Privacy Policy

Last updated: 2026-06-18

This policy explains how Scalebloom LLC ("Chatporch", “we”, “us”) handles personal information across:

• The marketing site at chatporch.com.
• The dashboard at app.chatporch.com, where customers sign in to configure their chat widget.
• The embeddable chat widget loaded from embed.chatporch.com onto customer websites, and the chat API that powers it.

We have two distinct groups of users:

1. Customers — businesses that sign up for Chatporch to add a chat widget to their website.
2. Visitors — end users who interact with the chat widget on a customer’s website.

For chat content created by visitors, the customer (the website operating the widget) is the controller of that data and Chatporch is the processor. Our Data Processing Addendum governs that relationship. For account data created by customers themselves, Chatporch is the controller.

1. Information we collect

1.1 From customers (account holders)

When you sign up for or use the Chatporch dashboard, we collect:

• Account identity — your email address (required), your name, and a profile image if you sign in with Google.
• Authentication data — session tokens, the IP address and user-agent of devices you sign in from, and, if you use Google sign-in, an OAuth identifier and tokens issued by Google.
• Site configuration — the content you create to configure your widget (business description, instructions, knowledge, branding, and similar settings). You can optionally provide your own website’s address to have us draft this configuration for you; see section 6.
• Billing information — if you purchase a paid plan, our payment processor (Stripe) collects your payment card details directly; we never see or store full card numbers. We store your plan, subscription status, message-credit balances, and Stripe customer and subscription identifiers.
• Audit log entries — a record of who changed your site configuration and when.
• Support and communications — anything you send us by email or through forms.

1.2 From visitors using the chat widget

When a visitor opens the chat widget on a customer’s site, we collect and process:

• Chat messages — the text the visitor types and the assistant’s reply.
• Message topic label — a short, high-level topic word (e.g. “pricing”, “booking”) generated for each visitor message and stored with the conversation log so the site operator can see and filter what visitors ask about.
• A conversation identifier — a randomly generated identifier created in the visitor’s browser and stored in sessionStorage (it clears when the browser tab closes).
• Page context sent for AI grounding — the URL and title of the page where the widget is open, used as context for the AI’s reply. We also store the URL (without any query string or URL fragment) of the page the conversation was first opened on, alongside the conversation log, so the customer can see where on their site each chat started.
• Approximate location — the visitor’s country, region (state / province), and city, derived from network geo data attached by our edge provider. We do not store latitude, longitude, postal code, or any finer-grained location data.
• IP address — used in memory for rate limiting and abuse prevention. We do not store the raw IP in our database. We store only a one-way hashed identifier scoped per customer site, so the same visitor cannot be linked across different customers’ sites.
• Standard request metadata — timing of the request, used for short-lived rate-limit accounting at our edge.

We do not collect names, email addresses, phone numbers, or other contact details from visitors unless the visitor types them into a chat message. Visitors sometimes share personal details in conversation with the widget; that content is treated under retention rules described in section 4.

1.3 From visitors to the marketing site

When you visit chatporch.com:

• Our hosting provider (Netlify) records standard server logs, including IP address, user-agent, and the page requested. We do not currently run analytics scripts on the marketing site. If we add them, we will list them in our Cookie Policy.
• If you submit the contact form, we receive the content of the form and process your inquiry.
• The marketing site runs our own chat widget, so you can try the product. If you open it, we collect the same data described in section 1.2. For those conversations Chatporch is both the site operator and the provider, so we act as the controller.

2. How we use information

We use the information above to:

• Provide, operate, and improve the Chatporch service.
• Generate AI chat replies for visitors of customer sites.
• Authenticate customers and protect their accounts.
• Enforce rate limits and prevent abuse.
• Send transactional and account-related emails (for example, magic-link sign-in emails).
• Respond to support inquiries.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information and we do not use chat content to train AI models. The AI replies are generated by our model provider (see section 3) using prompts we send for each individual request; that provider, consistent with its then-current API terms, does not use API content to train its models.

