about their visitors
When a visitor uses a chatbot, we store, on the business's behalf:
- the conversation (what the visitor writes and the replies);
- the page they were on, the page that referred them, their type of device and browser, and their time zone and language (we don't use IP addresses to work out where visitors are);
- details they choose to give: name, email, phone number, messages for the team, call bookings, ratings;
- if the business connected Shopify and the visitor checks an order: the order number and email they enter, and the order's status, tracking and items, shown only to them;
- if the business's website tells the chat who a signed-in customer is: their name and email.
We use this only to provide the chat and the business's inbox, alerts and reports. Chat replies are written by an AI model from Anthropic, which receives the conversation in order to write them. We don't sell this data, don't use it for advertising, and don't use it to train AI models.
Who we share data with
We use these service providers (subprocessors). Each receives only what it needs for its task and is bound by contract to protect it:
| Service | What it does for Chatloom | Location | When it's used |
|---|---|---|---|
| Railway Corporation | Hosting, database and backups | United States | Always |
| Anthropic, PBC | AI model that writes chat replies, summaries and labels | United States | Always |
| Resend, Inc. | Sending Chatloom's emails (password reset, invites, alerts, weekly reports) | United States | Always |
| Stripe, Inc. | Payments and billing for paid plans | United States | Paid plans |
| Slack Technologies, LLC | Alerts posted to the business's Slack channel | United States | Only if the business connects Slack |
| Shopify Inc. | Looking up a customer's order in the chat | Canada / United States | Only if the business connects Shopify |
| Cal.com, Inc. / Calendly LLC | Booking calls from the chat | United States | Only if the business adds booking links |
| Browser push services (Apple, Google, Mozilla) | Delivering notifications to team members' devices | United States | Only for people who turn on notifications |
We may also disclose data if the law requires it, or to protect the rights and safety of our users or others. If Frontbits LLC is involved in a merger or sale, data may transfer as part of it, under this policy.
International transfers
Our systems are hosted in the United States. Where the law requires safeguards for transfers (for example, from the EU, UK or UAE), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep data
- Accounts and workspaces: while they exist; deleted within 30 days after you delete them.
- Visitor chats: for the period each business chooses (30 days to 1 year, or until it deletes them).
- Shopify order details in chats: 90 days.
- Access log: 1 year. Activity log: while the workspace exists.
- Backups: up to four weeks, then overwritten.
- Billing records: as long as tax and accounting laws require.
Security
- Encryption in transit: all traffic to Chatloom uses HTTPS (TLS). Calls to our subprocessors use HTTPS, and the app reaches its database over our hosting provider's encrypted private network.
- Encryption at rest: the database and backups are stored on our hosting provider's encrypted storage. Credentials for connected services (such as Shopify and Slack) are additionally encrypted by the application with AES-256-GCM.
- Access control: each business's data is kept in its own workspace, reachable only by its team members, with roles (owner, admin, member). Only owners and admins can connect other apps or use the privacy tools. Access to production systems is limited to authorised Frontbits staff using accounts protected by strong passwords and two-factor authentication.
- Passwords: account passwords are hashed with bcrypt and never stored in plain text. Sign-in attempts are rate limited.
- Logging: changes to chatbots and teams are recorded in the Activity log, and every view or export of customers' personal data is recorded in an access log kept for one year, which workspace owners and admins can read.
- Backups: automated nightly backups, kept for up to four weeks, plus a backup before every database change.
- Separation of environments: development and testing use separate systems with test data only.
- Data minimisation and retention: we only request the data each feature needs (for example, Shopify access is read-only and limited to orders). Chats are deleted automatically after the period each business chooses, and Shopify order details after 90 days.
- Abuse protection: public endpoints are rate limited, and order lookups require both the order number and the email the order was placed with.
More on our Security page.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how it's used, and withdraw consent. You can also complain to your data protection authority (in the UAE, the UAE Data Office).
- Customers: email [email protected]. You can also edit your profile, export your data and delete your account in the dashboard.
- Website visitors: contact the business whose chatbot you used. Businesses can find, download and delete a visitor's data in Chatloom. If you can't reach the business, email us and we'll pass your request on and help.
We'll respond within one month.
Deleting your data
- Customers: delete your account in Profile → Delete account, or delete a workspace from the dashboard. We then delete the data as described above.
- Website visitors: ask the business, or email [email protected] with the email address you used in the chat. We'll delete your chats, contact details, messages and bookings for that business (after confirming the request with them).
- Shopify stores: uninstalling Chatloom from your Shopify admin disconnects it immediately and deletes the connection.
Cookies and local storage
- Dashboard: one essential cookie keeps you signed in. No advertising or analytics cookies.
- Chat on websites: the chat stores a random identifier and the conversation in the visitor's browser (local storage) so it can continue the conversation. It isn't used for tracking or advertising.
Children
Chatloom is a service for businesses and isn't meant for children. Businesses are responsible for their own websites' audiences.
Changes
We'll post updates here and change the date above. For important changes, we'll tell customers by email or in the dashboard.
Contact
Frontbits LLC, Sharjah Media City (Shams) Free Zone, Sharjah, United Arab Emirates. Email: [email protected].