Privacy Policy

Last updated: April 1, 2026

1. Information We Collect

Information you provide

When you create an account, configure chatbots, or contact us:

  • Account data: name, email address, organization name, profile photo
  • Content: chatbot configurations, data sources you upload, system prompts, welcome messages
  • Communications: support requests, feedback, and other messages you send us

Information collected automatically

  • Usage data: pages visited, features used, actions taken in the dashboard
  • Device data: browser type, operating system, screen resolution, IP address
  • Conversation data: messages between your end-users and chatbots, including customer names and emails when provided

2. How We Use Your Information

  • Provide, operate, and maintain the CustomerHero platform
  • Process conversations through our AI provider (OpenAI) to generate responses
  • Generate vector embeddings from your data sources for knowledge base search
  • Send transactional emails: account verification, password resets, usage alerts
  • Analyze aggregate usage patterns to improve the product (we never train AI models on your data)
  • Respond to your support requests and feedback
  • Detect and prevent fraud, abuse, or security incidents

3. Data Storage & Security

Your data is stored in PostgreSQL databases hosted on managed, encrypted infrastructure (Neon for managed hosting, Cloudflare Workers for compute). All data is encrypted in transit using TLS 1.3 and at rest using AES-256.

Each organization's data is logically isolated. We enforce row-level access controls — queries always filter by organization ID. No customer can access another organization's data.

Access to production databases is restricted to authorized engineering personnel using short-lived credentials and multi-factor authentication. We maintain audit logs of all administrative access.

4. Third-Party Services

We share data with these providers to operate the service:

OpenAI

Conversation content and data source text are sent to generate AI responses and vector embeddings. We use their API with data processing agreements — they do not use your data to train their models.

Resend

Transactional email delivery (account verification, password reset, and notification emails). Processes recipient email addresses and message content.

Cloudflare

Application hosting, CDN, and browser rendering for URL data source ingestion. Processes request metadata and page content.

Stripe

Payment processing. Handles credit card information — we never see or store your full card number.

5. Your Rights

Depending on your location, you have the right to:

  • Access your personal data and receive a copy
  • Correct inaccurate or incomplete data
  • Delete your data and account
  • Export your data in a machine-readable format
  • Object to or restrict certain processing
  • Withdraw consent at any time where processing is consent-based

We support GDPR (EU), CCPA (California), and LGPD (Brazil) requirements. To exercise any right, email privacy@customerhero.app. We respond within 30 days.

6. Cookies

We use essential cookies for authentication (session token) and locale preference. We do not use third-party advertising or tracking cookies. Analytics are collected server-side without cookies.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account:

  • Personal data and conversation histories are deleted within 30 days
  • Backups containing your data are purged within 90 days
  • Aggregate, anonymized analytics may be retained indefinitely
  • Data required for legal compliance may be retained as required by law

8. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

9. Contact

Questions about privacy? Email privacy@customerhero.app.