Privacy Policy

Stylchat is a product of Trailops LLC, a limited liability company organized under the laws of the State of Wyoming, with its principal place of business at 30 N Gould St, Ste R, Sheridan, WY 82801, USA ("Trailops," "Stylchat," "we," "us," or "our"). Trailops LLC is the data controller for account holder information described in this policy, and acts as a data processor on behalf of our customers for end-visitor interactions through embedded chat widgets.

By using Stylchat, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

1. How Stylchat Works (Two Operating Models)

Stylchat provides chat widgets and customer support tools for websites under two distinct operating models:

• Bring Your Own Infrastructure (BYOI): Base BYOI stores zero visitor or conversation data on Stylchat infrastructure. Live chat messages, conversation history, leads, support tickets, handoff routing, and media files are processed exclusively by your own external automation or webhook (such as self-hosted n8n). Stylchat acts as widget configuration and transit-only relay. If you choose to enable optional paid add-on packs (Data Pack or Desk Pack), the specific hosted data disclosed in the pack declaration is processed on our US West database infrastructure; any files are stored in Cloudflare R2 as described below.
• Stylchat Managed Infrastructure: We host the conversational AI, vector knowledge base, and support desk for you. Our API and PostgreSQL database (conversations, tickets, contacts, synced store catalogs and vector embeddings) run in California, United States (Railway US West). Uploaded files (Knowledge Base documents, ticket attachments and temporary live-chat files) are stored separately in Cloudflare R2 object storage, in a bucket with an Asia-Pacific (APAC) location hint and Cloudflare's default jurisdiction; this does not guarantee that files stay in any particular country or region.

2. Information We Collect & Addon Pack Disclosures

What we collect depends on how you use Stylchat:

A. All Users (Account & Setup)

• Account Information: Your email address, name, and login credentials when you sign up (authenticated via Clerk, including optional Google or social sign-in).
• Widget Configuration: Your widget appearance settings (colors, branding, launcher icons, typography), system prompts, and destination webhook URLs.
• Billing Details: Purchases and subscriptions are sold by Trailops LLC and processed by Stripe. We store confirmation of your purchase, plan status, and invoice records — we never receive or store your full payment card numbers.
• Technical & Usage Data: Basic browser metadata, API request logs, and widget load counters used for reliability, rate limiting, and dashboard analytics.

B. BYOI Mode (Base Zero-Storage & Optional Addon Packs)

• Base BYOI (Zero Storage): No visitor conversation transcripts, chat turns, lead entries, support tickets, or uploaded files are stored on Stylchat servers. File uploads and voice notes use customer-owned base64 payload streams directly to your webhook.
• Optional Data Pack ($5/mo per widget): "This optional Data Pack stores lead form fields, conversation text, chat feedback, analytics events, and your team's inbox workflow data (internal notes, assignments, read status, reminders and snoozes) on Stylchat infrastructure in California, United States, for 180 days rolling (leads until owner deletes; inbox workflow data is deleted with the conversation or ticket it belongs to). Cancel any time (no refunds): access continues until the end of your paid billing period, followed by a 30-day inactive preservation window, then permanent deletion of this pack's hosted data. Your BYOI licence and customer-owned workflow continue independently."
• Optional Desk Pack ($5/mo per 5 agents): "This optional Desk Pack stores transient live agent handoff and queue data on Stylchat infrastructure in California, United States. Ordinary sessions expire after 15 minutes of inactivity. Sessions awaiting or receiving a human reply expire after the widget's agent-wait setting (1 minute to 2 hours, default 2 hours) without activity; explicitly ended sessions expire after 5 minutes. Cleanup runs every minute and attempts to remove associated temporary files; storage cleanup failures can delay file deletion. This pack does not provide durable conversation history. Optional live typing preview requires visitor opt-in; drafts are never saved, while consent choices and notice text are kept for up to 180 days, subject to earlier widget or Desk Pack data deletion. Cancel any time (no refunds): access continues until the end of your paid billing period, followed by a 30-day inactive preservation window, then permanent deletion of this pack's hosted data. Your BYOI licence and customer-owned workflow continue independently."

Optional live draft preview is available with the BYOI Desk Pack or Managed Starter/Pro. It starts off. Visitors may separately opt in and withdraw without losing chat access. Draft text is sent only to authorized support agents and is not stored. Versioned consent and withdrawal receipts contain a hashed session identifier and notice text, are retained for up to 180 days, and are removed earlier when the widget or its Desk pack data is deleted.

