Privacy Policy

1. Information We Collect

We collect the following types of information when you use Chat33:

1.1 Account Information

When you create an account, we collect your name, email address, password (stored in hashed form), and any optional profile information you choose to provide. If you sign up through a third-party service (Google, or Sign in with Apple in our iOS app), we receive basic profile information from that provider (see Section 1.6).

1.2 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, timestamps, browser type, operating system, IP address, and device identifiers.

1.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and understand how you use the Service. See Section 7 for more details on our cookie practices.

With your consent where the law requires it (EU, UK, Switzerland), we also use the Meta Pixel and Conversions API, Google Analytics 4 and the Whop Pixel to measure how visitors find Chat33 and whether our advertising works. These tools set their own cookies and receive page views and conversion events (sign-up, contact, purchase) together with a hashed email address and name, your IP address and browser user agent, and, for Google Analytics, a pseudonymous client id. You can decline in the cookie banner; declining stops these tools entirely for your browser and for server-side events about your account.

The cookie banner is part of the website. Our mobile apps use different tools and have their own privacy choice, described in Section 1.6.

1.4 Third-Party Platform Data

When you connect your social media accounts to Chat33, we access and process data from those platforms as authorized by you and as necessary to provide the Service. This includes:

• TikTok: Profile information (username, follower count, video count), video performance metrics (views, likes, comments).
• YouTube: Video performance metrics (views, likes, comments) via YouTube Data API Services.
• Instagram: Messaging data, media performance metrics (reach, likes, comments), and profile information.
• Threads: Profile information (Threads user ID, username, display name, profile picture, follower count), the posts you publish through Chat33 and their performance metrics (views, likes, replies, reposts, quotes, shares), replies to your posts, and posts that mention your account.

We do not store the content of messages sent through connected platforms beyond what is necessary for service delivery and analytics.

Threads data. We use your Threads profile information to show which account is connected, publish only the posts you create or schedule in Chat33, and read the metrics of those posts and your follower count to power your analytics dashboard. We read replies to your posts so you can view, answer and hide them in Chat33, and we read replies and mentions to run the automations you set up (for example, an automatic reply to a mention). For a reply or mention that starts one of your automations, we store the author’s Threads username as a contact in your workspace and the text that triggered it in the automation’s activity log. Your Threads access token is stored encrypted and used solely to act on your instructions.

We keep this data for as long as the Threads account is connected to your workspace, and the posts you published together with their metrics remain in your post history until you delete them or your account (see Section 5). When you disconnect the Threads account in Chat33, or remove Chat33 under Website permissions in your Threads settings (Threads then notifies us automatically), we delete the access token immediately and stop all access to your Threads data.

When you request deletion of your data through Threads, we remove the access token, the account’s posts and their metrics, its profile data and the automation activity logs for that account from Chat33, and confirm the request on our data deletion page. Contacts created from replies and mentions by other Threads users remain part of your workspace unless you ask us to delete them at support@chat33.io, which is also where you can request deletion of any other Threads data.

1.5 Financial Data

• Stripe Connect: We facilitate payouts to influencers via Stripe Connect. Bank account details are handled entirely by Stripe and never stored on our servers. We store payout amounts, transaction history, and earnings records.
• Campaign Funding: We process campaign funding via Stripe. Payment details are handled by Stripe. We store campaign funding amounts and transaction records.
• In-app purchases: Subscriptions and credit packs bought in our iOS or Android app are paid through Apple’s App Store or Google Play. Apple or Google processes the payment, and we never see your card details. We store which plan or pack your workspace bought, in which store, the store’s transaction ID, when the subscription renews or ends, and whether it is set to renew.

1.6 Mobile Apps

Chat33 has apps for iPhone (iOS) and Android. This policy covers the apps too. The apps work with the same account and data as the website, and everything in this policy applies to them. This section adds what is specific to the apps.

