Privacy Policy

This Privacy Policy explains how Chat Octopus, Inc. (“Company,” “we,” “us”) collects, uses, and protects your information when you use the Chat Octopus website and service (“Service”). By using the Service, you agree to the practices described here.

1. Information we collect

Information you provide

• Account information: email address and display name when you create an account.
• Content you upload: files (video, audio, images, PDFs, documents) and text prompts you submit for processing.
• Communications: messages you send to us via email or support channels.
• Payment information: when you buy a plan or credits, our payment processor (Stripe) collects your payment details to process the transaction. We never receive or store your full card number. We store a Stripe customer and subscription identifier, your plan and credit status, and a record of each payment: the amount, any tax amount, the currency, the dates, and details of any payment dispute.

Information collected automatically

• Usage data: pages visited, features used, and interactions with the Service, collected via PostHog (hosted in the EU) and Google Analytics. This includes session replays: recordings of how you move through and use our pages.
• Device information: browser type, operating system, and screen resolution.
• Server logs: IP address, request timestamps, and performance metrics collected by our hosting infrastructure for operational monitoring.

2. How we use your information

• To provide the Service: process your files, generate output, and deliver results.
• To improve the Service: analyze usage patterns to identify bugs, improve features, and understand how the Service is used. Section 4 describes how we use the content you submit, including for AI training.
• To process payments: bill your plan, complete purchases, and manage your subscription and credit balance.
• To communicate with you: respond to support requests, send service updates, and notify you of material changes.
• To maintain security: detect and prevent fraud, abuse, and unauthorized access.

3. Cookies and tracking

We use the following categories of cookies and similar technologies:

We do not use advertising cookies or sell your data to third parties. In the EU, EEA, and UK, analytics cookies are set only if you accept them in the cookie banner: until then Google Analytics runs without cookies and PostHog stores nothing on your device. We remember your choice in a first-party cookie for twelve months, and you can change it any time via the Cookie settings link in the footer. You can also disable non-essential cookies in your browser settings, though this may affect functionality.

4. How we handle your content

Files you upload are processed on secure servers to fulfill your request. Uploaded files and generated output stay in your conversation history until you delete them or close your account. Temporary copies made while a job is running are removed within seven days.

Our systems, and in limited cases our team, may review conversations and content to debug problems, keep the Service safe, respond to your support requests, and improve the Service. Findings from these reviews are kept as counts and categories, never as copies of your content.

We use content and conversations submitted on or after August 2, 2026 to train and improve our AI systems. To opt out, contact us at [email protected] and we will explain the steps and any requirements. Once you delete content, we no longer use it for training.

Otherwise, we do not access, review, or use your content, except where required by law.

5. Third-party services

We use the following third-party services to operate and improve the Service:

• Supabase: authentication, database, and file storage.
• Stripe: payment processing and subscription billing.
• Cloud hosting and content delivery: application hosting, content delivery, and security protection for the Service. Our hosting provider also runs one of the AI models that generate video, on its own infrastructure.
• AI model providers: Google, Anthropic, Groq, and fal.ai process your prompts and files to produce output.
• OpenRouter: routes some of those requests, and passes your prompts and files to the provider it selects.
• Google: also sign-in, if you choose to sign in with a Google account, and Google Analytics for traffic measurement.
• Intercom: support messaging, using your account details.
• PostHog: product analytics (EU-hosted).
• Sentry: error and performance monitoring.

Media processing (trimming, encoding, subtitles, and image operations) runs on our own servers, not at a separate provider.

These providers process data on our behalf, each under its own privacy policy and terms.

Stripe is an exception. For fraud prevention it acts as an independent controller rather than on our behalf, deciding for itself how to use the device and cookie data it collects during checkout, under its own privacy policy.

6. Data retention

We retain your account information for as long as your account is active. Conversation history and the files in it are retained until you delete them. When you close your account we cancel any subscription straight away and schedule deletion for thirty days later; at the end of that period your content, your files, and your account are removed, except where retention is required by law.

Backups are rotated on their own schedule, so deleted data can remain in a backup for a short period afterwards. We do not restore or use it.

Payment and billing records are kept permanently as evidence for tax, accounting, and payment disputes, even after you close your account. These include the amount paid, any tax amount, the currency, the dates, and records of any dispute. The raw messages we receive from Stripe are cleared after ninety days.

7. Data security

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and secure infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children’s privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at [email protected] and we will promptly delete it.

9. Your rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal information.
• Object to or restrict certain processing activities.
• Request a portable copy of your data in a structured format.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. International data transfers

Your data may be processed in the United States and other countries where our service providers operate. Where data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. If a change is material, we will make reasonable efforts to notify you. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

If you have questions about this Privacy Policy or how your data is handled, contact us at [email protected].

Chat Octopus, Inc.
4056 Forest Hill Blvd, Unit #292
Palm Springs, FL 33406
United States