OpsBots — privacy notice

Self-drafted by CHK GmbH; not reviewed by a lawyer.

Who is responsible

CHK GmbH is responsible for personal data used to operate its own website, accounts, billing and security. Contact and postal details are in the imprint. For privacy requests use support@opsbots.ch.

When a business supplies knowledge documents or connects a customer-service channel, that business normally decides why its customers' data is processed. CHK processes those data on its instructions under the DPA. Ask that business about its chatbot, messages and customer records. CHK forwards requests it receives in this role to that business. When you contact CHK about OpsBots itself, CHK is responsible for handling your enquiry. CHK is also responsible for the demo workspaces it sets up itself to show OpsBots, as long as no business owns them.

What we collect and why

• Account and team information: name, e-mail address, workspace, website, stated use case, membership role and invitation status. We use these to create and administer access, support you and communicate about the service.
• Login and security information: password hashes, encrypted authenticator secrets, hashed recovery and session tokens, login attempts and network-derived identifiers. We use these to authenticate users, prevent abuse and investigate incidents. Network hashes are pseudonymous identifiers, not anonymous data.
• Contract records: the document versions acknowledged, the time and a hashed network identifier. Acknowledging this notice is not blanket consent to unrelated processing.
• Billing information: chosen plan, billing country, subscription status, Stripe identifiers, transaction events and invoice information. Stripe collects payment-card details on its own checkout; OpsBots does not store full card numbers. To allow one free trial per business, we keep a pseudonymous value, derived with a secret key, of the website's domain and of the card's Stripe fingerprint (not the card number), linked to the workspace, for 24 months. This also applies after the account is closed or deleted, as that is its purpose. Social-media and directory pages give no website value.
• Support, website and service information: enquiries, request time, route, outcome, technical identifiers, usage counts and operational errors. Our application logger restricts fields and does not intentionally record message bodies or credentials. Hosting and payment services may hold their own technical logs.
• Installation check: for each chat widget, the time and the website address from which the chat window last opened on an allowed website, and the last address that was refused. This shows the business whether its chat is installed correctly. Nothing about the website's visitors is stored.
• E-mails during the trial: while a workspace is new, its owner receives service e-mails about it from OpsBots: a welcome when the free trial starts; at most two setup tips during the trial, for example when the chat is not switched on yet; one reminder to activate a workspace that has no card yet; and a warning at least three days before the deletion date of a workspace that was never activated. They are plain-text e-mails without tracking pixels or tracked links; we do not record whether they are opened. Each tip contains a link to stop further tips with one click, for all workspaces of that login; we then keep that choice, with the code of the link in hashed form, as long as the account exists. Codes of links that were not used are deleted after 90 days. The welcome and the deletion warning belong to the service and cannot be switched off.
• Customer-controlled content: uploaded files, website extracts, search representations, questions, answers, feedback, leads, consent records and human-handover records. A connected mailbox adds relevant correspondence, addresses, thread identifiers, draft replies and access credentials. A connected WhatsApp number adds the data listed under WhatsApp below. Only enabled, connected channels apply. The client determines the permitted content and recipients.

Applicable rules and purposes

We apply the Swiss Data Protection Act, including purpose limitation, proportionality, transparency and security. Swiss private-sector processing does not rely on the GDPR's legal-basis catalogue as a universal requirement. Where a justification is necessary, we assess consent, an overriding interest or a statutory basis as applicable.

Where the GDPR applies, account and service processing may be necessary for a contract with the individual or requested pre-contract steps. For company staff, our legitimate interests are administering the business relationship, supporting users and securing the service. Billing and accounting may require compliance with legal duties. Optional processing that needs consent uses a separate choice; consent can be withdrawn for future processing. Contract acknowledgement does not replace it.

We do not use this service to make solely automated decisions with legal or similarly significant effects about individuals. Do not submit sensitive information merely because an AI can accept it. Client use involving sensitive or regulated data needs a separate assessment and agreed safeguards.

Recipients and transfers

Authorised CHK personnel and service providers receive the information needed for their duties. We disclose information to authorities where legally required and to advisers where needed for legal claims, with appropriate safeguards. We do not sell customer content for advertising.

