Privacy Policy

i-⁠Chat (i-chat.eu, with its panel at hq.i-chat.eu) is provided by Igor Gerweck, sole proprietor, Pulvermühlenweg 7, 34125 Kassel, Germany. For anything about your data, write to support@i-chat.eu. The provider’s full details are in the Legal Notice.

We handle two kinds of personal data, in two different roles:

• Businesses that use i-⁠Chat. For your own account, billing details and support chats, we decide how the data is used. We are the controller.
• People who write to those businesses on Instagram, WhatsApp or Threads. Their messages and contact details belong to the business they wrote to. The business is the controller, and we process this data only on its behalf and on its instructions. We are the processor.

If you wrote to a business that uses i-⁠Chat, please ask that business first about your data. We help the business answer you, and you can also write to us.

• Your account: email address, a hash of your password (never the password itself), your name, optional billing details (phone, address, VAT number), sign-in sessions and devices, and your notification settings.
• Channels you connect. Their access tokens are encrypted at rest.
  • Instagram professional account: ID, username, name, profile picture, follower count, the account’s own posts and their statistics.
  • WhatsApp Business Account: account and phone number IDs, the display number, verified name, quality rating, message templates and their status, and whether a payment method is set up.
  • Threads profile: ID, username, name and profile picture.
• Conversations with your customers: comments, direct messages, story replies and mentions, WhatsApp messages and the files in them, Threads replies and mentions, and the replies sent by you or your automations. For each contact: name, username, phone number, tags, consent and opt-out status, and the notes you write.
• What you set up: auto-replies, automations, broadcasts and saved replies.
• Technical records: webhook deliveries from Meta, the send history, taps on links you send (time, browser, and a one-way hash of the IP address, never the address itself), and diagnostics.
• Support: the messages and screenshots you send to i-⁠Chat support.
• Cookies: only the ones that keep you signed in and remember your language. No advertising or analytics cookies, and no third-party trackers.

Only to provide the service you set up:

• receive Meta’s notifications (webhooks) and match your keywords;
• send your replies and broadcasts through Meta’s official APIs;
• show your Chats, Contacts, History and Stats;
• sign you in, send you the notifications you chose, and answer your support questions;
• prevent duplicate sends, fix problems and keep the service secure.

We do not sell data, use it for advertising, build profiles, or use data from Meta for any other purpose.

For your own account, the legal basis is our contract with you, and our legitimate interest in keeping the service secure. For your customers’ data we act on your instructions, as described in the Terms of Service; you, as the controller, are responsible for having a legal basis to message them.

We never delete or use your customers’ data on our own: it is yours, and it stays under your control. Only the technical records listed under How long we keep data expire by themselves.

i-⁠Chat never asks for your Instagram, Facebook, WhatsApp or Threads password, does not scrape, and does not use browser automation. It only accesses the accounts you connect through Meta’s own login screens, and only for the features above. You can disconnect an account at any time.

i-⁠Chat runs on a server in the European Union: the application, its database and its queue are all there. Its backups are encrypted and are also kept in the EU.

i-⁠Chat’s server, database and backups are in the EU. Data leaves the EU only in these cases:

• Email delivery: our email delivery service keeps its delivery records (recipient, subject, time and status) in the United States. That transfer is covered by the EU standard contractual clauses in our agreement with it.
• Meta: Instagram, WhatsApp and Threads are Meta’s services. Meta Platforms Ireland Limited may process messages outside the EU, under its own terms and safeguards.
• Your own AI provider: if you turn on AI replies, where your provider processes data is governed by your agreement with it (see below).

To get a copy of the safeguards that apply, write to support@i-chat.eu.

These service providers process data for us, only as far as each one needs to:

• A hosting provider in the European Union: the server described above, where i-⁠Chat and its database run.
• Meta Platforms Ireland Limited (Ireland): the Instagram, WhatsApp and Threads APIs, which deliver your customers’ messages to us and send your replies.
• An email delivery service: sign-in codes and notification emails, which can include a contact’s name and the details they left. The service keeps its delivery records in the United States (see Transfers outside the EU).
• An AI service in the EU: the support assistant inside the panel. When you ask support a question, it sees your messages, any screenshots you attach, and what it looks up in your own account to answer you: connected account usernames, auto-reply texts, and short excerpts of messages that were sent. The data is processed in the EU and is not used to train AI models.
• Encrypted backup storage in the EU: encrypted copies of the database and of uploaded files, so the service can be restored after a failure.

A current list of our service providers is available on request at support@i-chat.eu.

AI replies are optional and off unless you turn them on. To use them, you connect your own account with an AI provider you choose (Anthropic, OpenAI, Google Gemini, or any provider with an OpenAI-compatible API) using your own API key. i-⁠Chat does not choose, provide or pay for that AI.

When AI replies are on, i-⁠Chat sends your provider the message the person wrote, the most recent messages of that conversation, and the description you wrote about your business, so that it can write an answer. You choose the provider and are the controller for that choice; your own agreement with the provider governs how it handles the data, including where it is processed. Your API key is stored encrypted and used only for these requests. Nothing is sent to any AI provider for a business that has not turned AI replies on.

• Your account and everything in it (connected channels, contacts, conversations, automations, auto-replies, broadcasts, saved replies, notes and send history): while your account is active. When you delete your account (Settings → Delete account), all of it is deleted at once.
• Disconnecting a channel deletes its connection, its access token and its auto-replies at once.
• Deleted data also disappears from our encrypted backups within 30 days, as they are overwritten.

While your account is active, some records have their own, shorter periods:

• Raw webhook deliveries from Meta (which contain names and message text): 30 days.
• Requests made with your API keys: 30 days.
• Deleted auto-replies and automations stay in “Deleted” for 30 days, then are erased with everything they recorded.
• Records of new-follower notifications (account IDs and usernames, no message text): 365 days.
• Sign-in codes: 24 hours after they expire.
• Screenshots sent to support: 90 days (24 hours if never sent).
• Support chats close after a day without activity and are then kept as your support history while your account exists.

To create an account we need your email address: without it we cannot sign you in or reach you about your account. Everything else is optional, or comes from the channels you choose to connect.

We make no decisions about anyone based solely on automated processing, including profiling, that have legal or similarly significant effects. The auto-replies and automations in i-⁠Chat are set up and controlled by each business.

Connections are encrypted (HTTPS). Access tokens and AI provider keys are encrypted at rest with AES-256-GCM. Every notification from Meta is checked against Meta’s signature before we act on it. Each business sees only its own workspace.

You can ask for a copy of your data, its correction or deletion, restrict or object to its processing, or take it to another service. Write to support@i-chat.eu from the address you sign in with. We answer within one month. If you wrote to a business that uses i-⁠Chat, the business answers these requests, and we help it.

To delete your account and everything in it yourself, at any time: Settings → Delete account, then confirm in the email we send you.

How to disconnect a channel or delete everything is on the Data Deletion page. Deletion requests made from Facebook, Instagram or Threads reach us through our data deletion callback, and the panel shows their status.

You can also complain to the data protection authority in your country.

i-⁠Chat is a service for businesses and is not meant for children.

When this policy changes, we update this page and its date. We tell businesses that use i-⁠Chat about important changes by email.

Email: support@i-chat.eu