Privacy Policy

3liChat ("we", "us", "our") provides an AI-powered live chat platform that helps businesses ("Customers") communicate with their visitors ("End Users"). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It applies to 3lichat.com, our web application, our chat widget, and our APIs (together, the "Service").

We are committed to protecting personal information and to processing it transparently. If you do not agree with this Policy, please do not use the Service.

Roles. For information you provide to us directly (e.g. to create an account), we are the data controller. For information our Customers process through our Service to provide support to their visitors, we are the data processor acting on our Customers' instructions, and the Customer is the controller.

We collect information in the following categories:

We do not knowingly collect sensitive personal information (such as government IDs, health data, or precise geolocation). Please do not submit such information through the Service.

We use the information we collect to:

• Provide, operate, and maintain the Service, including authenticating you, delivering messages, routing conversations, and producing analytics.
• Train and improve the assistive AI features described in the Service documentation, using only the knowledge a Customer explicitly uploads or instructs us to ingest. We do not use End User conversation content from one Customer to train models for another Customer.
• Communicate with you about product updates, security alerts, billing, and support. Marketing emails are opt-out; transactional emails are required for the Service.
• Detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
• Comply with legal obligations, enforce our Terms, and protect our rights and the safety of users and the public.

Our legal bases for processing under the GDPR are: (a) performance of a contract with you, (b) our legitimate interests in running and improving the Service, (c) compliance with legal obligations, and (d) your consent where required (for example, for non-essential cookies and marketing communications).

When you choose to sign in with Google, we use Google's OAuth 2.0 flow. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The scopes we request, and why:

What we do with this data: we use it only to create and maintain your 3liChat account, to authenticate you, and to display your identity inside the workspace.

What we do NOT do: we do not use Google user data to serve advertising, sell it to third parties, allow humans to read it (except where you give us explicit consent for support, where required to comply with applicable law, or for security purposes such as investigating abuse), or use it for any purpose unrelated to the features listed above.

You can revoke our access to your Google account at any time at myaccount.google.com/permissions. Revoking access does not delete your 3liChat account — see Section 11 (Data deletion) for that.

When you choose to sign in with Facebook, we use Meta's Login product. Our use of information received from Meta's Platform adheres to Meta's Platform Terms and Developer Policies.

The permissions we request, and why:

We do not request, store, or process any other Meta Platform data (friends, posts, pages, photos, messages, ads data, etc.). We do not post to your timeline. We do not use Meta data for advertising.

You can revoke our access to your Facebook account at any time at facebook.com/settings/?tab=applications. To delete the 3liChat data associated with your Facebook account, follow our Data Deletion Instructions.

We use cookies and similar technologies (local storage, session storage) for the following purposes:

• Essential — to keep you signed in, remember your workspace, and protect against cross-site request forgery. These are required for the Service to function and cannot be disabled.
• Functional — to remember preferences such as your theme, sidebar state, and language.
• Analytics — to understand which features are used. These are aggregated and never shared with third-party advertisers.
• Visitor analytics — when a Customer embeds our chat widget on their site, a cookie identifies returning visitors so conversations can be resumed. The Customer is the controller for this cookie and is responsible for obtaining any required consent from their End Users.

You can clear cookies in your browser settings. Some Service features may not work if essential cookies are blocked.

We share information only as described below:

• Service providers (sub-processors). Cloud hosting, email delivery, error monitoring, payment processing, identity providers, and customer-support tooling. We bind each sub-processor by contract to confidentiality and security obligations consistent with this Policy.
• AI model provider. To write AI replies, summaries and lead details, the text of a conversation and the relevant parts of the Customer's knowledge base are sent to our AI model provider, currently OpenAI (United States), which processes it to return a response. A Customer that connects its own AI provider key sends this text to that provider instead.
• Customers. If you are an End User chatting with a Customer's business, the content of your conversation is shared with that Customer's authorised agents.
• Legal compliance. When required by law, lawful process, or to protect rights, safety, and property. We will challenge requests that we believe are overbroad.
• Business transfers. In a merger, acquisition, or sale of assets, with notice to you before your information is transferred and becomes subject to a different privacy policy.
• With your consent. In any other case where you direct us to share information.

A current list of sub-processors is available on request — contact ngtphat98@gmail.com.

We do not sell personal information as that term is defined under the CCPA and similar laws, and we do not share it for cross-context behavioural advertising.

Our servers are located in Singapore. To generate AI replies, conversation text is also sent to our AI model provider in the United States (see “How we share information”). We handle these transfers as required by the laws that apply to us, including Vietnam's Personal Data Protection Law.

On request, we will share a summary of the safeguards used for any specific transfer — email ngtphat98@gmail.com.

We keep personal information for as long as needed to provide the Service and to comply with legal obligations. Typical retention windows:

We implement administrative, technical, and physical safeguards to protect personal information, including:

• TLS (HTTPS) for data in transit.
• Per-tenant data isolation in our application and database tier.
• Role-based access control, with optional two-factor authentication for user accounts.
• Audit logging of administrative actions.
• We will notify affected users and regulators of a personal data breach within the timelines required by applicable law.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security but we work continuously to harden the Service.

Depending on where you live, you may have the following rights with respect to your personal information:

• Access — request a copy of the personal information we hold about you.
• Rectification — ask us to correct inaccurate or incomplete information.
• Deletion ("right to be forgotten") — ask us to delete personal information, subject to legal exceptions.
• Restrict or object — to certain processing, including direct marketing.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — where we rely on consent, at any time.
• Lodge a complaint — with your local supervisory authority.

To exercise any right, email ngtphat98@gmail.com. We will respond within 30 days. If you are an End User of one of our Customers, please contact that Customer first — they control your data and we will assist them with your request.

California residents: the CCPA/CPRA gives you rights to know, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

You have three ways to delete data:

• Self-service. Sign in and go to Settings → Account → Delete account. This deletes your user record. If you are the workspace owner, you must transfer ownership or delete the workspace first.
• Workspace deletion. Workspace owners can delete the entire workspace from Settings → Workspace → Danger zone. All conversations, integrations, and team members are removed.
• Email request. Email ngtphat98@gmail.com from the address on the account. We verify identity, then delete within 30 days.

See our full Data Deletion Instructions page for the procedure required by Meta's Platform Terms.

The Service is not directed to children under 13 (or under 16 in the EU/EEA), and we do not knowingly collect personal information from them. If you believe a child has provided personal information to us, please email ngtphat98@gmail.com and we will delete it.

We may update this Policy from time to time. If we make material changes we will notify you by email or by a prominent notice in the Service at least 30 days before the changes take effect. The “Last updated” date at the top of this page always reflects the most recent version.

Questions, requests, or concerns about this Policy or our handling of personal information? We're here to help.