Privacy Policy

Last updated: 14 October 2026

Chatloom is a product of Frontbits LLC, a limited liability company registered in Sharjah Media City (Shams) Free Zone, Sharjah, United Arab Emirates ("we", "us"). This policy explains what personal data we handle, why, and your choices. Chatloom isn't offered to businesses in the European Union, the EEA, the United Kingdom or Switzerland. Questions: [email protected].

Two kinds of data

1. About our customers (businesses that use Chatloom and their team members). Here we decide how data is used: we're the controller.
2. About our customers' website visitors, collected when they use a chatbot on a business's website. Here we handle data on the business's behalf and under its instructions: the business is the controller and we are its processor, under our Data Processing Agreement. If you chatted with a business's chatbot, the business's own privacy policy applies, and you should contact the business first about your data.

Data about our customers

Google Drive: Chatloom can only read the files you pick in Google's file picker, never the rest of your Drive, and only reads them. Chatloom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the files' text only to answer questions through your chatbot; we don't sell it, use it for advertising, or use it to train AI models, and people at Chatloom don't read it except with your permission, for security, or where the law requires. Notion: Chatloom can only read the pages you share with it on Notion's screen.

Legal bases (where data protection law requires one): performing our contract with you, our legitimate interests in securing and improving the Service, your consent for device notifications, and legal obligations (such as keeping billing records).

Data we process for businesses about their visitors

When a visitor uses a chatbot, we store, on the business's behalf:

• the conversation (what the visitor writes and the replies);
• the page they were on, the page that referred them, their type of device and browser, their time zone and language, and the country they're in (worked out by our network provider, Cloudflare, from their connection; we don't store IP addresses);
• details they choose to give: name, email, phone number, messages for the team, call bookings, ratings, and anything a business's form or "collect data" step asks for (such as a delivery address);
• if the business uses the email channel: emails sent to its support address (sender's name and address, subject and message), and the replies;
• if the business uses the Helpdesk: the ticket's status and priority, notes its team writes, and the customer's rating of the help they got;
• if the business connected Shopify and the visitor checks an order: the order number and email they enter, and the order's status, tracking and items, shown only to them;
• if the business's website tells the chat who a signed-in customer is: their name and email, and any details the business stores about them as a contact (such as their plan or latest order).

We use this only to provide the chat and the business's inbox, alerts and reports. Chat replies are written by an AI model from Anthropic, which receives the conversation in order to write them. We don't sell this data, don't use it for advertising, and don't use it to train AI models.

Who we share data with

We use these service providers (subprocessors). Each receives only what it needs for its task and is bound by contract to protect it:

We may also disclose data if the law requires it, or to protect the rights and safety of our users or others. If Frontbits LLC is involved in a merger or sale, data may transfer as part of it, under this policy.

International transfers

Our systems are hosted in the United States. Where the law requires safeguards for transfers (for example, under the UAE's data protection law), we put appropriate safeguards in place, such as standard contractual clauses with our service providers.

How long we keep data

• Accounts and workspaces: while they exist; deleted within 30 days after you delete them.
• Visitor chats: for the period each business chooses (30 days to 1 year, or until it deletes them).
• Shopify order details in chats: 90 days.
• Access log: 1 year. Activity log: while the workspace exists.
• Backups: up to four weeks, then overwritten.
• Billing records: as long as tax and accounting laws require.

Security

• Encryption in transit: all traffic to Chatloom uses HTTPS (TLS). Calls to our subprocessors use HTTPS, and the app reaches its database over our hosting provider's encrypted private network.
• Encryption at rest: the database and its nightly backups are stored on our hosting provider's encrypted storage, and the extra copies taken before database changes are kept on encrypted company devices. Credentials for connected services (such as Shopify and Slack) are additionally encrypted by the application with AES-256-GCM.
• Access control: each business's data is kept in its own workspace, reachable only by its team members, with roles (owner, admin, member). Only owners and admins can connect other apps or use the privacy tools. Access to production systems is limited to authorised Frontbits staff using accounts protected by strong passwords and two-factor authentication.
• Passwords: account passwords are hashed with bcrypt and never stored in plain text. Sign-in attempts are rate limited.
• Logging: changes to chatbots and teams are recorded in the Activity log, and every view or export of customers' personal data is recorded in an access log kept for one year, which workspace owners and admins can read.
• Backups: automated nightly backups, kept for up to four weeks, plus a backup before every database change.
• Separation of environments: development and testing use separate systems with test data only.
• Data minimisation and retention: we only request the data each feature needs (for example, Shopify access is read-only and limited to orders). Chats are deleted automatically after the period each business chooses, and Shopify order details after 90 days.
• Abuse protection: public endpoints are rate limited, and order lookups require both the order number and the email the order was placed with.

More on our Security page.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how it's used, and withdraw consent. You can also complain to your data protection authority (in the UAE, the UAE Data Office).

• Customers: email [email protected]. You can also edit your profile, export your data and delete your account in the dashboard.
• Website visitors: contact the business whose chatbot you used. Businesses can find, download and delete a visitor's data in Chatloom. If you can't reach the business, email us and we'll pass your request on and help.

We'll respond within one month.

Deleting your data

• Customers: delete your account in Profile → Delete account, or delete a workspace from the dashboard. We then delete the data as described above.
• Website visitors: ask the business, or email [email protected] with the email address you used in the chat. We'll delete your chats, contact details, messages and bookings for that business (after confirming the request with them).
• Shopify stores: uninstalling Chatloom from your Shopify admin disconnects it immediately and deletes the connection.
• HubSpot: click Disconnect on any automation's HubSpot step to delete Chatloom's access key (we also ask HubSpot to cancel it). API keys: revoke them on the Developers page.
• Notion and Google Drive: click Disconnect on the Sources page to delete Chatloom's access key (for Google, we also ask Google to cancel it). You can also remove Chatloom's access in Notion's or Google's own settings. Imported pages and files stay as sources until you delete them.

Cookies and local storage

• Our website (chatloom.co): only if you click Accept on the cookie banner, Google Analytics sets cookies (named "_ga") to count visits and see how people use the site. Your choice is remembered in a cookie ("chatloom_consent"). If you decline, no analytics cookies are set. You can change your mind at any time with Cookie settings at the bottom of every page. We don't use Google's advertising features, and Analytics data is kept for up to 14 months.
• Dashboard: one essential cookie keeps you signed in. No advertising or analytics cookies.
• Chat on websites: the chat stores a random identifier and the conversation in the visitor's browser (local storage) so it can continue the conversation. It isn't used for tracking or advertising.

Children

Chatloom is a service for businesses and isn't meant for children. Businesses are responsible for their own websites' audiences.

Changes

We'll post updates here and change the date above. For important changes, we'll tell customers by email or in the dashboard.

Contact

Frontbits LLC, Sharjah Media City (Shams) Free Zone, Sharjah, United Arab Emirates. Email: [email protected].