C. Managed Infrastructure Mode (Hosted AI & Support)

• Knowledge Base Content: Documents (.pdf, .docx, .txt, .md, .csv), files, or website URLs you upload to ground your AI assistant, stored in Cloudflare R2 (APAC location hint, default jurisdiction, no residency guarantee) and indexed as vector embeddings in our US West database.
• Chat Conversations, Tickets & Media: Message text, Service Desk support tickets, CSAT survey responses, uploaded file attachments, and voice notes exchanged between visitors and your chat widget.
• Inbox Workflow Data: What your team adds while handling chats and tickets in the inbox: internal notes (visible only to your team, never sent to visitors, never included in transcripts or customer emails, and never used to train AI), teammate mentions, assignments and routing departments, per-agent read status, snoozes and personal reminders, saved views and macros. Which teammate is viewing or writing a reply is shared with your team in real time and is not stored.
• Team Activity & Performance Data: Which teammate was assigned, replied to, resolved or snoozed each chat or ticket, with timestamps. We use it to show your team's activity and service-level and performance reports (such as reply and resolution times) to the workspace owner and teammates allowed to see reports. It is never used for advertising or to train AI.
• Pre-Chat Lead & Contact Information: Visitor name, email address, phone number, and company details collected when you enable the Pre-Chat Lead form, ticket creation, or CRM contact directory.
• Store Catalog & Order Lookup Data (WooCommerce): When you connect a WooCommerce store, we sync read-only product catalog data (title, price, stock_status, permalink, image_url) and use encrypted store API credentials (AES-256-GCM) to perform real-time order status lookups requested by your customers in chat.
• Shopify App (Stylchat Live): With your approval of the read_products permission, we import your published Online Store products (title, price, availability, link and image) when you choose to sync. We use a short-lived Shopify session to do this and do not store a Shopify access token. We do not read Shopify orders or customer records. To link your store, we keep your shop domain, the Stylchat account and widget it is connected to, and its Shopify billing status. The storefront widget only loads after the shopper allows it through Shopify's customer privacy consent.
• Wix App (Stylchat Live for Wix): When you install Stylchat on a Wix site and link it to your Stylchat account, we receive and keep the app installation ID and the site's ID, name and web address, together with the Stylchat account and widget it is linked to. Through the Wix permissions you approve, we read your Wix Stores products (name, description, price, currency, availability, link and image, plus the SKU where Wix provides one) when you connect the store and when products change, and we keep that copy so the assistant can answer product questions. We do not request Wix orders, customers, site members or payment details. We use a short-lived Wix access token generated per request and do not store it. Stylchat plans for Wix are bought and billed through Wix; Wix tells us your plan name and when it ends, and we never receive your payment card details. The storefront chat is added to your site as a Functional-category script, so your site's Wix cookie-consent settings apply to it.
• Mobile App Permissions: When using the Stylchat mobile app for live agent replies, the app requests photo library access (to attach images) and microphone access (to record voice notes) solely when you actively use those features.

Connected Messaging Channels (Managed Only)

When a business connects Telegram, Facebook Messenger, Instagram Direct or WhatsApp Business to a Managed widget, Stylchat receives customer messages and attachments, platform user identifiers, phone numbers where provided, display names and usernames, and delivery/read events. We use these records to route customer-support conversations to the business’s inbox, deliver its team’s replies, prevent duplicate delivery and enforce messaging windows. Where supported, we also process consent/opt-out records and approved utility templates. Channel messaging is not part of base BYOI.

Connection credentials are encrypted at rest. Credential values are not returned in dashboard connection responses or privacy exports. Channel message content and associated metadata are stored with the business’s other hosted conversations; media is stored in Cloudflare R2 under the storage arrangements described in this policy.

