Privacy policy

Who we are

HiberChat provides live chat, an AI agent, and a shared inbox to businesses (our customers). For account and billing data we are the controller. For conversations and visitor data inside a customer's workspace, the customer is the controller and we process that data on their behalf.

Data we collect

• Account data: your name, email, business name, password hash, and workspace settings.
• Billing data: plan, seats, and invoices. Card details are collected and stored by Stripe, not by us.
• Conversation data: messages, files, and voice notes exchanged through the widget and connected channels.
• Visitor data: only the fields a customer chooses to collect (such as name or email), plus technical details like page URL, browser, device, language, and approximate time zone.
• Knowledge content: website pages, documents, and FAQs a customer adds to train their AI agent.
• Website forms: what you send us through our contact form.

How we use data

• To provide, secure, and support the service.
• To generate AI answers from a customer's own knowledge sources.
• To send service emails such as invitations, password resets, and transcripts.
• To bill for paid plans.
• To reply when you contact us.

We do not sell personal data, and HiberChat does not use customer conversations or knowledge content to train AI models. To generate a reply, the visitor's message and the relevant knowledge passages are sent to our AI provider under its API terms.

Service providers

We rely on a small number of providers to run HiberChat:

• Google Cloud — application hosting and databases.
• Google Gemini — generating AI replies from retrieved knowledge passages.
• Stripe — payments and invoicing.
• Cloudflare — DNS and outgoing email delivery.
• Meta — only when a customer connects Facebook Messenger or Instagram.

Retention

We keep account data while your workspace is active. Customers control how long conversation and visitor data is kept and can delete it at any time. Deleted data is removed from active systems promptly and from backups on their normal rotation.

Your rights

You can access, correct, export, or delete your personal data. If you chatted with a business that uses HiberChat, contact that business first — they control your conversation data and can export or delete it from their dashboard. You can also contact us and we'll help.

Security

We apply the controls described on our Security page, including tenant isolation, encrypted transport, hashed passwords, and signed webhooks.

Cookies

The dashboard uses essential cookies for sign-in and CSRF protection. The widget stores a visitor identifier in the browser so returning visitors can continue their conversation. We don't use advertising cookies.

Changes and contact

We'll update this page when our practices change and revise the date above. Questions? Reach us through the contact page at hiberchat.com/contact.