Privacy Policy

This policy explains how Ringpixel LLC(“we”, “us”), operator of chatlasso, collects, uses, shares, and deletes information when you use chatlasso.com, app.chatlasso.com, and related services (the “Service”). It also contains the data deletion instructions required for apps that use Meta platform APIs.

1. Information we collect

• Account information: name, email address, password (stored as a salted hash, never in plain text), and optional profile details.
• Workspace content: the flows you create (trigger terms, reply text, links), team memberships and roles, and support tickets.
• Instagram data (via the official Instagram API, with your authorization): your professional account's ID and username, an access token (stored encrypted with AES-256-GCM), and the comments, direct messages, button taps, and follower-status signals needed to run your flows. We request only the permissions the product needs: basic account info, message handling, and comment handling.
• Billing information: handled by Stripe. We store your subscription status and Stripe identifiers; full card numbers never touch our servers.
• Usage and log data: sign-in events, IP addresses, and product events used for security auditing and support.

2. How we use information

We use your information solely to operate the Service: running your flows, sending the replies you configured, counting sends and follows, billing, support, and security. We do not sell personal data, we do not use your data for advertising, and we do not use Instagram data to train machine-learning models. Instagram data received through Meta's APIs is used only to provide the features you asked for, consistent with the Meta Platform Terms.

3. Sharing

We share data only with processors needed to run the Service, under contracts that limit their use of it:

• Stripe (payments), our email delivery provider (transactional email), and our hosting providers (compute, storage, backups).
• Meta Platforms, Inc., to the extent that operating your flows requires API calls to Instagram on your behalf.
• Authorities, where required by law, after reviewing the request's validity.

4. Security

Access tokens and other secrets are encrypted at rest (AES-256-GCM); passwords are hashed; transport is encrypted with TLS; webhook payloads from Meta are verified with signatures; sign-in is protected with rate limiting and optional two-factor authentication; and tenant data is isolated per workspace in every query.

5. Retention

We keep your data while your account is active. Disconnecting an Instagram account deletes its access token immediately. Deleted workspaces are purged from production systems within 30 days; encrypted backups age out on a rolling schedule of up to 35 additional days. We may retain minimal billing records where tax law requires.

6. Data deletion instructions

You can delete your data at any time, in three ways:

• Disconnect Instagram: in the app, go to Integrations and disconnect an account. Its access token is deleted immediately and flows stop for that account.
• Delete your workspace: go to Settings → Workspace → Delete workspace. All workspace data, including Instagram data, flows, and contacts, is removed from production within 30 days.
• Email us: send a deletion request to hello@chatlasso.com from your account email. We confirm completion within 30 days.

7. Your rights

Depending on where you live (including the EU/EEA under GDPR and California under CCPA/CPRA), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Contact us and we will respond within the legally required period. You may also lodge a complaint with your local supervisory authority.

8. Children

The Service is not directed to children and may not be used by anyone under 18.

9. International transfers

We process data in the United States. Where data of EU/EEA or UK residents is transferred, we rely on standard contractual clauses with our processors.

10. Changes and contact

We will announce material changes to this policy by email or in-app before they take effect. Questions and requests: Ringpixel LLC · hello@chatlasso.com.