Privacy Policy & Data Governance

Version: 2026-10-v1 · Effective Date: October 16, 2026 · Domains: caseshow.info, chateasy.ai

Data Privacy & Cryptographic Architecture Notice: This policy details how customer identifiers are irreversibly hashed using SHA-256 before delivery to Meta Conversions API (CAPI) and Google Ads, confirms our strict Zero Raw Message Transcript guarantee for advertising networks, outlines data deletion rights, and explains how cross-business conversational craft learning operates without personal identifying information (PII).

1. Overview & Roles Under Data Protection Laws

ChatEasy / Ceti Harness ("ChatEasy", "we", "our", or "us") provides an autonomous AI frontdesk receptionist, multi-channel communication engine, and conversational intelligence platform for businesses. This Privacy Policy governs our collection, cryptographic handling, multi-tenant storage, and synchronization of personal information across our web dashboard, messaging channels (WhatsApp Cloud API, Meta Messenger, Instagram Direct, and Meta Threads), embeddable website widgets, and advertising network integrations.

We distinguish clearly between two categories of users:

Business Subscribers: Companies and professionals who create ChatEasy accounts and connect their messaging channels or web domains. Under GDPR, CCPA/CPRA, and relevant privacy laws, the Business Subscriber is the Data Controller (or "Business") with respect to all customer communications and lead records.
End Customers & Contacts: Individuals who message your business via connected communication channels or the embedded website widget. ChatEasy acts strictly as a Data Processor (or "Service Provider") on behalf of the Business Subscriber, processing inquiries solely pursuant to the Business's instructions.

2. Categories of Data We Collect & Process

Subscriber Account & Billing Data: Account owner name, corporate email address, business name, timezone, and subscription status. Billing is handled by our PCI-DSS compliant processor, Paystack; we never store full debit/credit card numbers—only tokenized references and transaction status.
Authentication Credentials: Secure email-based one-time passcodes and Google OAuth profile information (verified email, name, avatar) used exclusively to authenticate workspace administrators.
Inbound Customer Communications: Customer message content, channel metadata (e.g., WhatsApp phone number, Instagram handle, Messenger PSID), booking details, and timestamps necessary to formulate AI replies and maintain customer relationship history.
Ad Attribution & Click Identifiers: Web and messaging referral metadata captured on first contact, including Click-to-WhatsApp identifiers (ctwa_clid), Meta click tokens (fbclid, fbc, fbp), campaign tags (utm_source, utm_campaign), and referral surface headers.
Business Knowledge Assets: Verified documents uploaded by the subscriber (pricing sheets, FAQs, catalog documents, operating hours) and public domain pages crawled with subscriber authorization. Sanitization routines scrub extraneous personal information before ingestion.
Derived Intelligence & Signal Ladder Scores: Algorithmic engagement levels (e.g., Engaged, Qualified, High Intent, Future Buyer Predicted), conversation diagnoses, and craft metrics computed strictly within your tenant workspace.

3. Conversions API (CAPI) & Ad Platform Hashing

When a Business Subscriber enables Conversions API synchronization or audience export, ChatEasy prepares customer milestone events for third-party advertising platforms, including the Meta Conversions API (CAPI) and Google Ads Customer Match.

Strict Identifier Normalization: Prior to transmission, all personal contact identifiers undergo standardized normalization routines:
- Phone Numbers: Formatted strictly into international E.164 numerical format by removing spaces, dashes, parentheses, plus signs, and leading international access digits (e.g., +1 (555) 234-5678 is normalized to 15552345678).
- Email Addresses: Trimmed of leading and trailing whitespace and converted entirely to lowercase characters (e.g., John.Doe@Example.COM is normalized to john.doe@example.com).
- Names: Trimmed, converted to lowercase, and stripped of punctuation.
Irreversible SHA-256 Cryptographic Hashing: Every normalized identifier is immediately processed through a one-way SHA-256 cryptographic hash function (generating a 64-character hexadecimal digest). Plaintext customer phone numbers and email addresses are never transmitted across the network to Meta or Google ad endpoints.
Click Attribution Tokens: Advertising click identifiers (ctwa_clid for Click-to-WhatsApp ads, fbc/fbp browser cookies) and IP addresses are transmitted alongside hashed tokens strictly to establish ad attribution and campaign conversion efficacy.
Affirmative Consent Gate: Conversions API synchronization and audience exports remain disabled by default and cannot be initiated until the Business Subscriber reviews and accepts the Data Sharing Consent Gate in the application dashboard.

4. Zero Message Transcript Disclosure to Ad Networks

Our Absolute Non-Disclosure Guarantee for Ad Platforms

Raw conversation transcripts, customer message texts, chat audio/media, and private internal notes are NEVER shared with, sold to, or synchronized with Meta, Google, or any advertising network.

When audience signals are dispatched to advertising platforms, the payload is strictly restricted to:

Discrete Event Names: Standard and custom milestone identifiers (e.g., Purchase, QualifiedLead, HighIntentEngagement, FutureBuyerPredicted, Lead).
Cryptographically Hashed Identifiers: SHA-256 digests of normalized phone numbers (ph) and emails (em).
Attribution Click Tokens: ctwa_clid, fbclid, fbc, fbp, and transaction currency/value if an actual commercial sale occurred.
Truthful Custom Milestones: Prospective or future buyers are dispatched as FutureBuyerPredicted—we strictly prohibit misreporting prospective signals as completed Purchase events.

