Privacy Policy

1. Introduction

At ChatSprout Inc., we respect your privacy and are committed to protecting your personal data. This Privacy Policy outlines our guidelines regarding the collection, storage, encryption, and usage of information when you use our website, APIs, and multi-tenant ChatSprout software.

2. Information We Collect

• Account Data: When you register for ChatSprout, we collect your name, email address, password hash, and billing configuration variables.
• Integration Keys: Official WhatsApp Business API tokens and Evolution API instance parameters are securely stored. Sensitive access tokens are cryptographically encrypted at rest before being saved in our database instance.
• Customer Conversations: We cache contact details, tag relationships, and chat histories (messages, media URLs, delivery statuses) to provide our real-time omnichannel inbox interface.

3. Data Security and Encryption

We implement state-of-the-art security practices to protect your tenant information:

• API Access Keys: Developer REST keys are generated as secure 256-bit strings shown *only once* to the user. We store exclusively the secure **SHA-256 hash** of the key.
• Row Level Security (RLS): The database implements strict Postgres policies guaranteeing that tenants can only view and manage records matching their own authenticated `user_id`.
• Outbound Webhooks: Webhook payloads are signed using custom per-subscription secret signatures (`HMAC-SHA256`) to ensure target integrity.

4. Billing and Payment Processing

Subscription payments are processed securely by our payment processor, **Stripe**. ChatSprout Inc. does not capture or store your raw credit card numbers or bank credentials. All transactions are securely channeled via Stripe Hosted Checkout, covered by PCI-DSS compliance regulations.