How Chattoko looks after your data, and your customers' data.
Where it's stored, who can see it, what the AI does with it, and how to delete it, in plain words. The Privacy Policy and Terms are the full legal text.
Stored in Sydney, with a few providers elsewhere
Customer data is stored in Google Cloud's Sydney region (australia-southeast1). That covers your conversations, tickets, customers, settings, call transcripts and AI summaries.
The servers that run Chattoko, and the service that runs the AI on live calls, are in the same region.
Some providers handle data outside Australia. Each one is named, with what it does, on our sub-processors page.
How it's protected
Encrypted
Data is encrypted on the way (HTTPS, TLS 1.2 or newer) and where it's stored.Kept apart
Every workspace's data is separate. Database rules check that a person belongs to a workspace before any read or write.Passwords
Sign-in runs on Firebase Authentication. We never see your password.Checked messages
Messages from our phone and billing providers are signed, and we check the signature before acting on them.Your keys
Keys for the tools you connect are stored encrypted.Your own phone account
Each workspace's numbers sit in their own Twilio sub-account.
Your team sees what their role allows
Every person on your team has one of four roles. You choose each person's role.
| Role | What they can do |
|---|---|
| Owner | Everything, including billing, exporting all data, erasing a customer's data and deleting the workspace. |
| Admin | Everything except billing and deleting the workspace. |
| Supervisor | Watches the inbox, calls and analytics. No settings. |
| Operator | Handles conversations only. |
Sign-in and records of who did what
Two-step sign-in
Owners and admins can turn on two-step sign-in for their account, with an authenticator app like Google Authenticator or 1Password.Single sign-on on Scale
On Scale plans, your team can sign in through your identity provider, with SAML or OIDC. We set it up with you.Who opened a customer's record
The access log in Settings shows who on your team opened a customer's conversation, ticket, caller profile or order history, and when. It records what was opened, never the customer's details.Chattoko support
When our support team opens one of your conversations, for example to look into a problem you reported, they give a reason first, and a line appears in your Activity log.
Owners and admins see the log, and payment rows are for owners only. By default, supervisors see changes to records and an operator sees their own rows; the owner can change that. The log names your team members, never your customers' messages or details.
Owners get a push and an email when someone adds an admin or owner, turns off call recording or the AI receptionist, releases a phone number, or exports more than 500 rows. Admins can turn these alerts on too. At most 3 alerts of each kind an hour; the rest stay in the log.
Rows are kept 90 days on Solo, 180 on Team and 365 on Scale.
What the AI sees, and what it never does
Chattoko's AI runs on Google Gemini and Anthropic Claude models. We choose the model for each feature, and if Gemini is unavailable, Claude can answer instead.
To answer, the AI is sent the conversation, call transcripts, the customer's details, and your knowledge base and products.
Google's AI services don't use your data to train their models. Anthropic's commercial terms don't let it train on your data, and it deletes these inputs and outputs within 30 days, unless it must keep them longer to enforce its usage policies or by law. We don't use your data to train AI models either.
Call recordings are never sent to Anthropic. When Gemini can't summarize a call, Claude may summarize it from the transcript.
Callers are told, and recordings don't stay forever
Callers hear a notice
When a call is recorded, transcribed or answered by the AI, the caller first hears a short notice, such as "This call may be recorded, monitored and transcribed…" Your settings can add words to it, but can't switch it off.Recordings are deleted on a timer
Call and voicemail audio is deleted 90 days after the call, or 180 days on Scale, or sooner if you set a shorter time. Recordings are stored by Twilio in the United States.Who can play them
Only signed-in members of your team. Who played or downloaded a recording shows in your Activity log.Card numbers
If a caller reads out a card number to the AI, the whole number is never sent to the AI, it's taken out of the transcript, and the call's recording is deleted. On a call with your team, the person on the call can pause the recording while a card number is read out.
Recording laws differ from place to place. You decide whether calls are recorded, and you're responsible for any consent the law needs (Terms, section 6).
Payments
Stripe handles card payments. Chattoko never stores card numbers, security codes or full payment details.
We keep a Stripe customer ID, your plan, your usage and your billing status.
Paying through Shopify? Your plan goes on your Shopify bill, and Shopify handles the payment.
How long data is kept, and how to delete it
| Data | How long |
|---|---|
| Chats, tickets and text threads | 12 months after the last message, then deleted. You can make it as short as 30 days in Settings. |
| Call and voicemail recordings | 90 days after the call, or 180 days on Scale. You can make it shorter in Settings. |
| Call transcripts and AI summaries | Kept with their conversation and deleted with it. |
| Activity log | 90 days on Solo, 180 on Team, 365 on Scale. The Chat plans match their size. |
| Billing and invoice records | 7 years, because tax law requires it. |
| Backups | Deleted data can stay in encrypted backups for up to 98 days, until they expire. |
Delete your account. In the console, open the sign-out menu at the top right, choose Delete my account, and type DELETE. A team member's account is deleted straight away.
If you own the workspace, this closes it for your whole team. We do it within 30 days and email you when it's done. You can also email support@chattoko.io from the address you sign in with.
Report a security problem, or ask for a DPA
Found a security problem in Chattoko? Email support@chattoko.io with "Security" in the subject.
If a personal data breach affects your data, we tell you without undue delay, and within 72 hours of finding out.
A data processing agreement (DPA) is available on request. Email support@chattoko.io.
The full text: Privacy Policy · Terms of Service · Sub-processors
Questions people ask
Where is my data stored?
Customer data is stored in Google Cloud's Sydney region (australia-southeast1). Call recordings are stored by Twilio in the United States, and the AI providers, Stripe and Resend may process data in the United States or other countries. The sub-processors page lists each one.
Does the AI learn from my customers' messages?
No. We don't use your data, your customers' data or your calls to train AI models. Google's AI services don't use your data to train their models, and Anthropic's commercial terms don't let it train on your data either.
Will my customers know they're talking to an AI?
The AI never pretends to be a person, and it says it's an AI when asked, then offers to bring in your team. On your website chat its replies carry an "AI" label. On calls, the standard greeting introduces it as a virtual AI assistant; a greeting you write yourself doesn't have to mention AI.
Can I turn call recording off?
Yes. Recording is a setting for your workspace, and it may be on when you start. When it's on, you're responsible for any consent the law needs where you and your callers are.
Can I get a data processing agreement (DPA)?
Yes, on request. Email support@chattoko.io with your business name and we'll send one to sign.
Does Chattoko hold a security certification?
No, Chattoko doesn't hold its own security certification. We build on providers that hold their own, such as Google Cloud, Twilio, Stripe and Anthropic, and Stripe handles every card payment.
What happens to my data if I cancel?
Your plan works until the end of the period you paid for, then the workspace is paused. Phone numbers are held for 30 days, then released. You can ask us for an export of your data within 30 days. To delete everything, delete your account.
Answer every call and chat, and know where the data goes.
Free to join the waitlist · 14-day trial when we open