5. Cross-Business Conversational Craft Learning & De-Identification

ChatEasy continuously analyzes conversational mechanics to optimize receptionist quality, natural conversational flow, and turn management. We maintain rigorous privacy boundaries for this process:

Heuristic Structural Flow Patterns: Our craft learning engine evaluates aggregated, structural conversational parameters—such as average response length, customer reply latency, greeting word count, acknowledgement framing, and multi-turn closure dynamics.
Separation from Customer PII: Cross-business craft learning operates on de-identified metadata. All customer personal data (names, phone numbers, emails), exact message transcripts, proprietary business documents, pricing models, and private quotes are completely excluded from the craft learning corpus.
Zero Cross-Tenant Leakage: No business ever receives access to the raw conversations, customer contacts, or proprietary knowledge of any other business subscriber. Strict PostgreSQL Row-Level Security (RLS) ensures absolute multi-tenant tenant isolation.

6. AI Processing & Model Providers

The Service utilizes enterprise large language model APIs to generate conversational replies and analytical summaries. We transmit conversation context and verified business knowledge snippets to designated inference providers (including DeepSeek, Google Gemini, NVIDIA NIM, and Groq) under commercial enterprise terms:

Our providers are contractually prohibited from using customer data or business transcripts to train public AI foundation models.
Data is processed in memory during inference and not retained for third-party commercial exploitation.
Failover routing is engineered strictly for high-availability uptime and redundancy.

7. Multi-Tenant Database Isolation & Security

All customer conversation records, knowledge base assets, audience signals, and consent logs are stored in a secured Supabase PostgreSQL database. Every database query enforces strict tenant isolation (business_id filtering and Row-Level Security policies) to prevent cross-business exposure. Data in transit is secured with TLS 1.3 encryption, and data at rest is encrypted using AES-256.

8. Data Retention & Lifecycle Management

Active Accounts: Conversation transcripts, customer contact records, and knowledge assets are retained for the duration of the subscriber's active subscription to provide conversational context and business intelligence.
Conversions API & Audience Queue: Outbox synchronization records and hashed audience queues are retained only as long as necessary to confirm delivery to ad networks, monitor sync errors, or generate authorized exports, after which historical queues are pruned.
Post-Termination Retention: When a subscriber cancels their account, data is retained in a dormant state for a thirty (30) day grace period to allow data export. Following this period, all tenant workspace data, conversation transcripts, knowledge vectors, and tokens are permanently purged from production systems.

9. Data Deletion Rights & Instructions

We provide clear, auditable mechanisms for both Business Subscribers and End Customers to exercise their right to erasure under GDPR (Art. 17), CCPA/CPRA, Meta Platform Terms, and applicable privacy laws:

Subscriber Workspace Full Purge: Business Subscribers may request complete erasure of their account, connected messaging channel tokens, customer contacts, conversation histories, knowledge embeddings, and analytics records by sending an email to privacy@caseshow.info with their verified Business ID. Our compliance engineering team executes a complete purge across production databases within 72 hours.
Meta Self-Service Deletion Callback: For channels connected via Facebook or Instagram, subscribers may navigate to Facebook Settings & Privacy → Apps and Websites → ChatEasy / Ceti Harness → Remove, selecting "Delete your data". Our automated webhook callback immediately purges associated access tokens and confirms the request with a tracking confirmation code.
End-Customer Data Erasure: End-customers who communicate with a business via ChatEasy may request deletion of their contact history directly from that business (as Data Controller). Alternatively, end-customers may submit a deletion request to privacy@caseshow.info specifying their phone number or handle and the business contacted. We will coordinate with the relevant Data Controller to purge the contact record and associated conversation logs.

10. Meta Platform & Social API Compliance

In accordance with Meta Platform Terms, WhatsApp Business Policies, and Instagram Developer Policies:

We never sell, broker, or monetize platform data or user communications.
Channel access tokens are stored securely in encrypted credential stores and used solely to route incoming and outgoing messages.
Channel connections can be unlinked at any time via the workspace settings, immediately halting webhook routing.

11. Your Statutory Privacy Rights

Depending on your jurisdiction (including the EU/UK GDPR, California CCPA/CPRA, and Kenya Data Protection Act, 2019), you may possess statutory rights to:

Request access to and a portable copy of personal data maintained in your account.
Request rectification of inaccurate or outdated contact information.
Object to or restrict specific processing operations.
Withdraw consent previously granted for Conversions API synchronization or audience modeling at any time.
Lodge a complaint with your local data protection supervisory authority.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements in our data architecture, platform integrations, or privacy regulations. Notice of material updates will be posted in the workspace dashboard or sent via email. When updates introduce changes to audience data sharing, businesses will be prompted to review and re-accept terms before further ad network transmissions take place.

13. Contact Our Data Protection Officer

For questions regarding our privacy practices, Conversions API cryptographic protections, or to submit data subject requests, please contact:

Data Protection Desk: privacy@caseshow.info
Legal & Compliance: legal@caseshow.info
Entity: ChatEasy / Ceti Harness
Website: https://caseshow.info