3. Cookies & Visitor Browser Storage (localStorage)

• Marketing Website (stylchat.com): Uses essential cookies to remember your cookie consent preferences and, only if you opt in via our cookie banner (Google Consent Mode), analytics cookies to understand general site traffic.
• Stylchat Dashboard (app.stylchat.com): Uses strictly necessary authentication cookies and session tokens managed by Clerk to keep you signed in. It does not use third-party advertising cookies.
• Embedded Chat Widget (browser storage): When embedded on a customer's website, the widget stores lightweight state in the visitor's browser localStorage (not third-party tracking cookies). Nothing is written until the widget starts, and with "start on click" enabled nothing is written until the visitor opens chat:
  • stylchat_session_<widgetId> & stylchat_session_meta_<widgetId> — Anonymous random session identifier and last-activity time. A new session starts after the owner's inactivity timeout (default 30 minutes).
  • stylchat_history_<widgetId> & stylchat_session_<widgetId>_conv — The active conversation and its recent messages, so chat continues across pages.
  • stylchat_chatted_<widgetId> — Whether the visitor has chatted before.
  • stylchat_contact_* — Name, email and company, only if the visitor submits the pre-chat form or the site identifies them, so they are not asked again.
  • stylchat_visitor_uuid — A random identifier created when the visitor submits a lead or sends a message, used to link their own conversations.
  • stylchat_visitor_proof_<widgetId> — Proof of a verified email for "My conversations", valid for 30 days.
  • stylchat_pv_<page> — A product-page view count, only when the site owner uses a "product views" pop-up rule.
  • stylchat_optin_v2_<widgetId> — On WooCommerce stores using the plugin's own chat opt-in, the visitor's choice.
  These keys stay in the visitor's browser until cleared. A site can remove all of them at once with the widget's opt-out function.
• Visitor Radar & website analytics (consent-based): For Managed Pro widgets, the widget can report anonymous live presence (a random identifier that is not stored in the browser, page origin, device and browser type, and an approximate location: country, city and rounded map coordinates estimated from the IP address by our network provider, Cloudflare) so the site owner sees who is browsing now. The IP address itself is not stored, and the location is an estimate, never GPS or device location. This runs only when the website's own consent tool reports that the visitor allowed analytics, and never when the browser sends a Global Privacy Control signal. Presence is kept in server memory for 60 seconds and is not stored as visitor history. Booking events are forwarded to the site owner's Google Analytics or Meta pixel only with the matching analytics or advertising consent. The widget reads consent from Shopify, WooCommerce (WP Consent API), Wix, common cookie banners, or the site's own setup; if no consent is found, these features stay off. Opening chat or sending a message never counts as consent.
• Visitor location in live chat: When a visitor chats, the support team can see the same approximate country and city for that chat session, estimated from the IP address by Cloudflare. It is held in server memory for up to 15 minutes, is not written to the conversation record, and the IP address is not stored.

4. How We Use Information & AI Privacy Guarantee

We use collected information solely to operate, customize, secure, and deliver your chat service, process billing, and send transactional notifications.

Google User Data (Google Calendar & Google Meet)

When a scheduling host connects a Google account, Stylchat requests only the calendar.events scope plus the account email. We use it solely to create, update, and delete the Google Calendar event and Google Meet link for appointments booked through Stylchat. We store only the encrypted access tokens, the connected email, and the resulting Meet link. Disconnecting revokes access and deletes the tokens.

Google user data is never sent to any AI or machine learning model, never used to create, train, or improve generalized or foundational AI/ML models, never sold, and never used for advertising.

The use of raw or derived user data received from Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Third-Party Service Providers (Subprocessors)

We rely on the following trusted infrastructure providers to deliver Stylchat:

• Clerk (USA) — Account authentication and identity management.
• Stripe (USA) — Payment processing and subscription billing on behalf of Trailops LLC.
• Railway (USA, California) — Backend API, background workers, and PostgreSQL database with vector search.
• Cloudflare (global network; R2 bucket in APAC) — Cloudflare Pages (application & widget CDN) and Cloudflare R2 (encrypted object storage for Knowledge Base documents, ticket attachments and temporary live-chat files). The R2 bucket uses an Asia-Pacific location hint and Cloudflare's default jurisdiction, which does not guarantee data residency.
• OpenRouter, OpenAI & Google (USA) — LLM inference (routed by OpenRouter to OpenAI and Google Gemini models) and text embedding generation for Managed Infrastructure users.
• Google Calendar & Google Meet (USA) — Appointment sync and meeting links, only when a scheduling host connects their Google account.
• Resend (USA) — Transactional email delivery (ticket alerts, chat transcripts, and workspace invitations) when custom SMTP is not configured.
• Google Fonts (USA) — Web font delivery for configured widget typography.
• Merchant-Configured Integrations (Optional) — WooCommerce, Shopify or Wix (where available), or notification channels (Slack, Discord, Telegram, Microsoft Teams, Zapier, Pabbly, n8n) strictly when connected and authorized by the customer.

We never sell your personal information or customer data to third parties. For customers subject to GDPR or UK data protection legislation, our standard Data Processing Addendum (DPA) with European Commission Standard Contractual Clauses (SCCs) and UK IDTA addendum applies.