OpsBots stores its data mainly with Render in Frankfurt, Germany. The AI model is Anthropic's Claude, listed as Anthropic (US): Anthropic stores the data in the United States and may run the model in other countries. Search and OpsBots' own e-mails run with Scaleway in Paris, France; payments with Stripe in Ireland and the United Kingdom; the support mailbox with Infomaniak in Switzerland. Render and Anthropic belong to US companies. The provider list names each provider, what it receives, where and in which role.

Switzerland recognises Germany, France, Ireland and the United Kingdom as countries with adequate data protection. For the United States we rely on the providers' data processing agreements: the Swiss-U.S. Data Privacy Framework where it applies, otherwise standard contractual clauses. We do not assume that a server in Europe rules out access from the United States, or that a provider's certification covers every service. You can ask support@opsbots.ch for details of the safeguards.

WhatsApp

WhatsApp is not offered to customers yet; CHK tests it on its own demo workspace. Once it is offered and a business connects its WhatsApp number, the business is the controller of the messages its customers send and CHK is its processor under the DPA. Meta Platforms delivers the messages through the WhatsApp Business Platform (Cloud API) as the business's own processor, under the terms the business accepts with Meta when it connects the number. Meta keeps message data for at most 30 days and does not use Cloud API messages to choose ads. Meta bills its fees to the business directly.

For each person who writes to a business on WhatsApp, OpsBots receives and keeps:

• the message text, kept as the conversation, like the website chat. Only text: photos, voice messages and files are not downloaded; the conversation shows a placeholder such as "[image]";
• the WhatsApp profile name, shown to the business's staff and kept with the contact;
• the phone number and Meta's business-scoped user ID, stored as keyed hashes to recognise a returning customer, and the number also encrypted, as the address replies go to; kept with the contact;
• times: the last message (a business may reply freely only within 24 hours of it), an opt-out by "STOP", and a hold that stops automatic answers when WhatsApp reports that the person's number or identity changed; kept with the contact;
• the delivery status of OpsBots' replies (sent, delivered, read, failed), without identifiers in plain text; kept with the conversation;
• Meta's original notification of each message, sealed and encrypted, for at most 7 days.

As in the website chat, the message text goes to the AI model and the search provider named in the provider list. The periods under "Retention and deletion" apply.

Google user data (Gmail)

When a business connects a Gmail mailbox (Google Workspace), OpsBots asks Google for two permissions: to read the mailbox's messages and settings (gmail.readonly) and to manage its drafts (gmail.compose). OpsBots uses them only to find e-mails that need a reply and to write reply drafts into that mailbox for the business's staff to review. It changes or deletes only its own unchanged drafts and never sends e-mail, although the drafts permission would allow it.

For each e-mail it checks, OpsBots keeps the sender address and subject for up to 30 days after it arrived, to show the business's staff what the mailbox received; the message identifier, so that no message is handled twice; and keyed hashes of the sender and the sender's domain, to apply the per-sender and per-domain limits. Each completed check of the mailbox deletes message identifiers older than 8 days and hashes older than 2 days; disconnecting the mailbox also deletes the hashes. While a mailbox is not checked, for example when its channel is switched off, they stay until the next check or until the workspace is deleted. For every e-mail thread it checks, OpsBots keeps the thread identifier and what it decided and, for a thread it answered, the identifiers of that e-mail and of its own draft with a fingerprint of the draft, until the workspace is deleted, also after a disconnect, so that it recognises its own drafts when the mailbox is connected again. For the e-mails it answers or hands to the business's staff, it keeps the text, addresses and thread identifiers as e-mail conversations with their draft records, for the periods under "Retention and deletion". It keeps the access token, encrypted, until the mailbox is disconnected. The message text goes to the AI model and the search provider named in the provider list, only to answer the e-mail. Google user data is not sold, not used for advertising and not used to train AI models. People at CHK read it only with the business's permission, for security, or where the law requires it.

OpsBots' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting the mailbox in OpsBots deletes the stored access token; you can also remove OpsBots' access in your Google account's security settings. Drafts already written stay in the mailbox.

