Privacy Policy
This policy explains what information Kavchat handles, why, where it is kept and for how long, and what choices you have. It covers the website kavchat.com, the dashboard at app.kavchat.com, the website widget, the SDKs and the API.
1. Who we are and our role
Kavchat is operated by maxsave. Contact: support@kavchat.com.
- For our customers' account data (the businesses that use Kavchat and their team members), we are the controller.
- For end-user data (people who chat with a business's bot), the business is the controller and Kavchat is the processor. If you chatted with a bot on a website or app, the business that runs it decides how your data is used. Please contact that business first about your data.
2. Information about our customers
- Account and team details: name, email address, login details, workspace name, and the roles of team members.
- Billing details: plan, payment status and the details needed for the tax invoice. Card payments are processed by a licensed, PCI DSS certified payment processor; we never see or store your full card number.
- Support correspondence: messages you send us.
- Technical data: IP address, browser type and request logs, used to run and secure the Service.
- Visits from ads: If you click an ad to reach us and then create an account, we store the ad details (campaign name and click ID). We report three events to the advertising platform where the ad appeared: account creation, your bot going live on your website or app, and your first payment. These reports include the click ID and email address, hashed with SHA-256 rather than sent as readable text. This helps us measure which ads work. We send nothing about anyone who did not arrive through an ad. You can object at any time by contacting us.
We use this information to provide the Service, process payments and invoices, send service and billing emails, answer support requests, prevent abuse, measure our ads and meet legal obligations. Where the GDPR applies, our legal bases are performance of a contract, our legitimate interest in running a secure service and in measuring our ads, and legal obligations (for example, keeping invoices).
3. Information about end users (processed for businesses)
- Conversation paths: which steps and buttons were used in a chat session, kept for 90 days for reports.
- Questions with no answer: free-text questions the bot could not match, kept for 90 days. Personal data such as email addresses and long digit sequences is removed from them automatically.
- Requests: details an end user submits in the contact form together with the conversation, kept until the business deletes them.
- Identity of logged-in users: if the business identifies its users with a signed token, the identifiers it chooses to pass, such as a user ID or phone number, for example to show the bot only to testers.
We process this data only to provide the Service to the business, as described in the data processing section of our terms of use.
4. Where data is stored and who helps us
| Service provider | Purpose | Location |
|---|---|---|
| Cloud hosting provider | Servers and database | Germany (European Union) |
| Email delivery provider | Sending service emails | European Union |
| Licensed payment processor (PCI DSS) | Card payment processing | Israel |
| Invoicing provider | Issuing tax invoices | Israel |
| The advertising platform where the ad appeared | Ad measurement, only for people who arrived through an ad | Depending on the platform, this may include locations outside the European Union |
If a customer turns on the optional AI features (Premium), questions that no script answers, together with the customer's published content, are sent to the AI provider the customer chose, under the customer's own account and key. The customer is responsible for that choice. Without AI turned on, nothing is sent to an AI provider.
The European Commission recognizes Israel as providing an adequate level of data protection. We do not sell personal information or share it for advertising purposes, except for the ad measurement described in section 2. End-user information is not sent to any advertising platform.
5. How long we keep information
- Conversation paths and questions with no answer: 90 days.
- Requests: until the business deletes them or deletes its workspace.
- Account data: while the workspace is active, and for a reasonable period after it is closed.
- Invoices and payment records: as long as tax law requires.
6. Cookies and local storage
- The kavchat.com marketing website does not use cookies or store anything in your browser. It has no analytics or advertising scripts. When you arrive through an ad, the ad details are passed only through link URLs, up to the signup page.
- The dashboard uses your browser's localStorage to keep you logged in.
- The widget uses localStorage and sessionStorage to cache the published script and keep a session ID for the conversation.
7. Security
Data is sent over encrypted connections (HTTPS), access to production systems is limited to those who need it, and user identity tokens are signed. No system is completely secure, so we also keep data collection to what the Service needs.
8. Your rights
Depending on where you live, including under the Israeli Privacy Protection Law and the GDPR, you may have the right to access, correct or delete your personal data, to object to or restrict certain processing, and to receive your data in a portable format. To use these rights for account data, email support@kavchat.com. End users should contact the business that runs the bot; we will help that business respond. You may also complain to your data protection authority, such as the Israeli Privacy Protection Authority.
9. Children
The Service is meant for businesses and is not directed at children. Businesses that use Kavchat with young audiences are responsible for meeting the rules that apply to them.
10. Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will tell customers by email about significant changes.