Chatla

Privacy Policy

Last updated: August 17, 2026

This policy explains what personal data INTEGER LLC collects when you use the Chatla service (chatla.uz), and how we use and protect it. The data controller is INTEGER LLC.

1. Data we collect

  • Account data: email, name (optional), password hash (bcrypt).
  • Via Instagram OAuth: Instagram user ID, username, profile picture, access token (stored encrypted with AES-256-GCM).
  • Via Instagram webhooks: comment text, the commenter's IGSID and username, message events.
  • Your knowledge base: uploaded FAQs, documents, links and catalog text, plus their vector embeddings (for RAG retrieval).
  • Technical audit: action type, timestamp, IP address and user-agent.

2. Why we use data

  • To provide the service — generating AI replies to comments and messages.
  • Authentication and account security.
  • RAG retrieval — finding the relevant fragment of your knowledge base for a reply.
  • Handing complex requests to a human operator (Inbox).
  • Security and abuse detection (audit log).

3. What we DO NOT do

  • We DO NOT sell your data to third parties.
  • We DO NOT use your customers' message content to train AI models.
  • We DO NOT retain message content for longer than 90 days.

4. Legal basis

Processing is based on: your consent (you connected Instagram), contract (our Terms of Service) and legitimate interest (service security).

5. Retention periods

  • Account and tokens — until the account is deleted.
  • Message content — 90 days, then automatic deletion.
  • When a customer unsends a message — deleted immediately on the `message_deletions` webhook.
  • Audit log — 1 year (for compliance).
  • After account deletion — fully deleted within 30 days (audit log retained in anonymized form).

6. Who we share with

  • Meta (Instagram API) — only via official endpoints.
  • Google Gemini — to generate AI replies. Content is sent to Google, but we use the “do not use for training” mode.
  • Hosting — Hetzner Online GmbH (Germany).
  • Google Analytics — site usage statistics (page views, device, approximate location). Your customers’ conversations and personal data are NOT sent.
  • We DO NOT sell your data.

7. Your rights

You have the right to access, correct, delete, export your data and withdraw consent. Contact: [email protected].

8. How to delete data

Full instructions are on the Data Deletion page (/legal/data-deletion). Or email [email protected].

9. Cookies

Functional cookies: session (Auth.js) and language choice (NEXT_LOCALE) — the service does not work without them.

Analytics cookies: Google Analytics (_ga) — to measure how the site is used. No advertising cookies, and the data is not used for advertising.

In the dashboard, page addresses are stripped of identifiers BEFORE anything is sent to Google: conversation, customer, post and payment IDs are never transmitted — only the screen name (e.g. «/app/inbox»).

10. Security

HTTPS everywhere; Instagram tokens encrypted with AES-256-GCM; passwords hashed with bcrypt; webhooks verified with X-Hub-Signature.

11. Children

The service is not intended for users under 18.

12. Changes

We will notify you by email at least 30 days before any material change to this policy.

13. Jurisdiction and controller

Jurisdiction: Republic of Uzbekistan.

Controller: INTEGER LLC — registered name «INTEGER, MASULIYATI CHEKLANGAN JAMIYATI» (Tax ID 308305720). Address: Farxod street 6A, Uchtepa district, Tashkent, Uzbekistan. Phone: +998 94 639 21 25. Email: [email protected].

Meta Platform Terms: https://developers.facebook.com/terms. Google privacy: https://policies.google.com/privacy.