Connected Messaging Platforms

When a business authorizes a channel, Stylchat exchanges messages and account metadata with Telegram or Meta’s Facebook Messenger, Instagram and WhatsApp services on that business’s behalf. Those platforms process data under their own terms and privacy policies. The business remains responsible for its customer communications, platform permissions, messaging rules and consent requirements.

6. Data Retention & Deletion Policy

We enforce automated retention and deletion schedules across all platform data:

• Account & Profile Records: Stored while your account remains active. When you delete your account, all associated profiles, widgets, session data, and stored Cloudflare R2 files are immediately and permanently removed via automated cascade deletion (except transaction records required for tax and accounting compliance).
• Ephemeral Live Chat Handoff: Ordinary live-chat sessions expire after 15 minutes of inactivity. Sessions awaiting or receiving a human reply use the widget's agent-wait setting, from 1 minute to 2 hours, with a 2-hour default since the last activity. Explicitly ended sessions expire after 5 minutes. A cleanup job runs every minute to remove expired session records and attempts to delete associated temporary files. Storage cleanup failures can delay file deletion. These transient sessions are separate from durable conversation history available under the applicable plan or hosted pack.
• Active 6-Month Rolling Retention (Chat Transcripts, Support Tickets & Analytics): For active accounts, chat conversation transcripts, Service Desk support tickets, and widget analytics events are retained for a rolling period of 6 months (180 days) to power your inbox history, SLA tracking, customer satisfaction (CSAT) metrics, and email transcripts. A cleanup sweep runs at service startup and every six hours to permanently purge records older than 6 months.
• Inbox Workflow Data: Internal notes, mentions, read status, snoozes and reminders belong to their conversation or ticket and are deleted with it — at the 6-month limit, when you delete the widget, or when the account is deleted. Saved views, macros and routing departments are kept while your account is active. Teammate presence (who is viewing or writing) is kept in memory for about 30 seconds and never stored.
• Team Activity & Performance Data: Kept with the conversations and tickets it describes and deleted on the same 6-month schedule, when the widget is deleted, or when the account is deleted. When a teammate's login is deleted, their name stays on past replies within the workspace's retention period so the conversation history remains accurate.
• Knowledge Base Documents, Store Catalog & CRM Contacts: Stored for the duration of your active subscription. Deleting a document or disconnecting a store immediately removes the original files from Cloudflare R2 and permanently deletes all associated vector embeddings or synced products.
• Managed Infrastructure 30-Day Cancellation Freeze: If you cancel your Managed subscription, your account enters an inactive 30-day freeze period at the end of your paid billing cycle. Your documents, vector knowledge base, store catalog, conversations, tickets, contacts, and configurations are preserved for exactly 30 calendar days to allow reactivation. If you do not reactivate within 30 days, all hosted data — including Knowledge Base files in Cloudflare R2, vector embeddings, synced store products, conversations, tickets, surveys, CRM contacts, team members, and Managed widget configurations — is permanently and irreversibly deleted.
• Team Agent Accounts: Login and personal profile data are deleted after owner approval when the login is not used by another team or separate account. Workspace chats and tickets remain subject to the workspace retention policy. See account deletion help.
• Data Erasure Requests: You can request full deletion of your account and personal data at any time by emailing privacy@stylchat.com.

Messaging Channel Retention and Disconnection

Messages and their attachments follow a 180-day rolling retention period. Encrypted inbound replay payloads are scheduled for removal after seven days once processing has completed or failed; events still awaiting processing may be retained longer. Processed delivery and deduplication records are eligible for removal after 30 days when no processing job remains pending. Connection activity records are kept for one year. Unsent uploaded reply drafts expire after 60 minutes. Cleanup runs in background jobs; file deletion and provider-access revocation may be delayed by retries or provider outages.

Disconnecting a channel stops its use for new messages in Stylchat; stored support history remains subject to retention and valid deletion requests. Deleting the widget or owner account removes its channel records and queues stored-file cleanup and removal of provider access. Provider revocation retries are bounded to seven days, after which queued credentials are discarded. Copies already held in the messaging platform are governed by that platform’s deletion tools and policies.

Deleting Your Account

Workspace owners can delete their account in Stylchat Live (Settings → Delete account) or on the web (Account → Account details → Account management → Delete account).

