Last updated: November 5, 2026
1. Introduction
ChatDirect.ca ("we", "our", "us") operates the chatdirect.ca website and the ChatDirect AI chatbot and built-in CRM platform (the "Service"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our Service.
We are committed to compliance with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and the European General Data Protection Regulation (GDPR).
2. Data We Collect
2.1 Information You Provide
- Account information: name, email address, company name, and password (hashed with bcrypt) when creating an account or using the client portal.
- Contact form data: name, email, company, and message content submitted via our contact form.
- Chatbot conversations: messages exchanged between website visitors and the AI chatbot (including via SMS, WhatsApp, Facebook Messenger, and Instagram DM).
- Lead information: name, email, phone number, and other details voluntarily provided during chatbot conversations.
- RAG documents: PDF, Word, and TXT files uploaded by clients, and web page URLs indexed for knowledge base enrichment.
- TOTP secrets: secrets for two-factor authentication (TOTP + backup codes).
2.2 Information Collected Automatically
- Usage data: pages visited, referring URL, conversation timestamps, and interaction patterns.
- Technical data: browser type, device type, and IP address (used for rate limiting and security). In conversations, the IP address is kept in hashed form. In leads (captured contacts), it is recorded in full by default; each client can choose, in its portal, to truncate it, hash it, or not keep it.
- Cookies: session cookies for authentication in the admin panel and client portal. No advertising or tracking cookies are used by the ChatDirect platform itself.
3. How We Use Your Data
- To provide and maintain the AI chatbot and built-in CRM Service, including the CRM AI features described in section 4.
- To process lead capture, scoring, and follow-up sequences configured by the client.
- To send transactional emails (account verification, password reset, support ticket updates).
- To improve our Service, analyze usage patterns, and fix bugs.
- To comply with legal obligations.
We do not sell your personal data. We do not use your data for advertising purposes.
Embeddings generation (RAG): when a client uploads documents or indexes web pages, the text content is sent to the OpenAI API (text-embedding-3-small model) to generate semantic vectors. These vectors are stored in Supabase (PostgreSQL with pgvector) in Canada (AWS ca-central-1, Montréal).
4. CRM Artificial Intelligence Features
The ChatDirect built-in CRM includes assistance features based on artificial intelligence (AI). They process personal information that the client business holds in its account: chatbot conversations, contact details, notes, and activities. For this information, the client business remains responsible for its data; ChatDirect acts as a processor (service provider) and processes it only to provide the Service to that business.
4.1 Features Currently Available
- Contact field filling ("Fill with AI"): completes the custom fields the client has marked "AI" in the CRM settings, based on what the visitor personally stated in the chatbot conversation. Data: conversation content (up to the last 40 messages) and the labels of the fields to fill. Only empty fields are filled; a value entered manually is never replaced, and each addition is recorded in the contact's history as filled by AI. Filling happens on demand (button) or automatically after a conversation ends, only for fields marked "AI".
- Lead score, conversion probability, and intent detection: help prioritize contacts. The score and conversion probability are calculated on our servers using fixed rules (number of messages, conversation length, return visits, pages viewed, keywords, whether contact details were provided). When the intent detection option is enabled in the chatbot settings, the chatbot's AI model also flags an intent level (medium or high) during the conversation; this calculation involves no additional transmission to the AI provider.
- "My day" priority sentence (portal and morning email): suggests where to start the day. Data: titles and due dates of overdue or scheduled activities, names of the related contacts, and the title, stage, and value of stalled deals. The sentence is generated at most once per day per user, and only when there are overdue activities or stalled deals.
- Email drafting assistance: suggests a draft (follow-up, proposal, reminder, thank-you). Data: the contact's name, status, score, and an excerpt of the conversation or deal. The draft is shown to the user, who reviews, edits, and sends it personally; nothing is sent automatically.
- Business card reading (mobile app): pre-fills a new contact. Data: the photo of the card and the contact details it contains (name, email, phone, company, job title, website). The photo is sent to Anthropic (Claude models), the only provider used for this feature, and is not kept by ChatDirect after reading. The user reviews the suggested fields before saving the contact.