3. Service providers (subprocessors)

We rely on the following processors to operate the service:

Each provider acts under a written data-processing agreement with us. We update this list when subprocessors change; customers can subscribe to changes by emailing us at the address in section 11.

4. Retention

Customers can delete a site from the dashboard at any time, which permanently removes its configuration and every conversation and message ever recorded for it. Customers can request account deletion at any time using the contact details in section 11.

5. Sharing information

We share personal information only as follows:

• With subprocessors listed in section 3, strictly to provide the service.
• With the customer (site operator) for visitor data tied to that customer’s chat widget. Visitors should be aware that the website running the widget can see the conversations they have with it.
• For legal reasons — to comply with a valid legal request, to enforce our Terms of Service, or to protect the rights, property, or safety of Chatporch, our users, or others.
• In a business transfer — if Chatporch or Scalebloom is involved in a merger, acquisition, or sale of assets, customer and account data may transfer to the successor, subject to this policy.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

6. AI processing

Chat replies are generated by our model provider (see section 3). For each request, we send:

• The system prompt assembled from the customer’s site configuration.
• The full message history for that conversation, up to a cap.
• The page URL and title where the widget is open (for grounding).
• Approximate visitor location (country, region, and city) attached by our edge provider.

Our model provider processes this data to generate a response and, consistent with its then-current API terms, does not use API content to train its models. We do not store the assembled system prompt or the AI response separately from the conversation log described in section 4.

Configuration assistance (“build from website”). When a customer chooses this option in the dashboard, we fetch a limited number of pages from the website address the customer provides and send their text content to our model provider to draft a suggested business description and knowledge base. The customer reviews and edits the draft before saving it; nothing is saved to the widget configuration unless the customer chooses to keep it. The same no-training terms apply, and we do not retain the fetched page content beyond producing the draft.

7. Cookies and similar technologies

Details are in our Cookie Policy. In short:

• The embed widget uses sessionStorage, not cookies. Nothing about the embed sets a cookie or tracks visitors across sites.
• The dashboard uses a session cookie to keep you signed in.
• The marketing site does not set cookies. It saves your theme choice in localStorage if you use the light/dark toggle, and it runs our own chat widget, which uses sessionStorage as described above.

8. Your rights

Depending on where you live, you have rights to access, correct, delete, port, or restrict our processing of your personal information, and to object to certain uses. Specifically:

• EU / UK / EEA (GDPR): rights of access, rectification, erasure, restriction, portability, and objection; the right to lodge a complaint with your data protection authority; and the right to withdraw consent.
• California (CCPA / CPRA): rights to know, delete, correct, and limit use of sensitive personal information, and to opt out of “sale” or “share” (we do neither). We do not discriminate against you for exercising these rights.

To exercise any right, contact us at [email protected]. We will verify your request and respond within the timelines required by applicable law.

For visitors of customer sites: if you want to access or delete chat content tied to a specific customer’s widget, contact that customer first — they are the controller. We will assist them in fulfilling your request.

9. International data transfers

We are based in the United States and our primary infrastructure is in the United States. If you access Chatporch from outside the United States, your data will be transferred to and processed in the United States and other countries where our subprocessors operate. For transfers from the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and equivalent UK/Swiss transfer mechanisms with our subprocessors.

10. Security and children

We use industry-standard practices to protect personal information, including encryption in transit, scoped credentials, and minimization of persisted visitor identifiers. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Chatporch is not directed to children under 16, and we do not knowingly collect personal information from children under 16. Customers using the widget on sites directed to children must comply with applicable children’s privacy laws (including COPPA for US-based sites directed to children under 13).

11. Contact

Questions, requests, or complaints: [email protected].

Charlotte, NC, United States

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top and, for customers, notify the email address on file. Continued use of Chatporch after an update constitutes acceptance of the revised policy.