Privacy Policy

1. Who We Are

Canary is an AI-powered chatbot platform operated by Optivus ("we", "us", "our"), a technology company registered in India. Our platform is accessible at canarychat.app (the "Website") and through the embeddable chat widget deployed on our customers' websites (the "Widget").

For privacy-related inquiries, contact us at privacy@optivustechnologies.com.

2. Scope

This Privacy Policy applies to:

• Customers — businesses and individuals who create an account on Canary to configure and deploy chatbots ("Tenant Admins").
• Visitors — individuals who interact with Canary-powered chatbots embedded on customer websites ("End Users").
• Website Users — individuals who browse canarychat.app.

3. Data We Collect

3.1 From Customers (Tenant Admins)

• Account information: email address, password (hashed), name
• Business information: company name, website URL
• Knowledge base content: uploaded files, website URLs, text content
• Configuration: chatbot settings, branding, system prompts
• Payment information: processed securely by Razorpay (we do not store card details)

3.2 From End Users (Website Visitors)

• Chat messages and conversation content
• Lead information voluntarily provided via pre-chat forms (name, email, phone, company)
• Session identifiers (randomly generated, stored in browser localStorage)
• Page URL where the chat occurred
• CSAT ratings (thumbs up/down)

3.3 Automatically Collected

• Browser type and version (via standard HTTP headers)
• IP address (logged by our hosting infrastructure, not stored in our application database)
• Google Analytics data on canarychat.app (if enabled)

4. How We Use Your Data

We do not sell personal data to third parties. We do not use chat data for advertising or marketing purposes.

5. Third-Party Processors

We use the following sub-processors to deliver our service:

OpenAI API data usage: Chat data sent to OpenAI via their API is not used by OpenAI for training their models. This is governed by OpenAI's API Data Processing Addendum.

6. Data Storage and Retention

Data is stored on Supabase (hosted in the United States) using PostgreSQL with encryption at rest. All data transmission uses TLS 1.2 or higher.

Retention periods depend on the customer's subscription plan:

After the retention period, conversations are archived (excluded from active use) and may be permanently deleted during routine maintenance. Account data is retained for the duration of the account and deleted upon request.

7. Cookies and Local Storage

canarychat.app: We use Google Analytics cookies (if enabled) for website traffic analysis. No advertising cookies are used.

Chat Widget: The widget uses browser localStorage to store:

• A randomly generated session identifier (e.g., canary_session_[tenant])
• Conversation history for returning visitor continuity
• Visitor information voluntarily provided via pre-chat forms

These are not cookies — they are not sent to any server automatically and are scoped to the specific website domain where the widget is embedded. They can be cleared by the visitor at any time through browser settings.

8. Data Subject Rights

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of personal data we hold about you
• Rectification — Correct inaccurate personal data
• Erasure — Request deletion of your personal data
• Portability — Receive your data in a structured, machine-readable format
• Restriction — Restrict processing of your personal data
• Objection — Object to processing based on legitimate interest
• Withdraw Consent — Where processing is based on consent

To exercise any of these rights, contact privacy@optivustechnologies.com. We will respond within 7 business days for Indian residents (per DPDPA) and 30 days for other jurisdictions.

9. Data Security

We implement the following security measures:

• All data in transit is encrypted using TLS 1.2+
• Data at rest is encrypted on Supabase infrastructure
• Passwords are hashed using bcrypt (via Supabase Auth)
• Row-Level Security (RLS) policies enforce tenant data isolation
• API authentication via JWT tokens with automatic refresh
• Webhook signature verification (HMAC-SHA256) for payment events
• Rate limiting on all public and admin endpoints
• Domain allowlisting for widget embedding

10. International Data Transfers

Our primary data infrastructure is hosted in the United States (Supabase, Render). By using our service, you consent to the transfer of data to the United States.

For users in the European Economic Area (EEA): transfers are conducted under Standard Contractual Clauses (SCCs) as adopted by the European Commission. Customers requiring a Data Processing Agreement (DPA) may contact us.

For users in India: cross-border data transfer to the United States is currently permitted under the Digital Personal Data Protection Act, 2023, as the US has not been placed on the restricted list.

11. Children's Data

Canary is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will take steps to delete it promptly.

12. Data Breach Notification

In the event of a data breach that affects your personal data, we will notify affected individuals and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law.

13. Grievance Officer

In compliance with the Information Technology Act, 2000 and the rules made thereunder, the Grievance Officer for the purposes of this Privacy Policy is:

Grievance Officer
Optivus
Email: grievance@optivustechnologies.com

Complaints will be acknowledged within 48 hours and resolved within 1 month.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email to registered customers and posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact

For questions about this Privacy Policy, contact us at:
privacy@optivustechnologies.com