- Dictated note cleanup (mobile app): makes a follow-up note readable and, where relevant, suggests a dated follow-up activity (call, meeting, task, email). Data: the text of the note. Voice dictation is converted to text by the phone; ChatDirect receives only the text. The rewritten note and suggested follow-up are presented to the user, who accepts or edits them.
- Negative review analysis (Review Booster): when a customer of the business leaves a 1- to 3-star rating with a comment, AI summarizes the points for improvement for the business and writes a short reply shown to the person who left the comment. Data: the text of the comment. This feature uses the AI provider selected by ChatDirect (Anthropic, or OpenAI as a fallback), regardless of the model chosen by the client.
- Conversation titles and summaries: make the inbox easier to sort. Data: conversation content. The title (a few words) and the summary are stored with the conversation.
4.2 Features in Development
Other features are being developed and may be offered, first as beta features and at the client's request: identifying needs expressed by visitors in chatbot conversations to prepare opportunities (deals) in the client's CRM, case summaries and recommended actions, and preparation of quotes. They will follow the principles of this section, and this policy will be updated before they go live.
4.3 Transmission to the AI Provider
Except for the score calculation, which runs on our servers, the content each feature needs (message text, contact details, notes, or photo) is sent to the AI provider in use: as a rule, the provider of the model chosen by the client (Anthropic, OpenAI, Google, or Mistral), subject to the exceptions noted above. The terms described in section 9 (Third-Party Services and Sub-processors) apply. Results are saved in the client's account, hosted in Canada.
4.4 Suggestions to Review
AI output consists of suggestions: it may be incomplete or inaccurate and must be reviewed by the user. None of these features makes a decision based solely on automated processing that produces legal effects or similarly significant effects for an individual. The lead score and conversion probability are meant to organize sales work and must not be the sole basis for such a decision.
4.5 Usage Limits
These features are subject to per-account limits, for example: 150 contact fillings per 24 hours, 100 calls per 24 hours for the mobile app AI features, and 20 assistance requests per hour in the portal. These limits may change.
4.6 Opting Out or Disabling These Features
- Button-triggered features (filling a contact, drafting an email, reading a card, cleaning up a note) run only when a user starts them.
- Automatic filling applies only to fields marked "AI" in the CRM settings; unchecking them stops it.
- Intent detection and Review Booster are chatbot settings that can be turned off at any time.
- In the mobile app, the user can withdraw consent to the AI features at any time in the More tab (section 4.7).
- Beta features are enabled only at the client's request. To have a CRM AI feature disabled on its account, the client can write to info@chatdirect.ca.
Individuals whose information is stored in a client's CRM exercise their rights (section 7) with that business; they may also write to us, and we will forward their request.
4.7 Mobile App: AI Features and User Consent
In the ChatDirect mobile app, the following features send data to the AI provider chosen by the business (Anthropic's Claude models by default), under the rules in section 4.3 and the details in section 4.1:
- Business card scan: the photo of the card.
- "Clean up" for a note: the text of the note.
- Live chat reply suggestion, "Fill with AI" on a contact record, and conversation titles: the conversation with the visitor.
- AI-drafted email: the contact's name and the start of their conversation.
- "My day" tip: the day's activities and deals.
Before any data is first sent to the AI, the app presents these features and the data involved, and asks for the user's consent. This consent is recorded for the user's account on the device in use. The user can withdraw it at any time in the app's More tab; consent will then be requested again before the next use of an AI feature.
The result is a suggestion that the user reviews before using it (section 4.4). As with the chatbot, the terms in section 9 apply: under their API terms of service, the AI providers do not use this data to train their models.
5. Data Hosting and Storage
The application and primary files are hosted on an OVH virtual private server (VPS) located in Beauharnois, Quebec, Canada. Some CRM data (deals, organizations, products, quotes) is stored in files on this OVH server, in Canada. Other structured data (accounts, conversations, leads, vector embeddings) is stored in a Supabase database (PostgreSQL) hosted in Canada (AWS ca-central-1, Montréal), with encryption in transit (TLS) and at rest (AES-256).
