Privacy Policy

1. Who this covers

Whizchat is operated by Whizchat (“we”, “us”), a company registered in Australia. We don't publish a street address. For privacy requests, questions or complaints, email support@whiz.chat, which is a monitored address and the fastest way to reach a person.

We provide a chat agent that businesses embed on their own websites. That means two different groups of people are involved, and we hold a different responsibility to each. This policy covers both, so find the section that describes you.

• Business owners who sign up for an account. For your information, we are the controller: we decide how it's used, and this policy is the whole agreement.
• Visitors who chat on a business's website. For your information, we are a processor acting on that business's instructions. They decide why your conversation is collected and what happens to it; we store and process it on their behalf. Their own privacy policy applies alongside this one.

2. If you chatted with a business

What is collected

• What you type. The full conversation, including anything you mention in passing.
• Contact details you share. If you give a name, email address or phone number in the conversation, it's saved as a contact record so the business can follow up. This happens automatically from what you write. There's no form to submit, and no separate step where you opt in. That's why we tell you before you start typing.
• Your IP address. Stored with the conversation and visible to the business you are chatting with. It is recorded once, when the conversation starts.
• Your approximate location. Our hosting provider derives a city, region and two-letter country code from your IP address. This is approximate: it identifies roughly where your internet connection is, not where you are.
• Your browser and operating system, from the user-agent string your browser sends with every request, so the business sees something like “Chrome on iPhone”.
• Which pages of that business's website you visited. The chat widget records the address and title of each page it loads on, and the business can see the most recent ten. This happens on every page of their site that has the widget installed, including pages where you never open the chat. It covers only that one business's website: the widget cannot see anywhere else you go, and nothing is shared between different businesses' sites.
• A random visitor ID. A random identifier is generated and kept in your browser's local storage so that if you come back, your conversation is still there. It is not a cookie, it is not shared between different businesses' sites, and it isn't linked to anything about you unless you provide it yourself. Clearing your browser storage removes it and starts a new conversation.
• Timestamps for each message.

What is not collected

We don't place advertising or tracking cookies through the chat widget. We don't follow you across different websites, and we don't sell or rent your information to anyone. Our own product analytics deliberately excludes the chat widget entirely, so opening a chat on a business's website does not register you as a visitor to ours.

We record which pages you visit on the one website the widget is installed on, and nothing beyond it. This happens whether or not you open the chat, so that a business you do message can see what you were looking for beforehand. We do not measure how long you spend on a page, how far you scroll, what you click, or which site you came from, and we do not combine any of this with information from anywhere else.

Who sees your conversation

• The business you contacted. They can read the whole conversation in their dashboard and reply as a human at any point.
• OpenAI. Your messages are sent to OpenAI to generate the agent's replies and to detect contact details. See the sub-processor table below.
• Our infrastructure providers, to the extent needed to host and store the data. Also in the table below.

3. If you have a Whizchat account

• Account details: your email address and password. Passwords are hashed by our authentication provider; we never see them.
• Business details: your business name, website address, and a logo if you upload one. Uploaded logos are stored in a publicly-readable location anyone with the file's URL can view it, so don't upload anything you wouldn't publish.
• Your knowledge base: text read from your website during an import, plus anything you write or edit yourself.
• Notification settings: the email address you want lead alerts sent to, and a record of each browser or device you turn push notifications on for.
• Usage analytics on our marketing site and dashboard, cookieless page and event counts, used to understand which pages work.

4. Reading your website

When you point Whizchat at your website, we fetch its public pages the way any visitor or search engine would, extract the text, and store it so the agent can answer from it. We only do this when you ask us to, at setup, or when you press re-read. There are no scheduled or background crawls. We only fetch pages that are publicly reachable; we do not log in, submit forms, or attempt to reach anything behind a password.

5. How the AI works

When a visitor sends a message, we search your stored website content for relevant passages and send those, your knowledge base, and the recent conversation to OpenAI, which generates the reply. Replies are checked before they're shown: if one contains a phone number or link that doesn't match your business's own details, it is replaced rather than sent.

We access OpenAI through its API, and OpenAI's API terms state that data submitted this way is not used to train its models and you should read their terms directly if this matters to you. For our part: we do not train any model on your conversations or your website content, and we never use one customer's data to improve another customer's agent.

6. Who else processes your data

We use the following sub-processors. Each is bound to handle the data only as needed to provide their service to us.

Our database and file storage are hosted in Singapore (ap-southeast-1). We say that plainly because it is probably not what you assumed: Whizchat is an Australian company, but the data itself sits offshore. Some of the providers above also process data in the United States and elsewhere. Where information is transferred overseas, we take reasonable steps to ensure it's handled consistently with this policy and applicable law.

7. Cookies and local storage

• The chat widget sets no cookies. It stores a random visitor ID and conversation ID in your browser's local storage so your conversation persists if you return.
• The dashboard uses essential cookies to keep you signed in. Without them, you can't log in.
• Our marketing site uses cookieless analytics. If you enter your website address before signing up, it's held in a short-lived cookie (24 hours) purely so it survives the signup step and we don't have to ask you twice.
• There are no advertising or cross-site tracking cookies anywhere in the product.

8. How long we keep things

We keep a conversation for as long as the business it belongs to wants it. There is no automatic expiry date. A record of a customer enquiry is something a small business may legitimately need years later, to honour a quote, to answer a warranty claim, or to meet its own record-keeping obligations, and quietly deleting it on a schedule of our choosing would destroy their records, not ours.

What that means in practice:

• A business can delete any individual conversation or contact at any time, and it is removed from our database.
• Closing an account deletes the business, its conversations, contacts, uploaded documents and knowledge base. We complete that within 30 days, including from backups.
• If you chatted with a business and want your conversation deleted, ask them. See section 9. It is their record, and they can remove it.
• Push notification registrations are deleted automatically as soon as a device stops accepting them.

We hold this position deliberately rather than by neglect, and we won't pretend it is the strictest one available: the Australian Privacy Principles and the GDPR both expect information not to be kept longer than necessary, and “as long as the business wants” puts that judgement in the business's hands rather than ours. That is the right place for it while we are the processor and they are the controller, but it does mean the business, not us, is the one answering for how long they hold their customers' messages.

9. Your rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it.

• If you have an account, email us at support@whiz.chat. Much of it you can also edit or delete yourself from your settings.
• If you chatted with a business, contact that business first, because the conversation is theirs and they can delete it. If you can't reach them, contact us and we'll help, though we may need to refer your request to them.

Depending on where you live you may have additional rights, including to object to processing, to request a portable copy, or to complain to a regulator. In Australia that is the Office of the Australian Information Commissioner (OAIC); in the EU or UK, your local data protection authority. We'd rather you came to us first.

10. Security

Data is encrypted in transit. Access to the database is restricted by row-level security so a business can only reach its own records, and the chat widget never talks to the database directly. Uploaded logos are the exception noted in section 3, which are deliberately public.

No system is perfectly secure. If we become aware of a data breach likely to result in serious harm, we'll notify affected people and the relevant regulator as required by law.

11. Children

Whizchat isn't directed at children, and accounts are for businesses. We don't knowingly collect information from children. If you believe a child has provided information through a chat widget, contact us and we'll delete it.

12. Changes

We'll update this page when the product changes, and update the date at the top. If a change materially affects how we handle your information, we'll tell account holders by email before it takes effect.

13. Contact

Questions, requests or complaints: support@whiz.chat, or through our contact form. We'll acknowledge within a reasonable time and aim to resolve complaints within 30 days.

See also our Terms of Service.