This policy explains how personal data is handled when you talk to a Chatbot Coastal assistant on a business's website, on its WhatsApp number, on its Facebook Page (Messenger) or on its Instagram account. It is written in plain language on purpose.
1. Who we are
Chatbot Coastal is operated by Xelion S.R.L. ("Xelion", "we", "us"). You can reach us about anything in this policy at [email protected].
Chatbot Coastal is a chat assistant that businesses ("our clients") add to their own channels. It answers visitors' questions using the information published on the client's own website, and it says clearly in its first message that it is an AI assistant, not a person.
Our role. For the conversations you have with a client's assistant, the client (the business you are writing to) decides why and how your data is used, and Xelion processes it on the client's behalf. For our own client accounts, our systems and the running of the service, Xelion is responsible for the data.
2. What data we handle
- Your messages and the assistant's replies, kept together as a conversation.
- An identifier for you on the channel. On WhatsApp this is your phone number. On Messenger and Instagram it is a number Meta assigns to you for that Page or account (we do not receive your profile, friends or contacts). On a website it is a random conversation code created by the chat window.
- On websites only: the address of the page you were on when you wrote, and the language of the page.
- Details you choose to give, such as a name, email address or phone number, if you type them into the conversation or into a contact card the assistant shows.
- Voice notes on WhatsApp. If you send one, it is converted to text so the assistant can answer. The conversation keeps the text. Pictures and Messenger or Instagram voice messages are not read; the assistant asks you to write instead.
- Technical records: message identifiers, times, whether a reply succeeded or failed, and usage counts. The company that hosts the service also processes standard connection data (such as your IP address) when you use the website chat window.
Please do not send sensitive information (health, payment card numbers, passwords, identity documents) in a chat. The assistant does not need it.
3. Why we use it
- To answer your question, using the client's website information.
- To send a copy of the conversation to the business, so its team can follow up. The business receives the conversation by email, together with any contact details you left.
- To show the client how the assistant is doing and which questions it could not answer, and to fix mistakes.
- To keep the service secure, prevent abuse and respect daily limits per sender.
We do not sell your data, and we do not use your conversations to build advertising profiles. The assistant does not make decisions that have legal or similarly significant effects on you.
4. Who receives it
We use the following providers to run the service. Each only receives what it needs:
- Meta Platforms (WhatsApp, Messenger, Instagram): delivers your messages to us and our replies to you, under its own terms and privacy policy.
- OpenAI: writes the answer. It receives your message, recent messages of the conversation, relevant text from the client's website, and, for WhatsApp voice notes, the audio to be transcribed.
- Supabase: stores the conversations and settings in a database.
- Vercel: hosts the service.
- Resend: sends the conversation email to the business.
- Sentry: records technical errors so we can fix them.
The client (the business) receives the conversations it is responsible for. We disclose data to authorities only when the law requires it.
5. Transfers outside your country
Some of these providers are located in, or process data in, the United States or other countries. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.6. How long we keep it
Conversations are kept for as long as the client uses the assistant, unless they are deleted earlier. They are deleted when you ask us to (see section 8), when the client asks us to, or when the client's assistant is permanently removed. Technical error and usage records are kept only as long as needed to run and improve the service.7. Your rights
Depending on where you live (for example, under the EU and UK GDPR), you can ask for access to your data, correction, deletion, restriction or portability, and you can object to its use. You can also complain to your data protection authority. To use these rights, write to [email protected]. You can also write directly to the business whose assistant you spoke with.
Stopping the assistant on WhatsApp: send the word STOP and it will stop answering you; send START to turn it back on.
8. Data deletion instructions
To have your conversation data deleted:
- Send an email to [email protected] with the subject "Delete my data".
- Say which channel you used (WhatsApp, Facebook Messenger, Instagram or a website), the business you wrote to, and the phone number (WhatsApp) or the name of your Facebook or Instagram account you wrote from, so we can find the conversation. We may ask you to confirm that you are the person concerned.
- We will delete the matching conversations from our systems and confirm by email, normally within 30 days.
A copy of the conversation may already have been emailed to the business, which then holds it under its own responsibility; we will tell you how to ask it to delete its copy.
9. Children
The assistant is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has written to an assistant, contact us and we will delete the conversation.10. Security
Access to the service's systems is restricted, connections are encrypted, and access keys are stored encrypted. No system is perfectly secure, and we cannot guarantee absolute security.11. Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will place the new version at the same address.