Chat203 · Terms · DPA · Privacy · Subprocessors · Español
Chat203 Data Processing Addendum
Version 1.1 (2026-10-19). In effect.
Version: 1.1 (2026-10-19) · Effective date: October 19, 2026
1. Roles
You are the controller (CCPA/CPRA: the "business") of personal information about the visitors who use the chat on your website. We process it only as your processor (CCPA/CPRA: "service provider") to run Chat203 for you.
2. What we process
| Category | Examples | Source |
|---|---|---|
| Chat content | Visitors' messages and the AI's replies; card numbers, SSNs and passwords typed into the chat are masked automatically when detected | Visitors |
| Attachments | Photos (JPEG, PNG, GIF, WebP, up to 4 MB) and PDF documents (up to 5 MB) that a visitor chooses to attach. Stored in a private bucket, encrypted at rest, under the conversation; sent to our AI provider for that one answer only; visible to your team in the inbox; deleted with the conversation. Files are not masked; the assistant is instructed never to read out identifiers it sees in them | Visitors who choose to attach them |
| Contact details | Name, email, phone, custom form fields, the answers to your qualification questions and the resulting hot/warm score, and separate email and SMS opt-ins | Visitors who choose to share them |
| Lead forwarding | At your option, each new lead is also sent to one email address and/or one webhook URL you choose (for example your CRM): name, email, phone, the visitor's note, department, the hot/warm score, the answers to your questions, the email and SMS opt-ins, and a link to the conversation in your dashboard. The transcript and the files are not forwarded. You are the controller of those destinations and of their security | You (destination); visitors (content) |
| Technical | Page URL, random browser ID, a one-way hash of the IP address (kept 1 day, for abuse prevention), bot-check result | Visitors' browsers |
| Your knowledge content | Website pages, files, Q&A, contact directory | You |
We do not knowingly process data of children under 13, or sensitive data such as health, financial account or government ID numbers. The chat tells visitors not to share them.
3. Our commitments
- Instructions. We process the data only to provide, secure and support Chat203 for you, as set out in the Terms and your settings, and as the law requires.
- No selling or sharing. We never sell visitor data, share it for cross-context behavioral advertising, or combine it with other customers' data.
- No cross-customer use. Your visitors' conversations are never used to answer, train or improve the assistant for any other customer.
- AI provider. Messages, and any files a visitor attaches, are sent to our AI provider to generate answers, under terms that prohibit it from training its models on that data.
- Confidentiality. Anyone at Cabana West with access is bound to confidentiality, and access is limited to what each person needs.
- Security. Encryption in transit (TLS) and at rest; row-level isolation per business in the database; least-privilege keys; daily backups; masking of card, SSN and password patterns; rate limits and bot protection.
- Subprocessors. The current list is at chat203.com/subprocessors. We will give at least 30 days' notice before adding or replacing one. You may object on reasonable grounds; if we can't resolve the objection, you may cancel.
- Assistance. You can export all your data and delete any visitor's data yourself in the dashboard. We will help with other data-subject requests and with privacy assessments, as reasonably needed.
- Breach notice. We will notify you without undue delay, and within 72 hours, after we become aware of a breach affecting your visitors' data, with the information we have.
- Retention and deletion. Data is deleted automatically after the retention periods you set (defaults: conversations and their attachments 365 days, leads 730 days). When your account ends, we delete your data as set out in the Terms, except copies that remain in routine backups until they expire. Data deleted from live systems remains only in encrypted, routine disaster-recovery backups, is put beyond use, and is permanently destroyed within 35 days. We have no obligation to restore data from backups.
- Location. Data is stored in the United States (Supabase on AWS, us-east-1). Processing of EU/UK personal data needs the standard contractual clauses or an equivalent mechanism (lawyer to advise whether Chat203 serves EU/UK visitors at launch).
4. Your commitments
You confirm that you have a lawful basis and give your visitors any notice that is legally required (the widget shows a notice and the AI disclosure, but your own privacy policy must also cover the chat). You will not configure Chat203 to collect sensitive data, and you will not use it for prohibited purposes (Terms, section 5).