Legal
Privacy policy: chatcommerce.io
Lire ce texte en français (version de référence, seule à faire foi)
Last updated: November 13, 2026.
1. Who is responsible?
The controller of the data collected by ChatCommerce (chatcommerce.io, the application and the free audit) is: AGENTIK, a simplified joint-stock company with a sole shareholder, with a share capital of €1,000, RCS Paris 988 418 802, 60 rue François Ier, 75008 Paris, represented by its president, HODL, itself represented by Jérémy André. Contact for any question about your data: [email protected]. AGENTIK has not appointed a data protection officer.
The service is aimed at professionals (see the Terms of Sale). The data concerned is that of natural persons acting for a business (manager, contact).
2. Data collected, purposes, legal bases, retention periods
| Processing | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Free audit: report | Address of the analyzed store; the result (score, priorities) is sent to the visitor. Visit and conversion counters: only the day (UTC) and the event name, without IP, email or URL | Provide the audit, measure overall usage | Pre-contractual measures taken at the visitor's request (providing the report). The counters contain no personal data. | Counters: no personal data, no time limit |
| Free audit: prospect email | Email address, store address, proof and date of consent (boxes ticked, not pre-ticked) | Send the report and contact again about this audit (first box); send ChatCommerce's offers (second box, optional) | Consent (two separate boxes) | 3 years from the date of consent, then deletion. Withdrawal of consent or unsubscription at any time: immediate deletion. |
| User account | Email address, date of creation and of last login; role in the organization | Log in, manage the organization | Performance of the contract | Duration of the account. A user who no longer belongs to any organization is deleted |
| Login | One-time code (stored as a hash, never in clear, valid for 10 minutes, 5 attempts); session (token stored as a hash, 30 days, renewed with use) | Authenticate | Performance of the contract; security | Code: 10 minutes. Session: 30 days, or closing of the account |
| Store and catalog | Store address, product catalog (titles, descriptions, prices, images, GTIN: commercial data), access to the catalog source (encrypted token, never sent back) | Provide the monitoring and the hosted feed | Performance of the contract | Duration of the account; deleted with the organization |
| Monitoring of presence in AI assistants | Purchase queries and products validated by the Merchant; texts of the answers of the assistants; citations; observations (cited or not, engine, date, position); measured cost | Measure and report | Performance of the contract | Texts of the answers: 90 days. Observations: as long as the account exists, deleted with the organization |
| Recommendations, reports, alerts | Ranked actions, evidence, monthly reports, addresses of alert recipients (confirmed by a code) | Provide the service | Performance of the contract | Duration of the account |
| Order, payment and invoicing | Name, position, company name, SIREN, VAT number, billing address, email, content of the order, Stripe payment identifiers, amounts, dates. No card number: it is processed by Stripe | Conclude and perform the contract, invoice, collect payment | Performance of the contract; legal obligation | Accounting and invoicing documents: 10 years |
| Invoicing record after deletion of the account | Stripe identifiers, amounts, dates, no measurement data (archive that survives the deletion of the organization) | Accounting obligation, evidence in case of dispute | Legal obligation | 10 years from the closing of the financial year of the document, then deletion |
| Service follow-up and support | Email exchanges, installation and follow-up notes | Install, help | Performance of the contract; legitimate interest: keeping a record of the exchanges to answer a complaint | Duration of the contract, then 12 months |
| Transactional emails | Email, content (codes, confirmations, alerts, reports) | Send the service's messages | Performance of the contract | According to the sending provider (section 3) |
| Technical logs | IP address (logs of Cloudflare and of the reverse proxy); method, path, status and duration of the request (API log, without IP address); the IP is used by the application only for an in-memory rate limit | Security, diagnosis | Legitimate interest: ensuring the security of the service and diagnosing outages | 6 months |
Free audit. The email address is not needed to see the report. The form has two separate boxes, not pre-ticked: the first to receive the report and be contacted again about this audit, the second, optional, to receive ChatCommerce's offers. Every message sent contains an unsubscribe link.
Free AI audit. The AI assistants queried through DataForSEO only receive questions built from what you sell (the sector) and the domain name of your store, never your email address; the content of the report (answers of the assistants) is deleted after 90 days. To pre-fill the registration, the site keeps for 7 days in your browser's local storage the email address and the store entered (no data sent to AGENTIK this way) and passes them to the application, in the part of the address that follows the # sign and that the browser sends to no server, only if you click "Create my account".
