Privacy Policy

1. Who we are

GetChat is operated by ABDUHAMIDOV ABDUSHUKUR VALI O'G'LI, an individual entrepreneur (yakka tartibdagi tadbirkor) registered in the Republic of Uzbekistan. The registration details and address are listed at the end of this page. Privacy questions: hello@getchat.io.

2. Our role: controller and processor

We decide how and why your merchant account data is used (account, billing, support, website and security records). For this data we are the controller.

When a merchant connects an Instagram account, GetChat processes the comments, messages and profile details of the people who interact with that merchant ("audience data") to run the merchant's automations. We do this on the merchant's behalf and on their instructions: the merchant decides which automations to run and what to send, and is responsible for having a lawful basis to contact their audience. For audience data we act as a processor (service provider), and the merchant is the controller. If you are an Instagram user and want your data removed from a merchant's GetChat account, you can contact that merchant or us; see section 10.

3. What data we collect

Account data. Email address, name, phone number if you provide it, a hashed password (we never store the password itself), language preference, profile photo, and the sign-in method you use (email, Google or Telegram). If you allowed optional attribution cookies (section 11), we also record how you first reached GetChat and the last campaign before you signed up (see "Attribution data" below).

Business details. Business name, owner name, and the billing country of the account.

Instagram account data. For each professional account you connect through Instagram's official login: the account ID, username, profile photo, account type, an access token (stored encrypted), daily counts such as followers, following and number of posts, and the posts or reels you choose for an automation (link, type, caption and public counters).

Automation and audience data. Your automation settings (keywords, messages, buttons, links, reminders). For people who comment on your posts or message your account: their Instagram-scoped ID and username, the text of comments and messages processed by an automation, the replies sent, whether a follow check passed, delivery status as reported by Meta, and timestamps. Conversation counters used for plan limits.

Billing data. Plan, billing period, amounts, currency, payment provider, transaction and subscription IDs, payment status and billing history. Card details are entered on the payment provider's own page: GetChat does not receive or store card numbers.

Support and communications. Messages you send through the support form, in-app tickets, email to hello@getchat.io or support@getchat.io, and their attachments.

Technical data. Our web server keeps an access log with IP address, time, requested address and browser information. IP addresses are also used briefly for rate limiting. Admin actions on accounts are recorded in an audit log.

Sign-in security records. For sign-in, sign-up, sign-in code and password-reset requests we record the time, the result (for example success, wrong password or blocked), a masked form of the email or phone (for example a*@g*.com), a masked network address (for example 203.0.113.x), a short device summary (for example "Chrome · Windows") and a one-way keyed fingerprint of the email or phone and of the IP address, used to recognise repeated attempts. Passwords, codes and session tokens are never recorded. Only GetChat's platform owners can see these records.

Attribution data (only with your consent). If you accept optional attribution cookies, your browser records how you reached GetChat: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the page you landed on (its path only, without the rest of the address), the name of the website that referred you (its domain only, for example google.com) and the time of the visit. It keeps the first such visit and the most recent visit that came from a campaign or another website. When you create an account, these two records are sent once and stored with your merchant account. We do not use your IP address or the full web address for this.

4. Why we use it and on what basis

• To provide the service you signed up for: running automations, sending the replies you configured, checking follows, showing analytics, enforcing plan limits. Basis: performance of our contract with you.
• To take payments and keep accounts: activating plans, receipts, refunds, tax and accounting records. Basis: contract and legal obligation.
• To keep GetChat secure: sign-in protection, fraud and abuse prevention, debugging. Basis: our legitimate interest in a safe, working service.
• To support you and send service messages such as sign-in codes, plan expiry and security notices. Basis: contract and legitimate interest.
• To understand how people find GetChat and which marketing channels lead to sign-ups, using the attribution data above, in aggregate. Basis: your consent, which you can withdraw at any time (section 11). Declining does not affect your use of GetChat.
• To improve GetChat using aggregated usage and growth statistics for internal analysis. Basis: legitimate interest. We do not publish any merchant's account statistics, name or results (for example as a case study) without that merchant's explicit permission, which can be withdrawn.

We do not sell personal data, do not use it for advertising, and do not send marketing emails. GetChat does not currently send your or your audience's data to AI model providers.

5. Instagram and Meta data

GetChat works only through Meta's official Instagram APIs, with the permissions you grant when you connect. We use Instagram data only to provide GetChat's features to the merchant who connected the account, in line with the Meta Platform Terms and Developer Policies. We do not sell Instagram data or use it for advertising.

You can disconnect an Instagram account in the app at any time, or remove GetChat in Instagram's settings. Disconnecting deletes the access token and the conversations of that account; see section 9 for what remains.

6. Who we share data with

We share personal data only with providers that help us run GetChat, each for its own purpose:

• Meta Platforms — to receive comments and messages and to send replies through the Instagram API.
• Paddle (Paddle.com Market Ltd and its affiliates) — for payments outside Uzbekistan. Paddle is the merchant of record and processes your payment and tax details under its own privacy notice.
• Click and Payme — for payments in Uzbekistan, under their own terms and privacy rules.
• Resend — to deliver our emails and receive mail sent to our addresses.
• Cloudflare — when we ask for a bot check (Cloudflare Turnstile) on sign-in, sign-up or a code request, Cloudflare checks that a person is using the browser. It processes your IP address and browser and device signals under its own privacy policy. Merchants see a check only after unusual activity, such as several wrong passwords.
• Google and Telegram — only if you choose to sign in with them; Telegram also delivers service notifications if you link it.
• Our hosting provider — a third-party provider that runs GetChat's servers and database.
• Professional advisers and authorities — accountants or lawyers where needed, and public authorities where the law requires it (see section 13).

