Chaitty Privacy Policy
Last updated: [DATE OF PUBLICATION]
Chaitty is an app for people who answer their company's WhatsApp messages at work. This policy explains what the app does with information, who can see it, and what you can ask us to do about it.
It is written to be read, not to be survived. If something here is unclear, write to [CONTACT EMAIL] and we will answer in plain words.
1. Who this policy is about
Two different groups of people appear in Chaitty, and the rules are not the same for both.
Agents. The people who sign in and use the app. They work for a business that uses Chaitty. If you are reading this because you downloaded the app, this is you.
The people your company messages. Customers and professionals who write to a business over WhatsApp. They never use Chaitty and most will never hear of it. Their messages appear in the app because the business they wrote to is reading them there.
2. Where your data actually lives
This matters more than anything else in this policy, so it comes first.
Chaitty does not keep a central copy of your conversations. The app is a window onto a server that belongs to the business using it, or that we operate on that business's behalf. Every conversation, message, photo, note and customer record stays on that server. The app fetches what is on the screen, over an encrypted connection, and keeps only what it needs on the phone to work.
This means that if you want to know where your company's messages are stored, who can read them, and how long they are kept, the answer belongs to your company, not to us. Ask your administrator. We can tell you how the app behaves. We cannot tell you what your employer does with its own records.
3. What the app collects from an agent
When you sign in, the app sends your company's server:
- Your email address and password, to prove who you are. The password is sent once, at sign-in, over an encrypted connection, and is never stored on the phone.
- The name of your device (for example "Ana's iPhone") and whether it is an iPhone or an Android, so that you and your administrator can tell your devices apart and sign out a lost one.
The server answers with an access token for that one device. It is stored in the phone's secure storage, the same place the system keeps passwords, and it is what keeps you signed in. Signing out deletes it and revokes it on the server.
While you use the app it also sends, to your company's server, the ordinary consequences of your work: the messages you write, the files you attach, the notes you leave, which conversations you opened and when you read them. That is the record of the job, and it is kept by your employer.
4. What the app keeps on your phone
- The access token and your company's address, in secure storage.
- Photos, videos, audio and documents from conversations you opened, in the app's temporary cache, so that they do not have to be downloaded twice. The system clears this on its own when space is needed, and deleting the app removes it at once.
- Your interface language and a few small preferences.
Nothing on this list leaves the phone except back to your company's server.
5. Push notifications
If you turn on notifications, the app gives your company's server a push token issued by Expo, the framework the app is built with. The server uses it to tell your phone that a message arrived.
You should know what a notification carries, because it travels further than the rest: the sender's name and a preview of the message text pass through Expo's push service and then through Apple's or Google's notification service on the way to your phone. That is how every push notification on every phone works, and it is the one place where message content leaves your company's server on its way to you.
If that is not acceptable for the kind of messages your company handles, turn notifications off in the phone's settings. The app works without them.
6. Who else can see anything
We use as few outside services as the app can function with. There is no analytics, no crash reporting, no advertising and no tracking of any kind in Chaitty. We do not profile you, we do not sell anything about you, and there is nothing in the app that follows you to other apps or websites.
The services that do touch data:
| Who | What reaches them | When |
|---|---|---|
| Your company's server | Everything in sections 3 and 4 | Always |
| Expo, then Apple or Google | The push token, the sender's name and the message preview | Only if you turn notifications on |
| Pusher | A conversation's numeric id when it changes, so the screen can refresh. No message content, no names | Always, while the app is open |
7. The people your company messages
If you wrote to a business over WhatsApp and are reading this: your messages are held by that business, on its own server, for its own purposes. Chaitty is the software it uses to read them, not the keeper of them. In the language of data protection law, the business is the controller and we are a processor acting on its instructions.
That means a request to see, correct or delete your messages has to go to the business you wrote to. If you send it to us, we will pass it on and tell you we did, but we cannot decide it for them.
Some businesses use automatic replies and translation, which means the text of a message may be sent to an artificial intelligence provider to draft an answer or translate it. Whether that is switched on is the business's choice, not ours.
8. Artificial intelligence
Where a business has switched it on, Chaitty can suggest a reply, improve a draft or translate a message. Doing that sends the relevant message text to a language model provider used by that business's server.
Suggestions are drafts. Nothing written by the assistant is sent to anyone until a human presses send, with one exception: a business can switch on automatic replies for itself, and then its own server answers without a person. That is the business's decision and its responsibility.
9. How long anything is kept
On the phone, until you sign out or delete the app, except the media cache, which the system clears whenever it likes.
On the server, for as long as the business keeps it. We do not set that period for businesses that run their own server. Where we operate the server for a business, records are kept for the life of the account and deleted within [RETENTION PERIOD] of the account closing.
10. Your rights
Depending on where you live, you can ask to see the personal data held about you, to correct it, to delete it, to get a copy in a portable form, to object to some uses of it, and to complain to a regulator. These rights come from the GDPR in the European Union, the UK GDPR in the United Kingdom and the LGPD in Brazil, among others.
Where we operate the server, write to [CONTACT EMAIL] and we will answer within the period the law allows. Where your company runs its own server, send the request to your company, which holds the records.
You can also, at any time and without asking anyone: sign out, which revokes that device; turn off notifications; and delete the app, which removes everything it kept on the phone.
11. Deleting your account
If your company runs its own server, only your administrator can remove your account, because it is their record of who works there.
Where we operate the server, you can ask us to close your account at [CONTACT EMAIL] or [ACCOUNT DELETION URL] and we will do it and confirm.
12. Security
Every connection between the app and a server is encrypted with HTTPS. Access tokens live in the phone's secure storage. Tokens are per device, so losing a phone means revoking one token, not changing a password everywhere. Credentials that businesses paste in to connect their WhatsApp number are encrypted where they are stored.
No system is perfect, and we would rather say that plainly than promise otherwise.
13. Children
Chaitty is a tool for work and is not meant for, or directed at, anyone under 16. We do not knowingly create accounts for children.
14. Changes
If this policy changes in a way that matters, the date at the top changes and we say so in the app or by email before the change takes effect.
15. Who we are
[LEGAL ENTITY NAME] [REGISTERED ADDRESS] [COMPANY REGISTRATION NUMBER]
Questions, requests and complaints: [CONTACT EMAIL]
WhatsApp is a trademark of Meta Platforms, Inc. Chaitty is not affiliated with, endorsed by or sponsored by Meta.