Privacy Policy

Information We Collect

• Account information: your name and email when you sign up, and a hashed password. If you sign in with Google, we receive your name, email, and profile photo from Google.
• Connected social accounts: when you authorize an Instagram professional account or a Facebook Page, we store its username or Page name, account ID, and the access token Meta issues so we can act on the account for you.
• Comments and messages: the comments, direct messages, and webhook events from your connected accounts that are needed to trigger automations and power the inbox.
• Automation settings: the keywords, replies, and templates you create.
• Link click analytics: if an automation includes a link, we may rewrite that link through CheapChat to record aggregate click counts for your dashboard. For abuse prevention and basic analytics we may store the click time, referrer (if provided by the browser), a truncated IP address, and browser user-agent metadata. We retain raw click metadata for up to 30 days, then remove or aggregate it.
• Billing: payments for paid plans are processed by Stripe. We never see or store your full card details; we keep your plan and subscription status.
• Shopify: if you connect a Shopify store, we access the product information needed to build product replies in your automations.

How We Use Information

We use this data to authenticate you, connect your social accounts, run the automations you configure, power the inbox and analytics, process payments, send transactional emails (such as receipts and account notices), and debug message delivery. We do not use your messages or comments for advertising, and we do not sell your data.

Sharing

We share data only where the service requires it: with Meta's Instagram and Facebook APIs to deliver the automations you configure, with Stripe to process payments, with the infrastructure providers that host CheapChat and deliver our emails. Nothing is sold to anyone.

Retention and Deletion

We keep your data for as long as your account is active. Disconnecting a social account in Settings immediately revokes its access token on our servers and purges the cached comments, messages, and webhook events for that account. To delete your CheapChat account entirely, email hello@cheapchat.tech from your registered address see the User Data & Deletion page for the full process.

Security

All traffic to CheapChat is encrypted in transit over HTTPS. Access tokens and secrets are kept out of code and managed through environment configuration, incoming webhooks are verified with Meta's request signatures, and access to production data is restricted.

Changes to This Policy

If we change this policy in a way that matters, we will update this page and the date at the top. Continued use of CheapChat after a change means you accept the updated policy.

Contact

For privacy questions or deletion requests, email hello@cheapchat.tech.