7. International transfers

GetChat's servers and database are run by a third-party hosting provider, and the providers listed above process data in several countries, including countries of the European Union, the United Kingdom and the United States. Your data may therefore be processed outside the country where you live. Where data leaves your country, we rely on the protections the law provides for such transfers, such as adequacy decisions and the contractual safeguards (for example standard contractual clauses) offered by those providers.

8. How long we keep data

• Account, business and Instagram connection data — while your account exists.
• Instagram access tokens — until you disconnect the account or delete your GetChat account.
• Contacts, conversations and messages — until you delete them in the app (Settings → Data & deletion), disconnect the account (conversations) or delete your GetChat account.
• Incoming Instagram event records — deleted automatically 48 hours after processing (30 days if processing failed).
• Web server access logs — about 30 days.
• Attribution cookies (`gc_ft`, `gc_lt`) — up to 90 days in your browser, or less if your browser limits cookie lifetime or you delete them; deleted when you withdraw consent.
• Attribution data stored with an account — until the account owner withdraws consent while signed in, asks us to delete it, or deletes the account, whichever comes first.
• Sign-in codes — minutes; they expire after use.
• Sign-in security records — 30 days; security alerts built from them — up to 90 days.
• Payment, invoice and refund records — kept after account deletion for as long as accounting and tax law requires.
• Support messages and email — for as long as needed to handle the request and keep a record of it, unless you ask us to delete them and no legal duty requires us to keep them.

Backups. We copy the database before system updates and keep those copies for recovery, with access limited to the operator. Data deleted from the live system can remain in such a copy until the copy itself is deleted; copies are not used for anything else. If we ever have to restore one, we apply again every deletion made after it was taken before the service goes back online.

9. Disconnecting and deleting

In the app, Settings → Data & deletion lets you erase your customer data only, or delete your whole profile after confirming a code sent to your email. Deleting a profile removes your account, connected Instagram accounts and tokens, automations, team members, contacts, conversations and messages, received comments, replies still waiting to be sent, account statistics and the files you or your customers sent. Payment and refund records stay, as described above.

Deleting your GetChat account does not cancel a Paddle subscription by itself; cancel it first (see the Refund Policy).

Meta can also send us a deletion request when you remove GetChat from your Instagram or Facebook settings. Details and a status check are on the Data Deletion page.

10. Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent. You may also complain to the data protection authority in your country.

To exercise a right, write to hello@getchat.io or use the support form from the email linked to your account. We may need to confirm your identity. We reply within one month, or sooner where the law requires it. Requests about audience data are passed to, or handled together with, the merchant concerned.

11. Cookies and browser storage

Some cookies are needed for the site to work: they remember your language (`gc_lang`, `gc_locale`), protect Google sign-in for a short time (`gc_oauth_state`) and remember your cookie choice (`gc_consent`, 12 months). Your sign-in session and a few interface preferences are kept in your browser's local storage.

Optional attribution cookies. Only if you accept them, we set two first-party cookies shared by getchat.io and app.getchat.io: `gc_ft` (how you first reached GetChat) and `gc_lt` (the last visit that came from a campaign or another website). They hold the attribution data described in section 3, for up to 90 days, and only GetChat reads them. If you decline, they are not created and GetChat works the same. You can change your choice at any time in Cookie settings or in your browser; withdrawing consent deletes these cookies and stops further recording. If the account owner withdraws while signed in to the app (for example in Settings → Data & deletion → Cookie settings), we also delete the attribution data stored with the account straight away; otherwise you can ask us to delete it (section 10). With the same consent we also remember in your browser's local storage, for up to 30 days, which of our campaign links you used.

We do not use third-party analytics or advertising cookies. The Paddle checkout window, when you open it, is run by Paddle and may set its own cookies.

12. Security

The site and app run over HTTPS. Instagram access tokens are stored encrypted, passwords are stored only as salted hashes, incoming webhooks from Meta and payment providers are verified, and admin access to accounts is limited and logged. No system is perfectly secure; if a breach affects your data we will notify you and the authorities where the law requires it.

13. Requests from public authorities

When a public authority asks us to disclose personal data, we check that the request is lawful and properly grounded, disclose only the minimum it requires, and keep a record of the request, our response and its legal basis. Where we consider a request unlawful or excessive, we challenge it by the means available to us.

14. Children

GetChat accounts are for people aged 18 or over acting for a business. We do not knowingly collect data from children for an account. Merchants must make sure their automations comply with the rules that apply to their audience.

15. Changes to this policy

We will update this policy when our data practices change, and show the new date at the top. For material changes we will tell account holders by email or in the app before the change takes effect.

16. Contact

Email hello@getchat.io, the support form, or Telegram @getchat_io.