The short version: When you use the assistant on a store powered by Chad, we handle that conversation for the store — and, separately, we build a cross-store profile about you (for example, how often you return items) that stores using Chad can look up. This notice explains what we do with your information and how to opt out of the cross-store profile — for free, at any time.
1. Who we are
Chad Enterprises Inc. (“Chad”, “we”, “us”) is a US company that builds AI assistants that handle customer support and sales for online stores. When you chat with the assistant on a store’s site, you are talking to Chad’s technology. You can reach us at hello@trychad.com.
We act in two different roles. When we handle your conversation to answer your questions for the store, we act on that store’s behalf (as its “processor”). Separately, we build a cross-store shopper profile for our own product, and for that we decide how your data is used (we are a “controller”). This notice focuses on the second — the part we are responsible for — and on your rights.
2. When this notice applies
This notice applies to you if you interact with the Chad assistant, or otherwise have your data processed by Chad, at any online store that uses Chad. It is provided under Articles 13 and 14 of the EU General Data Protection Regulation (“GDPR”) and its UK equivalent. It supplements the store’s own privacy notice and our Privacy Policy and GDPR Policy — the store remains responsible for telling you how it uses your data.
3. The cross-store shopper profile
Chad builds a profile of each shopper by combining:
- your purchase and return history at stores that use Chad — for example, how many orders you place and how often you return items or raise disputes; and
- signals we take from your chat conversations — for example, patterns that suggest returns abuse.
We pool this across the stores that use Chad, so that a store can look you up and see a reliability signal — for example, whether you tend to keep or return what you buy — to help it decide how to serve you.
Our lawful basis is our legitimate interest, and the stores’, in reducing return fraud and abuse and in serving reliable customers well (GDPR Article 6(1)(f)). The signal is advisory: a person at the store sees it and decides. Chad does not automatically block you, refuse a return, or stop you checking out.
4. Your right to object — how to opt out
You have the right to object to the cross-store profile. There are two ways to do this:
- In the assistant, use the opt-out link. This stops us using your information for the profile from that point on, and needs nothing from you — no email, no account.
- Email hello@trychad.com. Use this if you also want us to consider erasing the information we have already gathered about you from past visits, based on grounds relating to your particular situation. Unless we have compelling legitimate grounds to continue, or need to keep the data to establish, exercise or defend legal claims, we will suppress or erase it. Because those records are not tied to your name, we may need to ask you for the email address you used so that we can identify them.
We keep only the minimum needed to remember that you objected, so that we do not rebuild your profile later.
5. What the profile holds
The profile holds your commerce history (such as order, return, refund and dispute activity) and behavioural signals we extract from your chats (such as indicators of returns abuse). We do not keep the raw text of your conversations in the profile, and we do not collect or try to infer special categories of data (such as health, religion or political views), even if a conversation happens to touch on them.
6. Handling your conversation for the store
When you chat with the assistant, we process the conversation to understand and answer your question on the store’s behalf, which includes sending it to third-party AI providers that generate the assistant’s replies. For this part we act on the store’s instructions as its processor; the store is the controller and is responsible for its own privacy notice. We keep a record of the conversation — see “How long we keep it” below.
7. Improving our AI
We may use conversation data to test and improve how our AI works, but only after it has been irreversibly anonymised so that it can no longer identify you — at which point it is no longer personal data. We do not train our own AI models; we use commercially available models. Because this use is limited to anonymised data, it does not affect your rights over your personal data.
8. Who we share information with
We share information with the store you interact with, and with service providers that process data on our behalf and on our instructions — our cloud infrastructure and the AI providers that power the assistant. We may also disclose information to professional advisers, to authorities where the law requires it, and in connection with a corporate transaction, as described in our Privacy Policy.
9. Where your data is processed, and international transfers
We are based in the United States, and your information is stored and processed there. Where personal data is transferred from the EU/EEA, the United Kingdom, or Switzerland, we rely on our certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework and, where applicable, on the European Commission’s Standard Contractual Clauses. See the Data Privacy Framework section of our Privacy Policy for details; a copy of the applicable safeguards is available on request at hello@trychad.com.
10. How long we keep it
We keep your profile for as long as at least one store you deal with still uses Chad to serve you. If you opt out, we stop using your information for the profile and keep only the minimum needed to honour your objection.
While the store you’re chatting with keeps using Chad, we keep a record of your chat conversations for as long as it stays necessary to run and improve that store’s support — for example, so the store can review conversations to train its staff and for safety checks — and so we can send you a copy if you ask. If that store stops using Chad, we keep a record of your conversations with it for up to 10 years from the date of each conversation, for dispute resolution, legal claims and safety, and then erase it. Those transcripts are separately anonymised to help improve our AI, and once anonymised they are no longer personal data.
11. Your other rights
If the GDPR or UK GDPR applies to you, you also have the right to request access to your personal data, to have it corrected or erased, to restrict or object to our processing of it, and to data portability where applicable. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
If you are in the EU/EEA or the United Kingdom, exercise any of these rights through our GDPR representatives (Article 27) — Euverify Ltd, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland (EU representative), or Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom (UK representative) — by emailing gdpr@euverify.com. If you are located anywhere else, email us at hello@trychad.com.
You also have the right to lodge a complaint with the data protection authority in your country — though we would appreciate the chance to resolve your concern first through the routes above.
12. Changes to this notice
We may update this notice from time to time; the current version will always be available at this address, with the “Last revised” date shown at the top.