• Signing in: You can sign in to the apps with your email address, with Google, or on iPhone with Sign in with Apple. From Google we receive your name, email address, profile picture and Google account ID. From Apple we receive an Apple user ID, your email address and, the first time only, your name. If you choose Apple’s Hide My Email, we receive an Apple relay address instead of your real one, and we use that address as your account email. We keep the token Apple gives us encrypted, so that we can ask Apple to end Chat33’s access when you delete your account.
• Photos and videos: When you pick photos or videos to post, to send in a message or to use in an automation, the app uploads them to your workspace. Before the upload, the app removes location and other metadata (such as the device and the date taken) from the file. Uploaded media follows the rule in Section 5.
• Push notifications: If you allow notifications, the app registers your phone with Google’s Firebase Cloud Messaging and sends us the push token it gets. We store the token with your account, the workspace you are signed in to, the platform, the app version and the language of the app, only to deliver your notifications. We do not use it for tracking or advertising. The text of a notification, for example the sender’s name and the first words of a new message, passes through Firebase Cloud Messaging and, on iPhone, Apple’s push service. When you sign out, the app removes the token, and the sign-out stops all notifications to that phone. We also delete tokens of signed-out sessions every day, and tokens of phones where the app has not been started for 60 days.
• Install attribution (AppsFlyer): The apps use AppsFlyer to learn which ad or link brought an install and to measure our advertising. AppsFlyer receives app events (such as opening the app for the first time, onboarding, sign-up and sign-in), your Chat33 user ID, device identifiers, your IP address, and your device type and operating system version. On iPhone the device identifiers are the identifier for vendor (IDFV) and, only if you tap Allow on Apple’s tracking prompt, the advertising identifier (IDFA). On Android they are the advertising ID and the Google Play install referrer. AppsFlyer shares attribution results with the ad networks we advertise on, so they can tell which ads led to installs.
• App analytics (Google Analytics for Firebase): The apps use Google Analytics for Firebase to understand how the apps are used and to measure our Google Ads campaigns. Google receives the Firebase app instance ID, app events (including screens viewed and the events listed above), your Chat33 user ID, purchase events, device identifiers (on iPhone the IDFV, and the IDFA only after you allow tracking; on Android the advertising ID) and your IP address, from which Google derives an approximate location.
• In-app purchases (RevenueCat): The apps use RevenueCat to process subscriptions and credit packs bought in the App Store or Google Play. Each workspace has its own random RevenueCat ID, created by our server, which does not contain your name or email address. RevenueCat receives that ID, your purchase and subscription history and the store receipts. Unless you choose Don’t allow (see below), the app also gives RevenueCat your AppsFlyer and Firebase IDs and device identifiers, and RevenueCat forwards your purchase events (such as purchases, trials, renewals and refunds) to AppsFlyer and Google Analytics for Firebase for advertising measurement.
• Country check: To know whether to ask for your consent (see below), the app asks our server which country it is connecting from. The server works this out from the IP address of the request and answers with the country code. It does not save the answer or link it to you. The app remembers the answer on your phone and asks again only after a reinstall, or on the next start if the check failed.

Your choices in the apps.

• Consent in the EU, EEA, UK and Switzerland: If you use the app in the European Union, the European Economic Area, the United Kingdom or Switzerland, the app asks you once, before any analytics or advertising data is sent, with the choices Allow and Don’t allow. If you choose Don’t allow, the app sends nothing to AppsFlyer or Google Analytics for Firebase, and it does not give RevenueCat the IDs it would need to forward your purchases to them. You can change your choice at any time in the app under More > Privacy choices. Outside these regions the app does not show this question, and AppsFlyer and Google Analytics for Firebase run as described above.
• Tracking on iPhone: Apple’s tracking prompt decides whether the app may read your advertising identifier (IDFA). If you do not allow tracking, the IDFA is not collected. You can change this at any time in your iPhone’s Settings under Privacy & Security, Tracking.
• Advertising ID on Android: You can reset or delete your advertising ID in your phone’s settings.
• Notifications: You can turn notifications off, all of them or by type, in the app under More > Notifications, or for the whole app in your phone’s settings.
• Deleting your account in the app: You can delete your account in the app under More > Delete account. We sign you out on every device, email you a link to restore the account, and delete the account for good after 7 days, as described on our account deletion page. Deleting your account does not cancel a subscription bought in the App Store or Google Play. Cancel it in your App Store or Google Play subscriptions.

