This policy explains how [Company legal name] ("Chatoo", "we") handles personal data when you use the Chatoo website, your Chatoo account and the Chatoo desktop app. The data controller is [Company legal name], [Registered address]. Contact: [Privacy contact email].

1. Data we collect

Your account

Your name, email address, username and display name, and whether your email is verified.
Your password, stored only as a hash. We cannot read it.
If you turn on two-step verification: the secret and backup codes it needs.
If you sign in with Discord: your Discord account ID and the tokens Discord gives us for that sign-in.
Account status, such as your role and whether the account is suspended.

Sign-in sessions

For each device you are signed in on: a session token, when it expires, the IP address and the browser or device description (user agent). Short-lived codes for email verification and password resets are kept until they are used or expire.

Licenses

If you link an existing VoiDeD Inside Circle license to your account: a masked copy and a one-way hash of the license key, and its status, plan and expiry date.

Billing

If you choose a paid plan: your plan, billing interval, number of seats, billing status, and the customer and subscription IDs that Stripe gives us. Your card details are entered on Stripe's checkout page and go straight to Stripe; we never see or store your full card number.

Free trial devices

To allow one free trial per computer, the Chatoo app sends a device identifier when you sign in during a trial, together with the platform (Windows or macOS) and the app version. The app never sends your computer's raw machine ID: it sends a one-way hash of it, and we store only a further keyed hash of that value. We do not use your IP address or network for this.

Messages you send us

When you use the contact form: your name, email address, the topic you chose, your message, a one-way hash of your IP address, your browser's user agent and the time. When you join the waitlist: your email address, which page you joined from and the time.

Security data

To stop abuse we keep short-lived counters of sign-in attempts, keyed by a one-way hash rather than your IP address or email.

The desktop app

[Describe what the desktop app stores on your device, and what, if anything, it sends to Chatoo's servers or to an AI provider when it generates drafts. Name the AI provider(s) and link their terms.]

2. The website

The website runs no analytics or advertising trackers today. If we add analytics, they stay off until you allow them in the cookie card, and you can change your choice under "Cookie preferences" in the footer. The Cookie Policy lists the small amount of browser storage the site uses.

3. Why we use your data

To provide the service (performing our contract with you): your account, sign-in, sessions, license and billing.
To keep free trials fair (legitimate interests): the hashed trial device identifier, so each computer gets one trial.
To keep the service secure (legitimate interests): session details, sign-in counters and hashed IP addresses.
To answer you (legitimate interests, or steps before a contract): contact messages.
To tell you about the launch or pricing (consent): the waitlist. You can ask to be removed at any time.

[Confirm the legal basis for each use with counsel, for each place you serve.]

We don't sell your personal data. We share it only with service providers that help us run Chatoo, under contracts that limit how they use it:

Hosting: [Hosting provider and location].
Email delivery: [Email provider].
Payments: Stripe, which processes payments for us and receives the details you enter at checkout. [Confirm the Stripe entity and its role, and link Stripe's privacy policy.]
Discord, if you choose to sign in with Discord.

We may also disclose data when the law requires it.

5. International transfers

[Explain where the data is stored and the safeguards used for any transfer outside your region.]

6. How long we keep it

Account data: while your account exists, then deleted within [period] of closing it.
Sessions: until they expire or you sign out.
Contact messages: [period].
Waitlist: until launch plus [period], or until you ask us to remove you.

7. Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict some uses, and withdraw consent. Contact [Privacy contact email]. You can also complain to your data protection authority.

8. Children

Chatoo is not for anyone under [Minimum age]. We don't knowingly collect data from children.

9. Changes

We will update this page when our practices change, and tell you about significant changes.