1. Who we are
ChatRhino is operated by [legal entity name], [registered address] (“ChatRhino”, “we”). Contact: support@chatrhino.ai. [Grievance officer name and contact, as required under the DPDP Act and IT Rules.]
2. Two roles
- For our customers' end users (people who message a business that uses ChatRhino): the business is the Data Fiduciary. We are its Data Processor and act on its instructions under our agreement. Please contact that business first about your data.
- For our own users and visitors (people who sign up, log in, contact us or visit this website): we are the Data Fiduciary.
3. What we process
| Data | Whose | Why |
|---|---|---|
| Name, work email, password hash, MFA factors and passkey public keys, session records, IP address and user agent | Workspace users | Provide accounts, keep them secure, prevent abuse |
| Conversations, messages, media, contact details (phone, email, channel IDs), custom fields, consent records | Our customers' end users | Provide the inbox, agents, campaigns and integrations on the customer's instructions |
| Billing account details, GST details, invoices, wallet and ledger entries | Customers and partners | Billing, tax and accounting |
| Audit events (who did what, when, from which IP) | Workspace users | Security and accountability |
| Contact form details (name, email, company, phone, message) | Website visitors who contact us | Reply to your enquiry |
| Server logs (IP, URL without query string, time) | Website visitors | Operate and secure the site |
This website does not use advertising cookies. [Update this if analytics are added — see the launch checklist.]
4. Legal basis and consent
We process data of our own users on the basis of consent given at sign-up and for legitimate uses permitted by the DPDP Act (for example to comply with law). Our customers are responsible for obtaining consent from their end users, including WhatsApp opt-in; ChatRhino records opt-in and opt-out and enforces opt-out in campaigns.
5. Where data is stored
Production data is stored on Amazon Web Services in the Mumbai region (ap-south-1). Data may be processed outside India by the sub-processors below, where permitted by law.
6. Who we share data with
- Hosting: Amazon Web Services (storage, compute, email delivery).
- Channel providers the customer connects: Meta (WhatsApp, Instagram, Messenger), 360dialog, Telegram, Twilio, MSG91, Gupshup, email providers.
- AI providers when AI features are used: Anthropic (language model) and an embeddings provider [name]. They receive the text needed to answer, summarise or draft, and may process it outside India. [Confirm provider terms on data retention and training.]
- Integrations the customer connects (for example Shopify, Razorpay, HubSpot, Zoho), limited to what each needs.
- Authorities where required by law.
We do not sell personal data.
7. Security
Encryption in transit and at rest, envelope encryption for credentials, tenant isolation enforced in the database, MFA and SSO, and an append-only audit log. See security.
8. Retention
Customers choose how long conversations and contacts are kept in their workspace. We keep account and billing records for as long as needed for the contract and as required by tax law [period]. Contact-form enquiries are kept for [period].
9. Your rights
Under the DPDP Act you may request access to a summary of your data, correction and completion, erasure, and grievance redressal, and you may nominate another person to exercise your rights. You can withdraw consent as easily as you gave it. Email support@chatrhino.ai. If you message a business that uses ChatRhino, contact that business first; we will help them respond. If you are not satisfied, you may complain to the Data Protection Board of India.
10. Children
ChatRhino is a business tool and not directed at children. Customers that message children must obtain verifiable parental consent where the law requires it.
11. Changes
We will post changes here and notify customers of material changes.