Privacy policy

1. Two kinds of data: ours and our partners'

AutoChat handles personal information in two distinct capacities, and different rules apply to each.

• Data AutoChat controls. Information about our partners and the people who contact us directly — account details, application requests submitted through this website, billing records, support correspondence, and platform usage records. For this information, Autograf Digital is the organization accountable for collection, use, and disclosure.
• Data AutoChat processes on behalf of partners. The contacts, conversations, call recordings, transcriptions, messages, emails, bookings, documents, and payment records that flow through the platform belong to the businesses our partners serve and their end customers. For this information, our partner (and the business it serves) determines why and how it is used; AutoChat processes it only to provide the platform, on the partner's instructions.

If you are an end customer of a business that runs on AutoChat — for example, you called or texted a company that uses a product built on our platform — your relationship is with that business. Privacy questions about how that business uses your information should go to it first; we support our partners in answering them, and you can always reach us using the contact route at the end of this policy.

2. What we collect, and why

For data we control, we collect only what we need to operate:

• Contact and account information — name, company, email address, and what you tell us when you request access or correspond with us. Used to evaluate applications, provide the platform, and communicate with you.
• Billing information — records of platform usage per workspace and per client, used to calculate charges. Payment card processing is handled by a dedicated payments provider; AutoChat does not store full card numbers.
• Platform operations data — authentication events, security logs, and technical records needed to keep the platform reliable and secure.
• Website data — this marketing site is static and does not use advertising trackers. Standard server logs (IP address, requested page, timestamp) may be retained briefly by our hosting provider for security and reliability.

For data we process on behalf of partners, the categories are determined by what our partners build: typically contact records, conversation content across voice, SMS, social messaging and email, call recordings and transcriptions, calendar and booking data, documents and signatures, and commerce records. We process this data to provide the platform's functionality and for no other purpose.

3. What we do not do

• We do not sell personal information. Not ours, and not our partners'.
• We do not use the content of partner communications for advertising.
• We do not permit third parties to mine platform data for their own purposes.

4. Subprocessors

AutoChat relies on a small set of upstream infrastructure providers to deliver the platform. We identify them by category; a current list is available to partners on request. Each processes data only as needed to provide its function:

• Telephony and messaging carriage — connecting calls and delivering SMS and social messages.
• Email delivery — transmitting transactional and marketing email.
• Transcription and AI inference — converting speech to text and powering agent and assistant features.
• Payment processing — handling card and payment transactions.
• Cloud hosting and storage — running the platform and storing its data.

We hold our subprocessors to contractual obligations consistent with this policy and with our obligations to partners.

5. Google and Meta API data

Where a partner (or a business it serves) connects a Google account — for example, calendar synchronization or business-profile and review management — AutoChat accesses only the data needed to provide that connected feature, uses it only to provide the functionality described in the product at the time of connection, does not sell it, and does not use it for advertising. AutoChat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Where a partner connects Meta platform features — for example, Instagram or WhatsApp messaging — AutoChat accesses message and account data solely to send and receive those conversations inside the platform, on behalf of the connected business. This data is not sold and is not used for any purpose beyond providing the described functionality.

Disconnecting an integration stops further collection from it. Data already processed can be deleted as described in sections 6 and 7.

6. Retention

For data we control, we retain personal information only as long as needed for the purposes above, and afterwards as required for legal, accounting, or audit obligations, after which it is deleted or anonymized.

For data we process on behalf of partners, retention follows the partner's configuration and instructions. When a partner relationship ends, partner data is exported to the partner on request and then deleted from active systems within a defined wind-down period, with backup copies expiring on a rolling schedule.

7. Deletion

You can request deletion of your personal information at any time. Plain instructions, the expected response window, and the contact route are published on our data deletion page at autochat.co/data-deletion — a standalone page that does not require an account to reach.

Where the data at issue is controlled by one of the businesses running on AutoChat, we will confirm receipt, route the request to the responsible business, and support it in completing the deletion.

8. Consent and electronic messages (CASL)

AutoChat is built around Canada's Anti-Spam Legislation (CASL). Consent is recorded as a first-class object in the platform: one consent state per person, enforced across every channel, with sender identification and functioning unsubscribe mechanisms on commercial electronic messages and an audit trail of consent changes. Partners are responsible for obtaining valid consent from their audiences; the platform is built to record and honour it.

9. Security

Platform data is protected with industry-standard measures, including encryption in transit, tenant isolation enforced at the data layer, scoped access controls, and logging of administrative access. No internet service can promise perfect security, and we do not — but security is a design constraint of the platform, not a feature tier.

10. Jurisdiction

AutoChat is operated from Alberta, Canada, and designed Canadian-first. The Personal Information Protection and Electronic Documents Act (PIPEDA) and CASL are the regimes we build against; provincial private-sector privacy law applies where relevant. Data residency requirements are discussed with each partner. If you are dissatisfied with our handling of a privacy concern, you may contact the Office of the Privacy Commissioner of Canada.

11. Changes to this policy

When this policy changes, the updated version is posted at this address with a new revision date. Material changes affecting partners are communicated to them directly.

12. Contact

Privacy questions and requests go to [email protected]. Please include enough detail for us to identify the records involved — we respond to every request, and we aim to acknowledge within a few business days.