Privacy Policy

1. Introduction

Broadchat ("Company", "we", "us") operates the Broadchat platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information: Name, email address, password (hashed), organization name, phone number.

Usage Data: Pages visited, features used, API calls made, IP address, browser type, device information.

Communication Data: Messages sent/received through the platform, contact information of your customers (as uploaded by you), campaign data, chatbot interactions.

Payment Data: Subscription details, wallet transactions. Payment processing is handled by third-party providers; we do not store card numbers.

3. How We Use Your Information

• To provide and maintain the Service
• To process transactions and manage subscriptions
• To send WhatsApp messages on your behalf via Meta Cloud API
• To provide customer support
• To send administrative notifications (service updates, security alerts)
• To improve and optimize the Service
• To detect and prevent fraud or abuse

4. Data Storage & Security

Your data is stored on secure servers with encryption at rest and in transit (TLS 1.2+). We implement industry-standard security measures including:

• Password hashing (bcrypt)
• JWT-based authentication with short-lived tokens
• Webhook signature verification (HMAC-SHA256)
• Role-based access control
• Multi-tenant data isolation
• Rate limiting on API endpoints

5. Data Sharing

We do not sell your personal data. We may share data with:

• Meta Platforms: Message content and phone numbers as required to deliver WhatsApp messages
• OpenAI: Message content sent to AI agents (when you use AI features)
• Service Providers: Database hosting, email delivery, payment processing
• Legal Requirements: When required by law, court order, or governmental authority

6. Multi-Tenancy & Data Isolation

Broadchat operates as a multi-tenant platform. Each tenant's data is logically isolated at the database level. Tenant administrators can only access data belonging to their organization. Super administrators may access aggregate statistics for platform management purposes.

7. Your Rights

You have the right to:

• Access and export your data
• Correct inaccurate information
• Request deletion of your account and data
• Withdraw consent for data processing
• Object to certain processing activities

To exercise these rights, contact us at privacy@broadchat.io.

8. Data Retention

We retain your data for the duration of your subscription. After account termination, data is retained for 30 days for export purposes, then permanently deleted. AI reply logs are automatically deleted after 60 days. Audit logs are retained for 12 months.

9. Cookies & Tracking

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising trackers. Local storage is used to persist user preferences and authentication tokens.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last updated" date. Material changes will be communicated via email.

11. Contact Us

For privacy-related questions or concerns, contact our Data Protection Officer at privacy@broadchat.io.