Our chat on opsbots.ch

Our chat on opsbots.ch is OpsBots' own website chat, which CHK runs for its own website. CHK is the controller of what you write in it. It answers from the public text of this website. On the home and prices pages, the chat button loads from app.opsbots.ch with each page view, which gives that server your IP address and the page address, like any page request; the chat window loads from there when you open it. When you use it, OpsBots keeps:

• what you write and the answers, as a conversation, for 12 months after its last activity;
• what you enter in the chat's contact form (name, e-mail address, and optionally a phone number and a message), with the record of your consent, as a contact, for the same period;
• your network address only as a keyed hash, to limit abuse;
• a session token in the tab's session storage, described under "Cookies and browser storage".

OpsBots stores this data with Render in Frankfurt, Germany. The message text goes to the AI model, Anthropic's Claude (Anthropic (US): Anthropic stores the data in the United States and may run the model in other countries), and to the search provider Scaleway in Paris, France; the provider list names each provider. Please don't enter sensitive information. Your rights are described below.

Cookies and browser storage

OpsBots uses the necessary account cookie __Host-sid for login. It is Secure, HttpOnly and SameSite=Lax. Active sessions stop working after 12 hours of inactivity or seven days at the latest; an incomplete two-step login expires after five minutes. Those are access lifetimes, not a promise that every database row is erased at expiry. The admin interface also saves your chosen language in local browser storage (admin.lang), and the open tab and a one-time notice in the tab's session storage (admin.inboxTab, admin.kTab, admin.notice); you can clear them in your browser settings.

The chat widget uses tab-scoped session storage for its session token, or memory when storage is unavailable. It does not need a tracking cookie. OpsBots sets no advertising or cross-site tracking cookies and uses no analytics or tracking service. The opsbots.ch website sets no cookies; when you open our chat there, the chat window keeps its session token as described above. Stripe's checkout and billing portal are Stripe's own pages, with Stripe's own cookies and privacy notice.

Retention and deletion

We retain account information while it is needed for your account, and retain limited evidence afterwards only for documented legal duties or claims. Statutory accounting records are generally kept for ten years after the relevant financial year. This does not mean every conversation is an accounting record.

The current cleanup jobs remove login-attempt records and billing-event deduplication records after 30 days, other webhook records after seven days, completed job records after seven days and failed job records after 30 days. Signup and password-reset request records become eligible for cleanup one hour after use or expiry; free-trial claims after 24 months. Actual cleanup depends on the scheduled worker running.

Retention periods: conversations (including e-mail conversations and their draft records), contacts (leads) and consent evidence are kept for 12 months after the last activity in the conversation; the security and audit log for 24 months; support correspondence with CHK for 24 months; accounting records for 10 years, as Swiss law requires. Until an automatic purge is available, CHK deletes expired records manually at least once a month and records each run. Disconnecting a mailbox removes its access token and pauses access. The e-mail conversations OpsBots has already stored stay under the periods above, and drafts already written into your mailbox stay there.

Closing a workspace stops its channels and records a deletion date 30 days later, or keeps an earlier deletion date already set because the subscription had ended at Stripe. If a subscription ends at Stripe without the workspace being closed, the deletion date is 90 days after the end. A workspace that is never activated (no card added, or a first payment that never went through) gets a deletion date 14 days after it was created and can no longer be used from that date. Its owner receives a warning e-mail at least three days before; if the warning goes out late, the date moves so that three days remain. The login goes too if it belongs to no other workspace. Until then, export conversations and contacts as CSV files or ask CHK to return your data. Until automated deletion is available, CHK deletes the data manually within 30 days after the deletion date and records the deletion. Legal holds and accounting duties apply only to the records they actually require.

Backups are kept for at most 30 days and then expire. If a backup is ever restored, CHK re-applies every deletion made since that backup before the data is used again. The hosting provider currently keeps database recovery copies for 3 days and manually created backups for 7 days. Providers keep their own copies only for the periods stated in the provider list.

Your rights

Depending on the applicable law and conditions, you may request access, correction, deletion, restriction, or a portable copy, object to processing based on legitimate interests, and withdraw consent. We may need proportionate identity verification and may retain records where a legal exception applies. There is no charge for exercising rights unless the applicable law allows one.

You may contact the Swiss FDPIC or the competent data-protection authority, including an EU authority where applicable. Contact CHK for its own processing and the relevant business for customer-channel processing.

Changes

We publish the date and version of this notice. Material changes will be communicated through the account or contact address before new optional processing begins; processing requiring consent will need a new choice.