1. Who We Are

Chatseeker ("we", "us", "our") provides a SaaS platform for creators and agencies.

This Privacy Policy explains what data we collect, how we use it, how we share it, and your rights.

This Policy should be read together with our Terms of Service and Data Processing Agreement (DPA).

2. Controller vs Processor

We operate in two roles:

2.1 When we are the Data Controller

We act as Controller when we process data of:

account owners
users of our platform
billing and support contacts

2.2 When we are the Data Processor

We act as Processor when our customers use the Service to process data of:

fans
subscribers
third-party users

In that case, the Customer is the Controller and we process data on their behalf.

3. Personal Data We Collect

We collect Personal Data you provide directly, Personal Data collected automatically when you use the Services, including through trackers such as cookies, pixels, and SDKs as described in our Cookie Policy, and Personal Data we receive from service providers that support core functions such as payments, analytics, and customer support.

3.1 Personal Data you provide directly

Name
Email address
Account credentials
Support messages

3.2 Personal Data processed through the Service

Chat messages
Media (images, videos, files)
User interactions
Purchase behavior
Paid message and tip activity used to calculate payable commission
Tags, segmentation, analytics

This data is controlled by the Customer.

3.3 Automatically collected data

IP address
Device information
Browser data
Usage logs
Cookie, pixel, and SDK-derived usage information

3.4 Personal Data received from service providers

Payment status and transaction metadata
Analytics insights
Support and account administration information

4. Sensitive Data

Due to the nature of the Service, Customer Data may include:

intimate or personal communications
behavioral patterns
potentially sensitive personal data

Chatseeker does not determine the nature of such data and processes such data solely on Customer instructions. The Customer is responsible for obtaining consent and ensuring lawful processing.

5. How We Use Data

We use data to:

provide and operate the Service
process payments
provide support
ensure security
provide AI functionality through OpenRouter
track paid message and tip activity to calculate payable commission
track AI usage and related cost signals through OpenRouter where OpenRouter is used to provide AI functionality
improve performance

We do not currently sell personal data or share personal data for cross-context behavioral advertising.

6. Sharing of Data

We may share data with:

Service providers and partners

providers that support hosting, infrastructure, analytics, payments, customer support, security, and related operational functions
Hetzner for hosting, server infrastructure, and related infrastructure operations
Cloudflare for security, content delivery, network protection, bot protection, and Turnstile verification
BetterStack for uptime monitoring, logging, alerting, and incident diagnostics
PostHog for product analytics in the active dashboard and service improvement
Featurebase for customer support, feedback management, and support communications
OpenRouter for AI message and content processing
Stripe and related payment providers for payment processing, billing, fraud prevention, and payment administration
professional advisors such as auditors, lawyers, and insurers where reasonably necessary

Operational providers may process technical data such as IP address, device and browser data, usage events, logs, error diagnostics, security signals, messages, and content where needed to provide, secure, monitor, and improve the Service. Messages and related content may be processed through OpenRouter to provide AI functionality, and OpenRouter usage data may be used to track AI usage and related cost signals. Payment processing is handled by Stripe. Chatseeker does not store full payment card details.

Legal, compliance, and protection purposes

competent authorities, regulators, courts, or law enforcement where required or permitted by law
parties involved in fraud prevention, security, incident response, or the protection of rights and property

Corporate transactions

relevant counterparties and advisors in connection with an actual or proposed merger, acquisition, financing, reorganization, or sale of assets

We do not currently sell personal data, share personal data for cross-context behavioral advertising, or use retargeting advertising.

7. International Data Transfers

The Services and the server infrastructure used to provide them are hosted and operated in the United States, currently using Hetzner infrastructure.

We also use operational providers such as Cloudflare, BetterStack, PostHog, Featurebase, and OpenRouter to secure, monitor, analyze, support, provide AI functionality, and improve the Service.

As a result, Personal Data may be processed in the United States and, where necessary for service delivery, in other jurisdictions.

Where applicable law requires additional safeguards for cross-border transfers, we rely on appropriate mechanisms such as contractual protections, including Standard Contractual Clauses, and related transfer safeguards.

8. Data Retention

We retain data:

as long as necessary for service provision
for legal obligations
for dispute resolution

We may retain data longer if required by law, including legal hold scenarios.

9. Data Deletion

Upon request or termination, data will be deleted or anonymized unless legal retention is required.

Customers are responsible for exporting their data.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, loss, misuse, alteration, and disclosure, including:

Encryption where appropriate
Role-based access controls applying least-privilege principles and multi-factor authentication
Network segmentation and firewalls
Logging and monitoring
Vulnerability management and timely patching
Secure development practices
Employee confidentiality obligations and security training
Vendor due diligence and contractual security obligations
Business continuity and disaster recovery planning
A documented incident response process

While no security measure can eliminate all risk, we design and operate our safeguards to align with the sensitivity of the data we process and the nature of the Services.

11. Your Rights

Depending on applicable law, you may have the right to:

access your data
correct data
delete data
restrict processing
data portability
withdraw consent

11.1 Processor Data Requests

If your data is processed by a Customer, contact the Customer directly. We assist them as required.

12. US State Privacy Rights and California Notice

Depending on where you live and applicable law, including certain United States state privacy laws, you may have additional privacy rights regarding Personal Data we process as a Controller.

request access to Personal Data we hold about you
request correction of inaccurate Personal Data
request deletion of Personal Data, subject to legal and operational retention requirements
request a portable copy of your Personal Data where applicable
opt out of certain processing activities where applicable
exercise your rights without unlawful discrimination

12.1 California and US State Requests

This notice is provided on a conservative basis and does not mean that every United States state privacy law applies to Chatseeker in every circumstance.

Account owners, platform users, billing contacts, and support contacts may submit privacy requests to manuel@kollus.io.

12.2 Customer-Controlled Data

If you are an end user, fan, subscriber, or other person whose data is processed through a Customer's use of the Service, please contact that Customer first. In that context, Chatseeker usually acts as a processor, service provider, or contractor and assists the Customer as required.

12.3 Sale, Sharing, and Retargeting

We do not currently sell personal data or share personal data for cross-context behavioral advertising.

PostHog is used for product analytics and dashboard improvement, not for advertising retargeting.

We do not currently use retargeting advertising. If this changes, we will update our privacy disclosures and consent controls before activating those activities.

13. Cookies and Tracking

We may use cookies and tracking technologies for analytics and service functionality.

We do not currently use retargeting advertising cookies or advertising pixels for behavioral retargeting.

14. Children

The Services are intended for adults aged 18 or older, or the age of majority in the jurisdiction where the individual resides, if higher, and are not directed to children.

We do not knowingly collect Personal Data from anyone under the age of 18.

If you believe that a minor has provided Personal Data to us, please contact manuel@kollus.io and we will take appropriate steps to delete that information promptly.

15. Data Breach Notification

In case of a breach, we investigate, mitigate, and notify where required.

16. Changes

We may update this Policy.

Continued use of the Service constitutes acceptance.

17. Contact

For privacy requests: manuel@kollus.io