DC
Domainchat
Data Security & Compliance

Privacy Policy

Last updated: September 27, 2026

1. Information We Collect

  • Account Information: email, company name, billing details when you sign up
  • Chat Data: messages, session history, conversation metadata between your customers and your AI agents
  • Lead Information: name, email, phone, company when end users submit contact forms
  • Usage Data: feature usage, page views, analytics telemetry
  • Messaging Data: messages sent and received via WhatsApp, Telegram, Instagram, and Facebook Messenger integrations
  • External Calendar & Scheduling Data: account email, OAuth authorization tokens (stored encrypted at rest), external calendar IDs, real-time availability/free-busy status, and event IDs when you connect Google Calendar or Microsoft Outlook

2. How We Use Your Data

  • To operate, maintain, and improve the Domainchat platform
  • To power AI agent conversations using advanced AI language & embedding models
  • To create vector embeddings of your knowledge base for accurate responses
  • To synchronize appointment scheduling and prevent booking conflicts by querying real-time Free/Busy availability on your connected Google Calendar or Microsoft Outlook calendar
  • To write confirmed meeting bookings directly to your external calendar and synchronize reschedules and cancellations
  • To generate analytics and insights about customer interactions
  • To process payments and manage your subscription
  • To comply with legal obligations and enforce our Terms of Service

3. Data Storage & Security

  • Relational data is stored securely with row-level security policy enforcement
  • External OAuth refresh and access tokens (Google and Microsoft) are encrypted at rest using strong AES-256 encryption
  • Vector embeddings are stored in isolated vector storage with per-tenant data vault isolation
  • Caching and rate-limiting data is stored in high-performance memory stores
  • All data is encrypted in transit (TLS 1.3) and at rest
  • Access is controlled via role-based permissions (Owner, Moderator)
  • Compliance events are recorded in a tamper-proof audit log with SHA-256 chaining

4. Data Retention & Protection

  • Active Account Retention: Trained knowledge sources and CRM leads are retained indefinitely while your workspace account is active.
  • Conversation Transcript Retention (180 days): Chat transcripts — messages and conversation metadata between your customers and your AI agents — are automatically and permanently deleted 180 days after a conversation's last activity. Active conversations are never affected; only chats that have been inactive for 180 days are purged.
  • Conversation Continuity & Visitor Sessions: A returning visitor's web-chat conversation resumes for up to 180 hours (~7.5 days) after their last message; after that a fresh conversation begins. The anonymous visitor identifier stored in the visitor's own browser expires after 60 days. On messaging channels (WhatsApp, Instagram, Facebook, Telegram), conversations follow the channel's native thread lifetime and remain subject to the 180-day transcript retention above.
  • Plan Downgrades / Inactivity: Your knowledge sources, CRM leads, and booking records are never deleted due to non-payment or plan downgrades. Secondary agents are safely paused, and all trained knowledge remains 100% saved; chat transcripts remain subject to the 180-day inactivity retention above.
  • 30-Day Recovery Vault: When you initiate workspace deletion, your data enters a 30-day safety vault (PENDING_DELETION). AI agents are paused immediately, but all your data remains securely saved.
  • 1-Click Restoration: Workspace owners can restore their workspace and reactivate agents anytime within the 30-day recovery period.
  • Permanent Purge: After 30 consecutive days in the recovery vault, all tenant records, vector embeddings, lead databases, and transcripts are permanently deleted from our servers.

5. Your Rights & Self-Service Tools (GDPR & Privacy Regulations)

  • Data Export (Portability): Workspace owners can download a complete Workspace Backup (.json) prior to deletion or anytime in workspace settings.
  • Workspace Deletion: Initiate soft deletion with a 30-day recovery window directly from workspace settings.
  • Correction & Erasure: Update account details or request immediate GDPR erasure by contacting info@domainchat.co.
Third-Party Calendar Data

6. Google API & Microsoft Calendar Data Compliance

When you connect your Google Calendar or Microsoft Outlook account to Domainchat (DC Calendar), we access your calendar data via official OAuth 2.0 authorization protocols to enable two-way appointment scheduling.

A. Google Calendar API Data Access & Limited Use

Domainchat requests the following Google OAuth scopes solely to provide calendar scheduling features:

  • https://www.googleapis.com/auth/calendar.readonly: Used exclusively to view your calendar list and inspect Free/Busy availability intervals to prevent double-booking appointments.
  • https://www.googleapis.com/auth/calendar.events: Used to create new calendar events for confirmed customer appointments and to update or delete those events if rescheduled or canceled.

Google API Services User Data Policy Compliance:

Domainchat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

B. Microsoft Outlook (Microsoft Graph) Data Access

When connecting Microsoft Outlook via Microsoft Graph API (Calendars.ReadWrite and User.Read), Domainchat accesses your calendar strictly to query schedule availability and publish, reschedule, or cancel bookings made through Domainchat.

C. Strict Limitations on Calendar Data Use

  • No Advertising: We never use or disclose Google or Microsoft calendar data for serving advertisements, personalized retargeting, or promotional tracking.
  • No AI Model Training: We never use Google or Microsoft calendar data to train, retrain, or improve generalized machine learning or artificial intelligence models.
  • No Third-Party Sale: We do not sell, rent, or lease your calendar data to data brokers or third parties under any circumstances.
  • Minimal Retention: We do not store your external calendar events or personal schedules in our permanent database. Only Free/Busy busy intervals are checked on-the-fly and cached in volatile memory (under 2 minutes) for availability calculations. Only the external event ID created for a Domainchat booking is stored.
  • Human Access Restriction: No humans read your calendar data unless you explicitly give affirmative agreement for customer support, it is strictly necessary to resolve security issues or abuse, or we are compelled by applicable law.

D. User Control & Data Deletion

You can disconnect your Google Calendar or Microsoft Outlook account at any time with one click from DC Calendar > Integrations > Disconnect. Upon disconnection, your stored OAuth access and refresh tokens are permanently purged from our database immediately. You may also revoke Domainchat's access at any time through your Google Security Settings or your Microsoft Account Privacy Portal.

7. Data Controller & Processor

Domainchat is a product of Msquare Digital Hub. Our customers (tenants) act as Data Controllers for their end users' data. Domainchat acts as a Data Processor, processing data solely on our customers' instructions.

8. Cookies

We use cookies and similar technologies for authentication, session management, and analytics. By using Domainchat, you consent to our use of cookies as described in this policy. You can manage cookie preferences through your browser settings.

9. Contact Us

Company: Msquare Digital Hub

Email: info@domainchat.co