Data and privacy
What OyeChats stores, who is the controller of what, how long things are visible, and how deletion works. The binding detail is in the legal documents this page links to.
Who controls what
For your visitors' conversation data, you are the controller and OyeChats is the processor acting on your instructions. For your own account data (your login, your billing, your usage), OyeChats is the controller. The DPA sets out the processor terms and is incorporated into the Terms of Service.
What is stored
| Category | Examples |
|---|---|
| Account | Name, work email, hashed password, workspace and role. |
| Chatbot configuration | Prompt, appearance, business hours, and the knowledge base you supplied. |
| Conversations | Messages, timestamps, lead form submissions and derived qualification signals. |
| Visitor metadata | IP address, browser and device type, approximate location, the page the widget loaded on, referrer and UTM parameters. |
| Operator data | Names, emails, roles, activity logs and push notification tokens. |
| Billing | Plan, cycle, invoice history, and the brand plus last four digits of the payment instrument. |
Full IP addresses are recorded because geolocation, abuse prevention and repeat-visit detection are performed against them, but they are stripped at every boundary you can see: dashboard, export and API all return geography only.
Retention and deletion
- Chat history window
- Your plan governs how far back the dashboard and analytics show conversations. This is a visibility window: reaching the end of it does not by itself delete the underlying records.
- Deleting content
- Removing a document or page from a knowledge base removes it and its indexed passages. Deleting a chatbot removes its knowledge base, conversations and leads.
- Expired trials
- A trial that ends without converting has its chatbots, knowledge and conversations deleted after a short grace window.
- Account deletion
- Request full deletion of a workspace and its data via support. Retention required for statutory purposes (invoices, tax records) is described in the Privacy Policy.
Sub-processors and security
OyeChats uses third-party providers for model inference, hosting, storage, email delivery, payments and error monitoring. The current list, with what each one processes and where, is published at Sub-processors.
Security practices are described on the Security page. Vulnerability reports go through responsible disclosure.
Something here wrong or missing? Tell us and name this page. We will fix it.