Privacy policy
Last updated: 27 October 2026
Chat2Checkout (chat2checkout.com) gives businesses an AI chat assistant for their website. This policy explains what data we handle for the businesses that use it (our customers) and for the visitors who chat with it on their websites.
Chat2Checkout is a product of Timely Growth Partner (timelygp.com), which runs the service and is responsible for it under these pages. Contact: support@chat2checkout.com or hello@timelygp.com.
Data we handle for businesses
Account details: name, email address and password (stored securely by our sign-in provider), team members and their roles.
Store and website data: the public pages of the connected website, the product catalog and the settings needed to answer shoppers (for WooCommerce: delivery options, payment methods and, with your approval, the ability to create cash-on-delivery orders). Store API keys are encrypted at rest.
Billing: plan, payments and refunds. Card and mobile-wallet details are handled by our payment providers (Polar, bKash); we never see or store them.
Data we handle for website visitors
Chat messages and the assistant's replies, the visitor's chosen language, and an anonymous random visitor id kept in the visitor's browser (no name, no tracking across other websites).
Photos a visitor sends in the chat, to find matching products. Photos are kept for 30 days and then deleted.
Details a visitor types into a form in the chat (a question, an enquiry, a booking or an order): for example name, phone, email and address. These go only to the business the visitor is chatting with.
Events such as opening the chat, adding a product to the cart, or sending a contact, quote or booking form on the business's website after chatting in the same visit, used for the business's reports. For website forms we record only that a form was sent and on which page, never what was typed into it. We also count page views and daily visitors of each website where the chat is installed (one anonymous count per page load, no page content or personal details) so the business can see how many visitors use the chat.
How we use data
To run the assistant: answering questions, finding products, showing forms and passing requests and orders to the business.
To give businesses their dashboard: conversations, reports, leads, bookings and inquiries.
Customer Insights (paid plans): finished chats are summarised into topics, questions and outcomes so the business gets a report of what its visitors ask for. Before a chat is sent to an AI provider for this, email addresses, phone numbers and links are removed. The summaries stay in that business's dashboard.
To keep the service safe and working: rate limits, abuse prevention and fixing errors. We don't sell personal data and don't use it for advertising.
Who processes data for us
Hosting and database: Vercel and Supabase (United States). AI: Anthropic (the chat assistant) and Voyage AI (search); when we turn them on, the chat may also be answered by OpenAI, Google (Gemini), xAI (Grok), DeepSeek (servers in China) or Mistral, and a message goes only to the provider that answers it. Voice chat (Business and Pro plans only): spoken messages are turned into text by Groq and replies are read aloud by Google Cloud; recordings are not stored. Rate limiting and background jobs: Upstash. Payments: Polar and bKash. Email alerts: Resend. Messenger, Instagram and WhatsApp chats: Meta Platforms (only for businesses that connect them).
Free plan: chats of businesses on the free plan are answered by the AI provider whose key that business added (for example Google Gemini), under that provider's terms, which the business accepted. Google's free tier may use what is sent to improve its products. Free-plan searches don't use Voyage AI.
Each processor only receives what it needs for its part of the service.
Who controls visitor data
For data visitors share in a business's chat, that business decides why and how it is used; we process it on its behalf. Visitors who want their data accessed, corrected or deleted can contact the business, or write to us and we will pass the request on.
How long we keep data
Visitor photos: 30 days. Conversations and their messages, chat summaries and chat events: 13 months, then deleted automatically. Requests, leads, orders and inquiries: as long as the business keeps its account, unless it deletes them. Raw social messages and webhook deliveries: 30 days. When a business deletes its store or account, its data and files are deleted.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data and to object to some uses. Write to support@chat2checkout.com and we will answer within 30 days.
Changes
We may update this policy. Important changes are announced in the dashboard before they apply.
Questions about these pages? Write to support@chat2checkout.com.
Messenger, Instagram and WhatsApp
A business can connect its Facebook Page, Instagram account or WhatsApp number so the assistant answers messages there. We then receive, through Meta's official APIs, the messages people send to that business, their id on that platform, the name the platform shares (for example the WhatsApp profile name or the Facebook name), and photos or voice notes they send. Replies go back through the same platform.
These chats are handled like website chats: they appear only in that business's dashboard, photos are kept 30 days, voice notes are turned into text and never stored, and contact details for a request are typed into a form page on our site, never sent to the AI. Raw messages as Meta delivered them are deleted after 30 days.
For the person who connects a Page or number, we keep the access tokens Meta gives us (encrypted) and their Facebook user id. Removing Chat2Checkout from Facebook's "Business integrations" settings, or disconnecting on our Channels page, deletes those tokens at once and stops all replies; Meta also sends us deletion requests, which we carry out immediately.