The API keys and integration credentials that clients save in their portal are encrypted using AES-256-CBC.
5.1 Data Isolation (Privacy Wall)
Each client's data is strictly isolated. The ChatDirect team does not have access to client data without explicit temporary authorization (72 hours maximum), granted only for technical support or incident resolution purposes.
6. Data Retention
Conversation data and lead information are retained for as long as the client's account is active, or until the client deletes them.
Clients can delete conversations and leads from their portal; we also delete them on request.
Rate-limiting records (hashed technical identifiers, with no IP address in clear text) are automatically deleted after 24 hours.
7. Your Rights
Under Law 25 and the GDPR, you have the following rights:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate data.
- Right to erasure: request deletion of your personal data. Visitors can also use the built-in "Delete my data" button in the chatbot widget.
- Right to portability: receive your data in a structured, commonly used format.
- Right to withdraw consent: withdraw your consent at any time.
- Right to lodge a complaint: file a complaint with the Commission d'accès à l'information du Québec or your local data protection authority.
To exercise these rights, contact us at info@chatdirect.ca.
8. Cookies
ChatDirect uses only essential cookies required for the functioning of the admin panel and client portal (session management and authentication). The chatbot widget uses localStorage to maintain conversation continuity.
If Google Tag Manager is enabled on the marketing website, it may set analytics cookies subject to their own privacy policies. The chatbot platform itself does not set any third-party cookies.
9. Third-Party Services and Sub-processors
When clients configure their chatbot, conversations, as well as the data used by the CRM AI features (section 4), may be processed by the following AI providers based on the selected model:
- Anthropic (Claude models) — United States
- OpenAI (GPT models + text-embedding-3-small for RAG) — United States
- Google (Gemini models) — United States
- Mistral — France / EU
Each provider processes data according to their own privacy policies. Under their API terms of service, these providers do not use this content to train their models and retain it only for a limited period to detect abuse: generally up to 30 days (up to 55 days at Google), and longer for content flagged as abusive, according to their terms.
Additional sub-processors:
- OVH (virtual private server hosting, VPS) — Canada (Beauharnois, QC)
- Supabase (PostgreSQL database + pgvector) — Canada (AWS ca-central-1, Montréal)
- Stripe (payment processing) — United States
- SMTP2GO (primary email delivery) — New Zealand / United States
- Twilio (SMS and WhatsApp Business, if configured by client) — United States
- Meta (Facebook Messenger and Instagram DM, if configured by client) — United States
- Google Firebase (Firebase Cloud Messaging): mobile app push notifications, processed in the United States. Data sent: the device token and the short content of the notification (for example, the contact's name or a message excerpt).
10. Security Measures
For a summary of our security measures, sub-processors and answers about SOC 2, see our Security page.
- AES-256-CBC encryption at rest for the API keys and integration credentials that clients save in their portal.
- Bcrypt password hashing with individual salts.
- Two-factor authentication (TOTP + backup codes) available on all portals.
- CSRF protection on all forms.
- Rate limiting on all API endpoints.
- HTTP security headers (X-Frame-Options, X-Content-Type-Options, HSTS).
- SSRF protection for webhook URLs.
- Wildcard SSL subdomains for client portals.
- Data isolation (privacy wall) — team access restricted and time-limited (72h).
- Regular internal security reviews.
11. Children's Privacy
Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.
13. Security Incident
In the event of a data breach likely to present a risk to the rights and freedoms of the individuals concerned, we undertake to:
- Notify the Commission d'accès à l'information du Québec within 72 hours
- Inform the individuals concerned as soon as possible
- Document the incident and the corrective measures taken
14. Contact
For any questions regarding this Privacy Policy or your personal data, contact us at:
ChatDirect
Email: info@chatdirect.ca
Quebec, Canada