Privacy Policy

The platform is operated by AI Skills S.R.L., Chișinău, Republic of Moldova (hereinafter “we”). You can contact us at vladw239@gmail.com.

For conversations held with a company that uses ChatAssist, that company is the data controller of your data and we act as data processor: we process the messages on its behalf, on its instructions. For the data of the platform's user accounts (the employees of client companies), we are the data controller.

• Conversation content — the messages sent and received on the connected channels, together with the time they were sent.
• Identification data from the channel — the display name, the user identifier of the messaging platform (Telegram, Meta), the username and, where the channel provides them, the phone number or the e-mail address.
• Account data — for platform users: the e-mail address, the display name and the log of the actions performed in the application.
• Technical data — operational logs needed for security and troubleshooting.

We do not collect data for advertising purposes and we do not sell data to anyone.

• Providing the service — receiving, displaying and sending messages (performance of the contract with the client company).
• AI assistance — analysing the conversation (summary, urgency, intent) and generating suggested replies, which the company may send automatically or after review by a human operator (the company's legitimate interest in replying promptly; the company configures the degree of automation itself).
• Security and accountability — an audit log of actions and the prevention of abuse (legitimate interest and legal obligations).

We use the following providers, strictly for the operation of the service:

• Meta Platforms (Messenger, Instagram) and Telegram — they deliver the messages; processing on their own platforms is governed by their own policies.
• OpenAI (USA) — analyses the conversation and suggests replies. Before data is sent, sensitive identifiers are automatically stripped from the messages (IDNP, the Moldovan personal identification number, card numbers, IBAN, keys and access tokens); what is transmitted is the most recent messages of the conversation, which may include the name, the e-mail address or the phone number, where the customer wrote them in the message or the channel provides them. The data is not used by OpenAI to train models, in accordance with that sub-processor's data processing agreement.
• Supabase — hosting of the platform's database.
• Google Cloud — hosting of our servers.

Transfers outside the Republic of Moldova and the European Economic Area are based on the standard contractual clauses included in the data processing agreements of these providers.

• The raw technical copies of the events (the notifications received from the messaging platforms) are deleted automatically after 30 days.
• Conversations and contact data are retained for as long as the client company has an active account and needs the history of its relationship with the customer, or until a deletion request is made.
• The audit log is retained for accountability and security purposes and is deleted together with the data it refers to.
• The record of a deletion request received through Facebook is kept as proof that we acted on the request: 30 days after it is completed we delete its identifier, so that the remaining row can no longer be tied to a person, and after 90 days we delete it entirely, at which point the confirmation code stops working. This retention is deliberately short and bounded: otherwise the very mechanism by which we comply would look like keeping data after being asked to delete it.

• All traffic is encrypted in transit (HTTPS/TLS).
• The companies' access keys and tokens are stored encrypted (AES-256-GCM), with the encryption key kept separate from the database.
• Access to data is segregated per company: the staff of one company cannot see another company's conversations.
• The endpoints on which we receive notifications are authenticated before anything is processed: the Meta callbacks through an HMAC-SHA256 signature over the request body, and the webhook that brings in the messages through a secret of our own, compared in constant time. A request that does not validate is rejected.

Under Legea nr. 195/2024 privind protecția datelor cu caracter personal (Law no. 195/2024 on the protection of personal data) of the Republic of Moldova and, where applicable, under the GDPR, you have, as a data subject, the right of access to your data and the rights to rectification, erasure, restriction of processing, objection and portability.

To exercise these rights, write to us at vladw239@gmail.com or address the company you conversed with directly. How erasure is carried out in practice is described on the Data deletion page. We answer a data subject access request within one month at the latest.

If you consider that your rights have been infringed, you may lodge a complaint with the Centrul Național pentru Protecția Datelor cu Caracter Personal (National Centre for Personal Data Protection, CNPDCP) of the Republic of Moldova (datepersonale.md).

The AI assistant suggests replies to messages and, if the company has enabled automatic replies, sends them. No automated decisions with legal effects, or with similarly significant effects on individuals, are taken. When the assistant does not have enough information or the subject is sensitive, the conversation is handed over to a human operator; you can ask at any time, within the conversation, to speak to a person.

We will update this policy whenever the operation of the service changes. The current version, together with the date it was updated, is published permanently at this address.

This English text is a courtesy translation, provided for information only. The legally binding version of this privacy policy is the Romanian one, published at Politica de confidențialitate. In the event of any discrepancy between the two versions, the Romanian version prevails.