2. How We Use Information

We use the information we collect for the following purposes:

2.1 Providing and Improving the Service

• Operating, maintaining, and improving Chat33
• Processing your automated messaging workflows
• Managing your account and providing customer support
• Developing new features and functionality
• Processing campaign participation and content tracking
• Calculating and processing influencer payouts
• Verifying video performance metrics across platforms

2.2 Analytics

• Understanding how users interact with the Service
• Generating aggregated, anonymized usage statistics
• Identifying trends and optimizing performance

2.3 Communication

• Sending transactional emails (account verification, password resets, billing notifications)
• Providing product updates and announcements (with opt-out available)
• Responding to your inquiries and support requests

3. Data Sharing

We do not sell your personal data. We may share your information only in the following limited circumstances:

• Infrastructure Providers: We use third-party cloud hosting and infrastructure services to operate the Service. These providers process data on our behalf under strict contractual obligations.
• Payment Processors: We use third-party payment processors to handle subscription billing. These processors receive only the payment information necessary to complete transactions and are subject to PCI DSS compliance requirements.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction, subject to the same privacy protections described in this policy.
• Stripe: Payment processing and influencer payouts via Stripe Connect. Stripe receives the financial information necessary to process transactions and payouts.
• AppsFlyer: Install attribution and advertising measurement for the Chat33 mobile apps, to measure which ads and links lead to app installs. AppsFlyer receives app events, your Chat33 user ID, device identifiers (on iPhone the IDFV, and the IDFA only if you allow tracking; on Android the advertising ID), install and campaign data, your IP address, and your device type and operating system version, and shares attribution results with ad networks. See Section 1.6.
• Google Analytics for Firebase: App analytics and Google Ads measurement for the Chat33 mobile apps. Google receives the Firebase app instance ID, app events, your Chat33 user ID, purchase events, device identifiers and your IP address. See Section 1.6.
• Firebase Cloud Messaging (Google): Delivery of push notifications to the Chat33 mobile apps. It receives your phone’s push token and the content of each notification. On iPhone, notifications are delivered through Apple’s push service.
• RevenueCat: Processing of in-app purchases and subscriptions in the Chat33 mobile apps. RevenueCat receives a random app user ID per workspace that contains no name or email address, your purchase and subscription history, and the purchase receipts from Apple or Google. Unless you choose Don’t allow in the app, it also receives your AppsFlyer and Firebase IDs and device identifiers, and forwards your purchase events to AppsFlyer and Google Analytics for Firebase. Payment details stay with Apple or Google.
• Apple and Google (App Store and Google Play): Payments for in-app purchases, processed by Apple or Google under their own terms and privacy policies, and sign-in when you choose Sign in with Apple or Google.
• TikTok: API access for video performance metrics, authorized by the user upon connecting their TikTok account.
• YouTube/Google: API access for video performance metrics via the YouTube Data API, authorized by the user upon connecting their YouTube account.

AI assistants you connect. If you connect an AI assistant (for example Claude, ChatGPT, Cursor or Codex) to your Chat33 workspace, the messages, comments and other data the assistant requests are sent to that assistant’s provider on your instruction. You choose which assistant to connect and can disconnect it at any time in Settings → API Keys → Connected AI apps.

Integrations you set up. When you set up a webhook, an API key, an automation tool (such as n8n or Zapier) or a webhook step in a flow, we send the data you choose, for example the messages people send to your connected accounts, to the address or service you configure. You choose and control these integrations and can remove them at any time in Settings → API Keys or in the flow. Email addresses your flows collect (captured leads) are forwarded only to the tools the workspace owner connects, such as Mailchimp, HubSpot or their own webhook.

4. YouTube API Services

Chat33 uses YouTube API Services. By connecting your YouTube account to Chat33, you agree to be bound by the Google Privacy Policy.