Team agents request account deletion in Stylchat Live (Settings → Request account deletion) or on the web (Account → Account details → Request account deletion). The workspace owner approves by typing the member email and entering a six-digit code emailed to the owner's verified address. The agent receives an email when their login is deleted. A login used by another team or separate account is kept; only the membership is removed.

Workspace conversations and tickets remain with the workspace owner. If the owner does not respond, email privacy@stylchat.com; support completes eligible verified requests within 30 days. See account deletion instructions.

Deleting an owner account permanently deletes that account, every widget they own, and all of their data (profiles, conversations, tickets, contacts, knowledge base files and settings), as described above. Transaction records required for tax and accounting compliance are kept.

If you can't sign in or no longer have the app installed, email privacy@stylchat.com from your account email address with the subject "Delete my account" and we will delete it for you.

7. Your Rights (GDPR & CCPA)

Depending on your jurisdiction (including EEA/UK GDPR and California CCPA), you have the right to access, correct, export, or request deletion of your personal data.

• Account Holders: Contact us at privacy@stylchat.com to exercise your privacy rights.
• Website Visitors: If you interacted with a Stylchat widget embedded on a customer's website, that website owner is the Data Controller and Stylchat acts as their Data Processor. Please contact the website owner directly regarding your chat or contact records, or email privacy@stylchat.com and we will assist in forwarding your request.

Messaging Customers Without a Stylchat Account

If you messaged a business through Messenger, Instagram, WhatsApp or Telegram, you do not need a Stylchat login to request access to or deletion of the data the business holds in Stylchat. Contact that business or email privacy@stylchat.com with the channel, the business/account contacted and an approximate conversation date. We will coordinate with the business and verify the request before disclosing or deleting records. Never send passwords, access tokens, verification codes or unrelated conversation content. See the messaging data deletion instructions.

Workspace privacy exports include channel connections without credentials, identities, message content and metadata, attachment metadata and consent records. Attachment file contents and internal delivery/replay records are not included in these exports.

Shopify Merchants & Their Customers

• Customer data requests: When a Shopify store's customer asks for their data, Shopify notifies us and the request appears in the store owner's Stylchat Privacy controls. The owner can download the chats, tickets and bookings linked to that customer's email on the store's widgets and send them to the customer within 30 days. Your team's internal notes are not part of this download.
• Customer deletion requests: When Shopify asks us to delete a customer's data, we automatically delete that customer's conversations, live chat sessions and files, support tickets and bookings from the store's widgets, together with your team's internal notes and reminders on them. Data the same person gave on the merchant's other websites is kept, because it is not Shopify data.
• Uninstalling the app: When the app is uninstalled we disconnect the store and delete its imported products straight away. Shopify then asks us to delete the store's data after 48 hours, and we remove the remaining store details (shop domain, link and billing records). Your Stylchat workspace and website data stay with your Stylchat account until you delete it.

Wix Merchants & Their Customers

• Visitors: Chats on a Wix storefront are handled like any other Stylchat widget: the site owner is the Data Controller and Stylchat is the Data Processor, as described above.
• Disconnecting the store: Disconnecting the Wix store from Stylchat immediately deletes its imported products and cancels any pending catalog refresh.
• Removing the app: When the app is removed from a Wix site, we disconnect the store, delete its imported products, cancel pending refreshes, discard unused link codes and end the Wix plan record. We keep only the installation ID with its removal date, so a reinstall is recognized; it is no longer used to serve the site.
• Deleting your Stylchat account: Your widgets, store connection and imported products are deleted with the account. The installation ID record remains but is no longer linked to any account.

8. Security, International Transfers & Children's Privacy

Security: We protect your data using industry-standard TLS encryption in transit, AES-256-GCM encryption for stored third-party credentials and SMTP passwords, and strict organization-level isolation across our database.

International Data Transfers: Stylchat is operated from the United States. By using the Service, you acknowledge that data is transferred to and processed in the United States by our subprocessors, and that uploaded files are stored in Cloudflare R2 outside the United States (APAC location hint, no residency guarantee), under standard contractual and technical safeguards.

Children's Privacy (16+): Stylchat is a business-to-business SaaS platform not directed at children under 16, and we do not knowingly collect personal information from anyone under 16.

9. Changes & Contact

We may update this Privacy Policy from time to time and will update the "Effective date" above when we do. Questions about this Privacy Policy can be sent to privacy@stylchat.com.

Governing law/jurisdiction: the laws of the State of Wyoming, USA, without regard to its conflict-of-laws rules.