Your data, handled straight.

ChatGenius is operated by Reston TechWiz LLC, a Virginia limited liability company. Registered address: 1763 Fountain Dr, Reston, Virginia, United States. Contact: privacy@chatgenius.net. Our Data Protection Officer is reachable at dpo@chatgenius.net.

Phone number (WhatsApp / SMS), email address, message content, timestamps, media (photos, voice notes) sent as part of the conversation. Nothing device-level — no fingerprinting, no IMEI, no location beyond what the customer volunteers.

Name, email, business name, billing address, IP addresses of admin sessions (for audit + fraud prevention). Payment card data is handled by Stripe — never touches our servers.

Technical usage stats (page views, feature usage), error logs, performance metrics. Aggregated and anonymised beyond 30 days.

Answer customer messages, notify operators when human help is needed, keep your knowledge base indexed.

Aggregated analytics (which features get used), error tracking (Sentry), performance metrics. Never uses your KB or conversations to train a foundation model.

Message counts, plan tier, overage tracking, invoice generation.

Read your notes, reproduce your issue, close the ticket.

Tax + accounting records (7 years, US IRS + Virginia state law), lawful data requests from authorities (transparency report published annually).

Most processing is necessary to fulfil our contract with you — message routing, KB indexing, operator dashboards.

Analytics, security monitoring, fraud prevention. You can object at any time via privacy@chatgenius.net.

Opt-in only, withdrawable in one click via the account settings or the cookie banner.

US + Virginia state tax + accounting records; lawful requests from authorities.

AI model provider. Conversation content sent to Anthropic for response generation. DPA in place. Zero-retention API mode enabled — Anthropic does not store or train on your data.

Used for operator + admin two-factor authentication codes. If SMS is enabled as a customer channel for your instance, Twilio also carries that traffic. Not used for WhatsApp routing. DPA in place.

Transactional email (confirmations, invoices, password resets). DPA in place.

Messages flow through WhatsApp's network the same way any WhatsApp Web session does — the bridge is registered as a linked device on the operator's phone. No data-processing agreement with Meta, no Meta Business API contract.

Cloud hosting across AWS, OVH, and Hetzner. Region details shared under NDA. Regional deployment on request per instance.

DDoS protection, edge caching, WAF. Sets essential __cf_bm cookie for bot protection.

Maps distance API + Weather API for geo-aware answers. Location-scoped, no personal data forwarded. Turnable off per instance.

Optional AI image generation for the WordPress plugin content tools. Not used by the chat runtime. Turnable off per instance.

Payment processing. Card data never touches our servers.

Cloud infrastructure across AWS, OVH, and Hetzner. Region details shared under NDA. Regional deployment on request per instance.

Encrypted, replicated to a second region in the same jurisdiction as your primary, 90-day retention. AES-256 at rest.

12 months default, configurable per instance (from 30 days to unlimited).

Kept until you delete it. Export at any time via the dashboard.

24 months retention.

7 years (US IRS + Virginia state records retention).

Request a copy of all data we hold on you. Reply within 30 days. Email privacy@chatgenius.net or use the dashboard export.

Update inaccurate data. In-app for most fields, or ask us.

Request deletion. Honoured within 30 days unless we have a legal obligation to retain (e.g., invoices).

JSON export of your data via the admin dashboard. Includes KB, conversations, contacts.

Object to any processing based on legitimate interest (analytics, security monitoring). Email privacy@chatgenius.net.

US customers: FTC (reportfraud.ftc.gov) or Virginia AG. EU customers: your local data protection authority.