Chatty

US state privacy notice

What Chatty does with personal information under US state privacy laws, and the contract terms that apply when a merchant installs Chatty.

Last updated: 28 September 2026. Effective: 28 September 2026

Scope

This notice is part of the Chatty Terms of Service. It covers personal information that a US state consumer privacy law applies to. Installing Chatty, or continuing to use it, is agreement to this notice. A separate signed addendum is not required for these terms to apply.

When a merchant installs Chatty on a store, the merchant decides what is collected from shoppers and why. The merchant is the business or controller. Chatty is the service provider or processor, and processes that information only for the purposes in this notice and on the merchant’s instructions.

On chatty.net, and for a merchant’s own staff accounts, Chatty decides how information is handled. That is covered by our privacy policy, not by the shopper terms below.

Chatty is operated by AVADA GROUP COMPANY LIMITED, Business Registration No. 0109524114, 102 Tran Phu, Ha Dong, Hanoi, Vietnam.

Which laws this notice addresses

There is no general US federal privacy law. Comprehensive consumer privacy laws are in force in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Florida’s law applies only to very large businesses. Further state laws take effect from 2027. We apply the strictest requirement in force to every US shopper, rather than a different rule per state. Where one state gives a right the others do not, we honour that right for the residents who have it.

We describe what Chatty does and the contractual commitments below. We do not describe Chatty as compliant with the CCPA, or as compliant in all 50 states.

Specific purposes

The merchant discloses shopper personal information to Chatty only for the following purposes. A general reference to the Terms is not a purpose. Chatty does not process that information for any other purpose.

  • Receive, store, route, display and transmit the shopper’s conversation with the merchant, on the channels the merchant enables.
  • Generate, moderate and retrieve a reply to that conversation.
  • Show order status and product information from the merchant’s store when the shopper asks.
  • Keep a searchable record of conversations and contacts for the merchant’s staff.
  • Authenticate the merchant’s staff and route conversations among them.
  • Produce usage reporting for that merchant. One merchant’s information is not used to provide the service to another merchant.
  • Detect and investigate security incidents, fraud and abuse of the service.
  • Maintain and repair the service. Shopper conversations are not used to train or fine-tune an AI model, ours or a third party’s, and there is no exception to that limit.
  • Comply with law, including passing on a shopper request the merchant instructs us to action.

Restrictions

Chatty does not, with shopper personal information:

  • Sell it, or share it for targeted advertising or for cross-context behavioural advertising.
  • Keep, use or disclose it outside the direct relationship with that merchant.
  • Combine it with information from another source, or from Chatty’s own interaction with the shopper, except where the CCPA and its regulations expressly permit the combination.
  • Use it in a way that contradicts a notice the merchant has given the shopper.

Chatty gives the merchant the same level of privacy protection for this information that the applicable state law requires of the merchant, including reasonable security. Access inside Chatty is limited to people who need it for the purposes above, and those people are bound to confidentiality.

If Chatty determines that it can no longer meet these restrictions, it tells the merchant. The merchant may then require Chatty to stop the unauthorised use and to confirm deletion of the affected information.

Sensitive information, health information and children

The service does not ask for sensitive personal information. If a shopper types it into the chat, Chatty uses it only to deliver that conversation to the merchant. Chatty does not use it to infer characteristics, and does not sell or share it.

Chatty does not act as a HIPAA business associate and does not sign a Business Associate Agreement. A covered entity or business associate must not route protected health information through the widget.

The service is not directed to children. Chatty does not knowingly process personal information from anyone under 16. If Chatty learns that it holds such information, it deletes it. The merchant must not direct the widget at children.

Shopper requests

Depending on the state, a shopper may have the right to know, access, correct, delete, and receive a portable copy of personal information, to opt out of sale, sharing and targeted advertising, to limit the use of sensitive personal information, to question a profiling result, to receive a list of third parties that received the information, and not to be discriminated against for asking.

A shopper who used the widget on a store sends the request to that store. The store is the business. The merchant may instruct Chatty by emailing [email protected]. Chatty follows that instruction. If a shopper writes to Chatty directly, Chatty tells the merchant and either acts on the merchant’s instruction or tells the shopper to contact the store.

Chatty confirms a request it receives within 10 business days and responds within 45 days. Chatty may extend once by a further 45 days where the request is complex, and will say so before the first period ends. An authorised agent may submit a request with written permission from the person.

If Chatty declines a request, the person may appeal by emailing [email protected] with “Appeal” in the subject line. Chatty replies in writing within 45 days, or the shorter period the state requires. A declined appeal includes the contact details for that state’s Attorney General.

Merchant verification

The merchant may take reasonable steps to check that Chatty uses shopper personal information as this notice describes. Those steps may include a review or assessment at least once every 12 months. Chatty provides the information in its possession that the merchant needs for that check, and bears the cost of one such assessment in each 12-month period. Further assessments in the same period are at the merchant’s cost unless they show that Chatty materially failed to meet this notice. Chatty does not currently hold a SOC 2 or ISO 27001 report. Until it does, the assessment above is the check that is available.

Sub-processors

The companies that process shopper personal information for Chatty are listed at chatty.net/sub-processors. That list is part of this notice. Each company is engaged under a written data-processing contract. Chatty remains responsible to the merchant for the processing this notice describes.

Chatty gives at least 30 days’ notice before a new sub-processor processes shopper personal information, and the merchant may object on reasonable data-protection grounds before that processing starts. To receive those notices, email [email protected] with the subject line “Sub-processor notifications”. Chatty does not permit an objected-to sub-processor to process that merchant’s shopper personal information while the objection is unresolved. If it cannot be resolved, the merchant may terminate the affected services and receive a pro-rata refund of prepaid fees.

Where information is processed

Shopper personal information is stored in the United States. Chatty personnel in Vietnam access it remotely to operate and support the service. It is not stored in Vietnam. Content delivery may pass through edge locations, with storage only in the United States.

Vietnam is not a country of concern under the US Department of Justice rule on access to bulk sensitive personal data (28 CFR Part 202). That rule names China including Hong Kong and Macau, Russia, Iran, North Korea, Cuba and Venezuela.

As a Vietnamese company Chatty is also subject to Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. A merchant can request the Data Processing Agreement, which includes the Standard Contractual Clauses, by emailing [email protected].

Government requests

If Chatty receives a legally binding request from a public authority for shopper personal information, it notifies the merchant before disclosing, unless the law prohibits notice, in which case it notifies as soon as that prohibition allows. Chatty challenges a request where there is a reasonable basis to do so, and discloses only the minimum the request compels.

Contact

[email protected]
AVADA GROUP COMPANY LIMITED, 102 Tran Phu, Ha Dong, Hanoi, Vietnam.

Chatty has not appointed a Data Protection Officer. When this notice changes in a way that matters, we update the date at the top.