Privacy Policy

By using the Services, you consent to the data practices described in this policy. If you do not agree, please do not use the Services.

2.1 Information You Provide

• Account Information: Name, email address, company name, phone number, and billing information when you create an account or subscribe.
• Content: Website URLs, documents, PDFs, FAQs, and other content you upload to train your AI chatbot.
• Communications: Messages you send to us through support channels, email, or chat.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, timestamps, and session duration within the Services.
• Device Data: Browser type, operating system, IP address, device identifiers, and screen resolution.
• Chat Data: Conversations between your chatbot/agents and your website visitors, including transcripts, timestamps, and visitor metadata.

2.3 Information from Third Parties

• Integrations: Data from services you connect via Zapier, Salesforce, Shopify, or other integrations — only as authorized by you.
• Payment Processors: Transaction data from Stripe or other payment processors. We do not store full credit card numbers.

‍

We use the information we collect to:

• Provide the Services — Operate your AI chatbot, live chat, co-browse, video chat, and related features.
• Train your AI chatbot — Process content you upload to generate accurate, on-brand chatbot responses for your visitors.
• Improve the platform — Analyze usage patterns to enhance features, fix bugs, and develop new capabilities.
• Communicate with you — Send account notifications, support responses, product updates, and (with your consent) marketing communications.
• Process payments — Handle subscription billing, invoicing, and refunds.
• Ensure security — Detect and prevent fraud, abuse, and unauthorized access.
• Comply with law — Meet legal obligations, respond to lawful requests, and enforce our Terms.

ChatBeacon provides an AI-powered customer engagement platform that includes, but is not limited to:

• AI Chatbots — Generative AI chatbots trained on your content, powered by OpenAI
• Live Agent Chat — Real-time messaging between your team and website visitors
• Co-Browse & Screen Share — Real-time visual collaboration tools
• Video Chat — In-browser video calls between agents and visitors
• PictureData™ — AI-powered visual product search for e-commerce
• Integrations — Connections to third-party services via API and Zapier

We reserve the right to modify, suspend, or discontinue any part of the Services at any time, with reasonable notice when possible.We do not sell, rent, or trade your personal information. We may share information only in these limited circumstances:

• Service Providers: Trusted vendors who help us operate the Services (hosting, payment processing, email delivery, analytics) — bound by confidentiality agreements.
• AI Infrastructure: OpenAI (for AI chatbot processing) and Microsoft Azure (for cloud hosting) — subject to their enterprise data processing agreements.
• Integrations: Third-party services you choose to connect (Salesforce, Shopify, Slack, etc.) — only data you authorize.
• Legal Requirements: When required by law, court order, or to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets — with prior notice.

5.1 How AI Uses Your Data

ChatBeacon's AI chatbot is powered by OpenAI's models. When you train your chatbot, we process the content you provide (website pages, uploaded documents, FAQs) to generate a knowledge base specific to your business.

5.2 What OpenAI Receives

When your chatbot responds to a visitor, the conversation context is sent to OpenAI's API for processing. OpenAI does not use your data to train their models under our enterprise agreement. All API calls are encrypted in transit.

5.3 AI-Generated Content

Responses generated by your AI chatbot are based on your training content and the conversation context. You are responsible for reviewing and approving the accuracy of AI-generated responses, particularly in regulated industries.

We use cookies and similar technologies to operate the Services, remember preferences, and analyze usage. Types of cookies we use:

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Services.

6.1 Chat Widget Tracking

Our chat widget collects visitor data (pages visited, referral source, device type) to provide agents with visitor context. This data is stored as part of your Customer Data and subject to your own privacy policies toward your visitors.

We implement industry-leading security measures to protect your data:

• SOC 2 Type II certified — audited annually by independent third parties
• HIPAA compliant — Business Associate Agreements available for healthcare customers
• 256-bit TLS encryption — all data encrypted in transit and at rest
• US-based Azure data centers — all data stored within the United States
• SSO / SAML support — Entra ID, Okta, and Active Directory integration
• On-premise deployment — available for organizations requiring full data sovereignty
• Audit logging — all administrative actions tracked and logged
• Role-based access controls — granular permissions for team members

While we implement robust security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly notifying you and relevant authorities of any breach in accordance with applicable law.

We retain your data only as long as necessary to provide the Services and fulfill the purposes described in this policy:

• Account Data: Retained for the duration of your subscription plus 30 days following termination.
• Chat Transcripts: Retained per your configured retention settings (default: 1 year). You may export or delete transcripts at any time.
• Training Content: Retained for the duration of your subscription. Deleted within 30 days of account termination.
• Billing Records: Retained for 7 years as required by tax and accounting regulations.
• Usage Analytics: Aggregated and anonymized data may be retained indefinitely for product improvement.

Upon account termination, you have a 30-day window to export your data. After this period, all Customer Data is permanently and irreversibly deleted from our systems.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Portability: Request your data in a machine-readable format.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@chatbeacon.ai. We will respond within 30 days (or sooner if required by applicable law).

The Services are not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us at privacy@chatbeacon.ai.

ChatBeacon is operated from the United States. If you access the Services from outside the US, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For EU/UK users, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to ensure adequate data protection for international transfers. For on-premise customers, data remains within your designated data center.

Depending on where you reside and how SmartMax Software, Inc. processes your personal information, additional privacy rights may apply under local law. These rights supplement the general rights described in Section 9 of this Privacy Policy.

‍

12.1 California Privacy Rights

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), applies to our processing of your personal information, you may have the right to:

• Know and Access. Request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it is used, and the categories of third parties to whom it has been disclosed.
• Correct. Request correction of inaccurate personal information.
• Delete. Request deletion of personal information we have collected from you, subject to applicable exceptions.
• Opt Out of Sale or Sharing. Request that a business not sell or share personal information as those terms are defined under the CCPA. SmartMax does not sell personal information and does not knowingly share personal information for cross-context behavioral advertising.
• Limit Certain Uses of Sensitive Personal Information. Where applicable, request limitations on certain uses or disclosures of sensitive personal information.
• Non-Discrimination. Exercise applicable privacy rights without receiving discriminatory treatment.

We may need to verify your identity before completing certain requests. You may also use an authorized agent to submit a request where permitted by law, subject to applicable verification requirements.

To submit a California privacy request, contact us at privacy@chatbeacon.ai or call +1-918-388-5900.

‍

12.2 European Economic Area Privacy Rights

If you are located in the European Economic Area ("EEA") and the General Data Protection Regulation ("GDPR") applies to our processing of your personal data, you may have rights including:

• access to personal data we process about you;
• correction of inaccurate or incomplete personal data;
• deletion of personal data in circumstances provided by law;
• restriction of processing in certain circumstances;
• objection to certain processing, including direct marketing and certain processing based on legitimate interests;
• data portability where applicable;
• withdrawal of consent at any time where processing is based on consent, without affecting the lawfulness of processing conducted before withdrawal; and
• the right to lodge a complaint with an applicable supervisory authority.

When SmartMax processes personal data for its own business purposes, the legal basis for processing may include performance of a contract, compliance with a legal obligation, our legitimate interests, or consent, depending on the activity involved.

When SmartMax processes personal data contained in customer conversations or other customer-controlled information on behalf of a ChatBeacon customer, the customer generally determines the purposes and means of that processing and acts as the controller, while SmartMax generally acts as a processor. Privacy roles may vary depending on the specific processing activity, agreement, jurisdiction, configuration, and deployment model.

If your request concerns information associated with a ChatBeacon conversation conducted through another organization's website, application, portal, or support channel, you should generally direct your request to that organization. SmartMax will assist its customers with applicable data-protection obligations where required by law and contract.

‍

12.3 United Kingdom Privacy Rights

If you are located in the United Kingdom and UK data-protection law applies to our processing of your personal data, you may have rights that include access, rectification, erasure, restriction, objection, data portability where applicable, and withdrawal of consent where processing is based on consent.

You may also have the right to raise a concern with the UK Information Commissioner's Office or another applicable authority.

As with EEA processing, SmartMax may act as a controller for personal information it processes for its own business purposes and as a processor where it processes customer-controlled information on behalf of a ChatBeacon customer.

Exercising Your Rights

To exercise privacy rights relating to information SmartMax processes for its own purposes, contact:

Privacy: privacy@chatbeacon.ai

Phone: +1-918-388-5900.

‍

We may request information reasonably necessary to verify your identity or authority to make the request. We will respond within the time required by applicable law.

For information processed through ChatBeacon on behalf of one of our customers, please contact the organization whose website, application, portal, or support channel you used. More information about how privacy responsibilities are divided between ChatBeacon customers and SmartMax is available in our  Service Privacy Notice in the ChatBeacon Trust Center.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or a prominent notice on our website at least 30 days before they take effect.

We encourage you to review this policy periodically. The "Last updated" date at the top of this page indicates when the policy was last revised.