Privacy Policy

Business customers and this website. For account, billing and website data, we decide how the data is used and are responsible for it.

Website visitors who chat with an assistant. The business that runs the assistant decides why those conversations are collected. We process them on that business’s behalf, following its instructions and these terms. If you chatted with an assistant on a business’s website, contact that business first about your data; we will help them respond.

• Account data: name, email address, business name, website address, role, and a salted hash of your password (never the password itself).
• Content you add: website pages we import for you, text, FAQs, assistant settings and corrections.
• Conversations: messages between visitors, the assistant and your team, and contact details visitors choose to leave (such as name and email).
• Billing data: plan, invoices and payment status. Card details are collected and held by Stripe; we never receive them.
• Usage and technical data: replies used, knowledge size and timestamps; server logs with IP address, browser type, page requested and status. Query strings, request bodies and chat contents are not written to server logs.
• Security signals: IP addresses for rate limits and free-trial abuse checks are stored only in hashed or shortened form.

• To provide the service: building your assistant, answering visitors, showing conversations and leads, and sending account and usage emails.
• To bill you and prevent misuse of the free trial and the service.
• To keep the service secure and reliable, and to fix problems.
• To meet legal obligations.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and securing the service, and legal obligations. We do not use your content or conversations to train AI models.

We share personal data only with the service providers that help us run Frontal Chat, listed with their purpose and location on the subprocessors page, and when required by law or to protect rights and safety. If our business is sold or reorganized, data may transfer to the new owner under this policy.

We use OpenAI to provide the AI features. To write an answer, the visitor’s message, recent messages in the conversation, relevant excerpts of the business’s knowledge and the assistant’s instructions are sent to OpenAI. Knowledge, visitor questions and corrections are also sent to OpenAI to create the search index (embeddings), and corrections a business makes are turned into question variations.

We do not use this data to train AI models. Under OpenAI’s API data-use terms, data sent to its API is not used to train OpenAI’s models unless the customer opts in; we have not opted in. OpenAI may keep API data for up to 30 days to detect and prevent abuse, or longer where the law requires. We send answer requests with OpenAI’s response storage turned off. If a business adds its own OpenAI key, the terms of that business’s OpenAI account apply to requests made with it.

• Account, content and conversations: while the workspace exists. The business can delete content, and the owner can delete the account; we then delete the workspace data from the live service.
• Free trials that end without a purchase: knowledge, conversations and leads are deleted 30 days after the trial ends, with notice beforehand. We keep a minimal record (dates, usage counts and hashed identifiers) to prevent repeated trials.
• Visitor chat sessions on a business’s website expire after 30 days without use and at most after 90 days.
• Database backups are kept for up to about five weeks. Server logs are kept for up to 30 days.
• Billing records are kept as long as tax and accounting law requires.

We use HTTPS, encryption of stored provider keys, hashed passwords and tokens, separation between workspaces and restricted server access. More detail is on the security page. No system is perfectly secure; we will notify affected customers of a breach as the law requires.

Our servers are in the United States (DigitalOcean, New York (United States)), and our main providers process data in the United States. If you are outside the United States, your data is transferred there. Where required, we rely on appropriate safeguards such as the providers’ standard contractual clauses.

Depending on where you live (for example under the GDPR in the EU and UK, or state privacy laws such as California’s), you may have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict some processing. You will not be treated differently for using these rights.

Email privacy@frontalchat.com to make a request. We may need to confirm your identity. If you chatted with a business’s assistant, we may pass your request to that business. You can also complain to your local data protection authority.

We use only cookies and storage needed for sign-in, security and the chat window, and no analytics or advertising cookies. Details are in the Cookie Policy.

Frontal Chat is a service for businesses and is not directed at children under 13. Businesses must not use it to knowingly collect children’s data.

We will post changes here and update the effective date. For material changes we will notify business customers by email or in the dashboard.

Frontal Web, Miami, Florida, United States. Privacy questions and requests: privacy@frontalchat.com.