Account deletion. The owner can export and then delete their organization from their account (Terms of Sale 8.5). The deletion erases the measurement, catalog and access data; only the invoicing archive of the line above remains.
3. Recipients and processors
The data is accessible to AGENTIK and, to the extent necessary, to the following providers.
| Provider | Role | Data | Location and safeguards |
|---|---|---|---|
| OVH SAS (Roubaix, France) | Hosting of the service | All the data of the service | France |
| Stripe | Card payment, subscriptions, VAT calculation | Identity and email of the payer, card (processed by Stripe alone), amounts | European Union and United States. Transfers covered by the Data Privacy Framework and by the standard contractual clauses of the European Commission. Stripe also acts on its own behalf for fraud prevention and its legal obligations |
| Brevo (France) | Sending of the service's emails | Address of the recipient, content of the message | European Union |
| DataForSEO OÜ (Estonia) | Querying of AI assistants for the monitoring | Purchase queries, brand and product names of the Merchant. No data of its customers | European Union; technical providers in the United States, covered by standard contractual clauses |
| Cloudflare, Inc. (United States) | Protection and routing of traffic | IP address, technical headers | Global network. Transfers covered by the Data Privacy Framework and by the standard contractual clauses |
| AGENTIK's bank and chartered accountant | Collection of payments, accounting | Invoicing documents | France |
The data may also be communicated to the authorities upon legal request. No data is sold or transferred. You can request a copy of the safeguards covering the transfers at [email protected].
4. Cookies and trackers
The site and the application set the strictly necessary cookies: the session cookie (HttpOnly, Secure, SameSite=Lax) after login. The site keeps in the browser's local storage (outside any cookie, no data sent to AGENTIK) the light or dark choice and, for the duration of the visit, the last audit report. No audience measurement tool or advertising cookie is used; the visit counters contain no personal data. No consent banner is therefore displayed.
5. The AgentCart connector on a merchant's store
This section concerns the data processed when the connector is installed on a customer's store, not browsing on chatcommerce.io.
- The access key (PrestaShop Webservice) provided is limited to the catalog: customers, orders, addresses, carts and guests cannot be read ("unauthorized" response verified on a demo). No payment goes through AgentCart.
- The connector does not store any buyer data. The module installed on the store records, in the store's database, statistics without buyer data (event type, time, link identifier, amount of an attributed order, cart number), purged after 90 days.
- The data likely to be personal is: (i) the search words entered by the buyer, which appear in the merchant's store access log; (ii) the IP address of the caller, visible in the logs of Cloudflare and of AGENTIK's reverse proxy. The connector discards words containing the
@character, but cannot reliably detect a telephone number or a name. - What the buyer writes to the AI assistant is processed by the provider of that assistant under its own terms, outside AGENTIK's control.
- The hosted product feed contains only catalog data (title, description, price, images, availability, GTIN): no buyer data.
- The merchant remains the controller for its customers' data and must publish the notice on AI assistants that is given to it at installation.
- AGENTIK is the controller for the technical logs of its own infrastructure, kept for 6 months. For the buyers' queries processed by the connector, AGENTIK acts as the merchant's processor.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and, where the processing is based on the contract or on your consent, portability (articles 15 to 21 of the GDPR). Where the processing is based on your consent (address left during the free audit, offer messages), you can withdraw it at any time, through the unsubscribe link of each message or by writing to [email protected]; the withdrawal does not affect what was done before. You can object at any time to the use of your data for prospecting purposes. You can also set directives on the fate of your data after your death.
An owner exports and deletes their organization's data from their account. For any other case: [email protected]; we answer within one month.
The email address is necessary to create an account, and the billing information is necessary to conclude the contract: without them, the service cannot be provided. The address left during the free audit is optional: the report is displayed without it. No decision producing legal effects is taken in a fully automated way.
You can lodge a complaint with the CNIL (cnil.fr).
7. Security
AGENTIK does not guarantee absolute security. Measures in place: login codes and session tokens stored as a hash; store access encrypted (AES-256-GCM); session cookie HttpOnly, Secure, SameSite=Lax; a store of another organization is never visible; rate limits on public routes.
8. Changes
The policy may change; the date of the update appears at the top of the page.