YouTube data accessed and stored by Chat33 includes:

• Your channel identity (channel name, ID, thumbnail, subscriber and video counts) to show which account is connected
• Videos you explicitly instruct Chat33 to upload to your own channel, together with the metadata you provide (title, description, tags, category, privacy setting, made-for-kids declaration)
• Performance statistics of your own videos (view, like, and comment counts) to power your analytics dashboard
• OAuth tokens, stored encrypted, used solely to act on your explicit instructions

Chat33 never uploads to your channel without your explicit action. When you disconnect the channel, we delete its access tokens and the thumbnails we copied from YouTube. Channel details and post statistics are deleted when you delete your account. Videos you upload through Chat33 are your own media and follow the uploaded media rule in section 5.

You can revoke Chat33’s access to your YouTube data at any time via Google Security Settings.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Specifically:

• Active accounts: Data is retained for the duration of your account’s existence.
• Account deletion: Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as fraud prevention or financial record-keeping).
• Uploaded media: Media you upload (images and videos) is your content. It is stored in your workspace so you can reuse it, until you delete it or your account is deleted, in which case it is removed within 30 days. Thumbnails we copy from a connected platform are removed when you disconnect that channel or delete your account.
• Push tokens: A phone’s push token is deleted when you sign out of the app on that phone, when the session ends, when the app has not been started on that phone for 60 days, or when your account is deleted.
• Usage logs: Aggregated and anonymized usage data may be retained indefinitely for analytical purposes.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: You have the right to request a copy of the personal data we hold about you.
• Correction: You have the right to request correction of inaccurate or incomplete personal data.
• Deletion: You have the right to request deletion of your personal data, subject to certain legal exceptions. See how to delete your account. In our mobile apps you can delete your account under More > Delete account.
• Data Export: You have the right to request a portable copy of your data in a commonly used, machine-readable format.
• Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. In our mobile apps you can change your choice under More > Privacy choices.
• Non-Discrimination (CCPA): We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at contact@chat33.io. We will respond to your request within 30 days.

7. Cookies

We use the following types of cookies:

• Essential Cookies: Required for the Service to function properly. These include session cookies, authentication tokens, and security-related cookies. These cookies cannot be disabled.
• Analytics and Advertising Cookies: Set by the measurement tools described in Section 1.3, to understand how visitors interact with the Service and whether our advertising works. In the EU, the EEA, the UK and Switzerland they are only set with your explicit consent. You can block or delete them at any time in your browser settings.
• Attribution Cookie: When you arrive through a campaign link or a referral link, we store the campaign parameters (such as utm_source), the referring site and the referral code in a cookie for 60 days, and attach them to your account if you sign up, so we can see which campaigns and referrers bring new users. This cookie contains no personal data and is not shared with third parties.

We do not use advertising or third-party tracking cookies other than those of the tools described in Section 1.3. You can manage your cookie preferences through your browser settings. Note that disabling essential cookies may impair the functionality of the Service.

8. International Data Transfers

Chat33 is operated by Nitrotech Inc. from the United States. Your data is processed and stored on servers located in the United States.

If you are accessing the Service from outside the United States, please be aware that your data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on appropriate legal mechanisms for data transfers, including Standard Contractual Clauses (SCCs) as approved by the European Commission, to ensure adequate protection of your data.

9. Children’s Privacy

Chat33 is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to promptly delete such information.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at contact@chat33.io so that we can take appropriate action.

10. Security Measures

We implement industry-standard security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256 encryption.
• Access Controls: We enforce role-based access controls, multi-factor authentication for internal systems, and the principle of least privilege for all employees and contractors.
• Regular Audits: We conduct regular security assessments, vulnerability scans, and penetration testing to identify and remediate potential security risks.
• Incident Response: We maintain an incident response plan and will notify affected users of any data breach within 72 hours of discovery, as required by applicable law.

While we take extensive precautions to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the “Last updated” date at the top of this page. For significant changes, we may also provide additional notice through email or in-app notifications.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

12. Contact for Privacy Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: