Legal

Privacy policy

What ChatUno collects, why, who receives it, where it is stored, how long we keep it, and how you can see, export or delete it.

Who we are

ChatUno is operated by New Ways of Doing LLC, 165 Berwick St, Melrose, Massachusetts 02176-3830, United States of America ("ChatUno", "we"). Privacy questions and requests go to info@chatuno.ai.

We have two roles. For the people who run a business on ChatUno (account holders and their team), we decide how their data is used: we are the controller, or the "business" under California law. For the people a business talks to through ChatUno (website visitors, people who message its Instagram account, booking customers, leads and prospects), the business decides why their data is collected and how it is used. ChatUno processes that data on the business's behalf, as its processor or service provider. If you are one of those people, contact the business first; we will help it answer you.

Information we process

Account details such as your name, email address, organization, and role, and your sign-in and security events.
Configuration, knowledge-base content, and support conversations you add to ChatUno.
Website chat: the messages visitors send to your assistant, the replies, and any name, email address or phone number a visitor chooses to leave. Marketing consent is a separate, unticked box; an address left to get an answer is not consent to marketing.
For a connected Instagram professional account: the account ID and app-scoped user ID, username, an access token (kept in an encrypted secret store), your own posts and Reels with their captions and metrics, account and media Insights, the comments on your posts, the direct messages and comments people send to your account together with the replies sent from ChatUno, the analyses ChatUno generates from your own content, and a label ChatUno derives from each message people send you (for example “price question” or “ready to buy”, with a short topic such as “blue shirt”) so it can show which questions come up most. These labels describe only what a person wrote to your account; we do not track what anyone does elsewhere on Instagram.
If you use the sales features: the products and discount codes you enter, and, for each person who talks to your assistant, a customer record (a display name, an email address they chose to leave, their Instagram-scoped ID where the chat came from Instagram, the stage and notes you add) together with the orders your assistant starts for them and the discount codes it offers. Card details are never collected or stored by ChatUno: buy links open on your own checkout page.
If you use appointment booking: the services and opening hours you enter, and for each booking the name, email address or phone number and optional note the customer gave, plus the time and status. A customer can ask for an email reminder about their own booking; that choice covers that booking only. If you connect Google Calendar, the booking's name, email address and time are written to your calendar.
If you use Social Studio publishing: the posts, captions, media and schedule you confirm for your own Instagram account, and a record of each publishing job (when it ran and whether Instagram accepted it).
If you sign in with Instagram or Google: the account ID or email address linked to your ChatUno sign-in, so that account can sign you in again.
If you use competitor analysis, prospect research or outreach: the public business information described in the sections below.
If you join the waitlist or contact support: your name, email address, location and message.
Operational logs used to protect the service, diagnose errors, and prevent abuse.

ChatUno is not built for sensitive data such as health information, government ID numbers or payment card numbers. Businesses must not ask for that kind of data through ChatUno.

How we use information

We use this information to operate the unified inbox, deliver authorized replies, analyze your own content, show account performance, publish and schedule the posts you confirm, produce the reports you ask for, send the emails you approve, maintain integrations, keep the service secure, and support your organization. ChatUno does not sell personal information and does not share it for cross-context behavioral advertising. We do not use connected Instagram data to build advertising profiles.

If the GDPR, UK GDPR or Türkiye's Law No. 6698 (KVKK) applies to you, our legal bases are: performing our contract with you when we provide the service; our legitimate interests in keeping the service secure, preventing abuse, fixing errors and improving the product; legal obligations, for example tax and accounting records; and consent where we ask for it, such as visitor analytics on a business's website or marketing email. You can withdraw consent at any time.

Instagram and Meta data

ChatUno accesses Instagram data only after an authorized professional-account user grants the requested permissions, and through Instagram's API we read data only for that account: we do not use it to collect data about other people's accounts beyond the messages and comments they send to you. We ask for these Instagram permissions: basic profile (account ID and username), messages, comments, insights, and content publishing. Access tokens are stored as protected server-side secrets and are never exposed to the browser. Automated replies are sent only to people who wrote to you, within 24 hours of their last message, or, for a comment on your post, as one private reply within 7 days of the comment, as Instagram allows. ChatUno publishes or schedules a post to your account only after you confirm it. You can revoke access from ChatUno or from your Instagram settings.

AI processing

To write replies, drafts, images and analyses, ChatUno sends the relevant content to our AI provider, OpenAI: website and Instagram messages with their conversation history, comments, captions, post images, passages from your knowledge base, and the public web pages read for competitor analysis and prospect research. OpenAI processes this data as our service provider (subprocessor). It is not shared with OpenAI for training or improving its models, and ChatUno does not train its own models on your data. Under OpenAI's API data policy it may be retained for a limited period for abuse monitoring before it is deleted. Your knowledge base is used only to answer your own customers. We will update this policy before sending data to any other AI provider.

Public business data: competitor analysis and prospect research

Competitor analysis compares your business with up to five other businesses whose public websites you enter. Prospect research reads the public website of a business you choose to research. In both cases ChatUno reads only pages the site links to or lists in its sitemap, respects robots.txt, never logs in, and does not collect anything from Instagram, TikTok or YouTube. For competitor analysis we keep a list of the pages read and a fingerprint (hash) of each page for 90 days so the next report can show what changed; we do not store the page text. Findings keep a short quote with its source link and the date it was seen.

These features look for information about businesses, such as prices, services and policies. A business website can still show a person's name or a work email address. Prospect research keeps an email address only if it is published on that website, together with the page it came from; it does not guess addresses. If you use Google Places to find businesses, the address and rating Google returns are cleared after 30 days and only Google's place ID is kept. If your name or business appears in a ChatUno report or prospect list and you want it removed, email info@chatuno.ai.

Outreach email

A business can use ChatUno to email prospects from its own connected Gmail account, or to email its own customers who agreed to marketing. ChatUno's Gmail access is send-only: we cannot read the inbox. The business is the sender and is responsible for following the law where its recipients are, including CAN-SPAM in the United States. ChatUno puts these controls in place:

Every email carries the sender's legal name and postal address, an unsubscribe link, and a one-click unsubscribe header.
Unsubscribes, hard bounces and spam complaints add the address to the business's do-not-email list, and ChatUno does not email it again. A campaign pauses automatically if too many emails bounce or someone complains.
Each address gets at most three emails in 60 days, and a business cannot start a new first contact with an address it emailed in the last 90 days.
Personal webmail addresses are skipped. Countries that require prior consent for this kind of email are blocked unless the business holds a consent record, and prospect email to Türkiye is switched off.

If you received an outreach email sent through ChatUno, use its unsubscribe link, or write to the sender. You can also email us at info@chatuno.ai and we will pass your request on and stop further emails to your address from that business.

Email flows

A business can turn on Email Flows: automated emails it sends to its own customers when something happens, such as a welcome after they sign up, a follow-up after a booking or an order, a reminder when a payment link stays unpaid, or a win-back after a long gap. Only customers who gave the business marketing consent receive them, every email carries an unsubscribe link, and an address that unsubscribed, bounced or complained goes on the business's do-not-email list (suppression) and is skipped from then on.

Link clicks in automated messages

A business can turn on link tracking for an automation that answers its Instagram messages or website chat. Links in the messages that automation sends then go through a short ChatUno address. When someone opens one, we record that the link was opened (a click count and the time of the first and last click), linked to that automation run and so to the person's Instagram-scoped ID or chat. We do not store their IP address, device or browser with it. The business sees these clicks only as counts in its automation funnel, to learn which automations work. They are kept as long as the automation exists and deleted with it or with the workspace.

Cookies and browser storage

On chatuno.ai and in the dashboard we use only the cookies needed to keep you signed in, and your browser's local storage for small preferences. We do not use advertising or analytics cookies. Our fonts and icons are served from our own site.

The chat widget on a business's website stores a random chat ID in the visitor's browser so the conversation continues on the next page. If the business switches on visitor analytics, the widget first asks the visitor for permission and stores nothing for analytics until they accept. It asks nothing and tracks nothing when the browser sends Do Not Track or Global Privacy Control. Analytics use a random ID and a salted one-way hash of the IP address. Our own chat widget on chatuno.ai works the same way: it records visitor analytics only after you accept.

Who receives data

We share data only with the providers needed to deliver the service, under their data processing terms and security controls:

Supabase: database, sign-in, file storage and the encrypted secret store.
Railway: hosting for our website, API and AI service.
OpenAI: generating replies, drafts, images, analyses and search embeddings.
Resend: booking emails, team alerts and emails a business sends to its own customers.
Google: Google sign-in, Calendar sync, sending from a connected Gmail, and Places search.
Meta: Instagram messages, comments, insights and publishing for accounts you connect.
Microsoft: our company email, which receives messages sent to info@chatuno.ai.

We may also disclose data when the law requires it, to protect people or the service, or as part of a merger or sale of our business, in which case this policy continues to apply.

Where data is processed

ChatUno's database runs with Supabase in the United States (AWS us-east-2) and our servers run with Railway in the eastern United States. Our other providers also process data in the United States. If you are outside the United States, your data is transferred there. For these transfers we rely on our providers' data processing terms, which include the EU Standard Contractual Clauses where they apply.

How long we keep it

Account, workspace, conversation, customer, booking and prospect data is kept while your account is active, until you delete it yourself or ask us to.
Disconnecting Instagram in ChatUno deletes the stored access tokens straight away; posts, analytics and conversations already imported stay in your workspace until you delete them or ask us to.
Removing ChatUno from your Instagram settings deletes the Instagram data we imported for that account straight away. We keep only the deletion request's confirmation code (in hashed form) and its status, so the request can be checked on our data deletion page.
Incoming Instagram notifications (the message or comment text and the sender's Instagram-scoped ID, held in a queue until processed): deleted 7 days after processing, or 30 days after the last failed attempt.
Link clicks in automated messages: kept while the automation exists, deleted with the automation or the workspace.
Visitor Tracking (website visitor analytics, recorded only after the visitor accepts): raw events, and visits and visitors not seen again, are deleted automatically after 180 days.
Competitor analysis page lists and fingerprints: 90 days. Google Places address and rating: 30 days.
The do-not-email list is kept for as long as the workspace exists, so an address that opted out is not emailed again.
We have not yet set fixed periods for waitlist sign-ups and support requests. Until we do, we keep them until you ask us to delete them.
Deleting your account or workspace in Settings removes its data from our live systems at once. Copies in our automatic daily database backups expire within 7 days.
Operational logs are kept only as long as our hosting provider retains them and are used for security and diagnosing errors; secrets and personal details are masked in them.
We keep records the law requires, such as billing and tax records, for the period it sets.

Security

Data travels over encrypted connections, and our database provider encrypts stored data. Access tokens for Instagram and Google are kept in an encrypted secret store and never reach the browser. Database rules keep each workspace's data separate from every other workspace. Our staff admin tools are open to two named ChatUno accounts, require two-factor sign-in and log every request. They show a workspace's usage and its recent customer messages; we look at those only to support you, fix a fault, investigate abuse, or when the law requires it. If a security incident affects your data, we will tell you without undue delay and notify authorities as the law requires.

Your choices and rights

You can disconnect Instagram in your dashboard under Settings → Channels & Connections by switching the Instagram connection off. You can export or delete data yourself: in Settings, any signed-in user can download or delete their own account, and a workspace owner can download all workspace records (with links to stored files) or delete the workspace; in Customers, an owner or admin can export or delete a single customer's records. For anything else, including correction, follow our data deletion instructions or email info@chatuno.ai.

Depending on where you live, you can ask us to tell you what personal data we hold about you, give you a copy, correct it, delete it, restrict or object to how we use it, or move it to another service, and you can withdraw consent you gave. We will not treat you differently for using these rights. We confirm your identity before we act, and we reply within 30 days. An authorized agent can make a request for you with your written permission.

United States: California residents have the rights above under the CCPA, including the right to know, delete and correct. We do not sell or share personal information, and we use sensitive personal information only to provide the service, so there is nothing to opt out of. Residents of other states with privacy laws have similar rights.
European Economic Area and United Kingdom: you can complain to your local data protection authority or, in the UK, the Information Commissioner's Office.
Türkiye: you have the rights in Article 11 of the KVKK and can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
United Arab Emirates: you have the rights in Federal Decree-Law No. 45 of 2021 (PDPL) and can complain to the UAE Data Office.

Children

ChatUno accounts are for people aged 18 or over who act for a business. The service is not directed at children under 13, and we do not knowingly collect personal data from them. If we learn that we hold such data, we delete it; email us if you believe we do. Where local law sets a higher age for consent (up to 16 in some EU countries), the business is responsible for not using ChatUno to target people below that age.

Changes and contact

We update this policy when the product or the law changes and change the date below. If a change materially affects how we use your data, we will tell account holders by email or in the dashboard before it takes effect. Questions go to info@chatuno.ai or New Ways of Doing LLC, 165 Berwick St, Melrose, Massachusetts 02176-3830, United States of America. Last updated October 20, 2026.