Privacy Policy
The short version
- For your account, we keep what signing in and running your workspaces needs.
- For your users' chats, we are your service provider: we store and deliver them for you, and use them for nothing else.
- API keys are stored only as one-way hashes. We run no analytics and set no tracking cookies.
- We never sell personal information. You can see, export or delete yours — email us.
1. Who we are, and whose information this covers
qux.chat is operated by [Legal entity name], of [Registered address]. Contact us about privacy at [Legal and privacy contact email].
This policy covers two kinds of information. Account information is about you, our customer: we decide how it is used, and this policy says how. Customer Content is what your application and its users send through the chat API: we process it for you, under your instructions and our Terms, and your own privacy policy is the one your users should read. If you use an application built on qux.chat, ask that application's operator about your information.
2. What we collect, and why
| What | Details | Why |
|---|---|---|
| Account | Your email address and name, as QuxCloud gives them to us when you sign in with it. Where an operator runs qux.chat with its own sign-in, your password is stored only as a salted, peppered one-way hash (argon2id) — never readable, even by us. | To give you an account and sign you in. |
| Sign-in and security | For each session: its start and last-seen times, and the IP address and browser description it came from. A log of security events (sign-ins and similar) with the same details. | To keep your account secure and investigate abuse. |
| Workspaces | Each workspace's name, its members and their roles, its plan, and its API keys — stored only as one-way hashes, with the name, scopes and last-used time you see in the console. | To run your workspaces and authenticate your application. |
| Usage | Counts of messages and monthly active users per workspace. Active users are counted from a one-way hash of the id your application gives them, salted per workspace, never the id itself. | To apply your plan's limits and show your usage. |
| Customer Content | Conversations, participants and the ids your application gives them, messages, attachments, uploaded media, read state, webhook addresses and their delivery records, and call signals. | Only to provide the Service to you. |
We run no analytics on the site or the console. We do not ask for, and ask you not to send, sensitive information such as government ID numbers, health information or payment card details.
4. How we use information
- to run the Service: accounts, workspaces, keys, the chat API, webhooks, media and calls;
- to apply plan limits and show you your usage;
- to keep the Service and your account secure, and to prevent fraud and abuse;
- to send service emails, such as security notices and changes to the Service;
- to comply with the law and enforce our Terms.
We do not use Customer Content to train or evaluate artificial-intelligence models, to advertise, or for any purpose of our own. Our staff look at it only when you ask us to, to keep the Service secure, or when the law requires it.
6. How long we keep it
- Account and workspace information: while your account is open, then deleted as described in section 7.
- Customer Content: until your application deletes it, or the workspace is closed, after which it is deleted within a reasonable time.
- Sessions: until they expire or you end them; security events for as long as needed to protect accounts.
- Usage counts: as long as needed for billing and our records.
7. Your choices and rights
You can see your workspaces, their keys and their usage in the console. You can also ask us, at [Legal and privacy contact email], to:
- give you a copy of the personal information we hold about you;
- correct it;
- delete your account and personal information (we may keep what the law or our records require);
- object to or restrict a use of it.
We will verify the request comes from you and respond within the time the law requires. Depending on where you live — for example in California or the European Economic Area — you may have further rights, including to complain to a data protection authority. We will not treat you differently for exercising them. Requests about Customer Content should go to the application that holds it; we will help that customer answer them.
8. How we protect it
API keys and passwords are stored only as one-way hashes; connections are encrypted in transit; each workspace's data is isolated from every other workspace's by the database itself, not just by our code. No system is perfectly secure, and we will tell you as the law requires if a breach affects your information.
9. Where it is stored
Our systems are hosted in [Hosting region]. If you use the Service from elsewhere, your information is transferred there, with the safeguards the law requires.
10. Children
Our accounts are for businesses and developers and are not directed to children. You must be at least 18 to have an account. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this policy
We will update this policy when what we collect or how we use it changes, and change the version and date at the top. For a material change we will give notice by email or on the Service before it takes effect.
12. Contact
Privacy questions and requests: [Legal and privacy contact email]. Post: [Legal entity name], [Registered address].