GDPR Compliance Statement

1. Commitment to GDPR Principles

AleafChat is fully committed to compliance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679) and the UK Data Protection Act (UK GDPR). We believe that data privacy is a fundamental human right. Whether you are a business owner operating within the European Economic Area (EEA) or managing customers located in Europe, our systems are engineered around privacy-by-design, data minimization, and absolute transparency.

2. Roles Under GDPR: Data Controller vs. Data Processor

Under GDPR Article 28, privacy responsibilities are allocated based on control over data processing:

You (Our Customer) as Data Controller: When you connect your Google Business Profile or Instagram account, you remain the Data Controller of customer reviews, direct messages, and reviewer identities. You determine the lawful basis and tone settings under which replies are crafted.
AleafChat as Data Processor: We act strictly as a Data Processor on your behalf. We ingest reviews and DMs, apply your designated AI reply rules, and push responses back via official APIs. We never sell, rent, or repurpose your customer data.

3. Lawful Bases for Processing (Article 6)

AleafChat processes personal data only where a valid legal basis exists under GDPR Article 6:

Contractual Necessity (Art. 6(1)(b)): To provide our AI automation services, synchronize Google reviews, route Instagram direct messages, and maintain your account balance.
Legitimate Interests (Art. 6(1)(f)): To prevent anti-bot abuses, secure API integrations, detect fraudulent login attempts, and ensure platform uptime.
Legal Obligations (Art. 6(1)(c)): To maintain audit logs, tax/billing records, and evidence of consent where required by applicable laws.
Consent (Art. 6(1)(a)): For optional telemetry, voluntary beta participation, and direct marketing communications, which can be withdrawn at any time.

4. Your Data Subject Rights (Articles 15–22)

Under Chapter III of the GDPR, all data subjects possess clear rights regarding their personal data:

Right of Access & Portability (Art. 15 & 20)

You can request or download a complete, machine-readable JSON archive of all reviews, messages, account logs, and metadata associated with your user ID.

Right to Erasure / “To Be Forgotten” (Art. 17)

You have the right to request full permanent deletion of your account, stored messages, and API tokens. All cryptographic keys are permanently shredded.

Right to Rectification (Art. 16)

You can modify, update, or correct inaccurate account details, business information, and prompt rules directly in your settings at any time.

Right to Restrict & Object (Art. 18 & 21)

You can pause auto-reply rules, disconnect Google or Instagram profiles, or object to automated AI decision-making by switching to 1-Click Human Approval Mode.

5. Automated In-App GDPR Self-Service Tools

AleafChat provides dedicated in-app tools and verified API endpoints to exercise your privacy rights immediately without bureaucratic delays:

Instant GDPR Export: Access /api/gdpr/export or visit Dashboard Settings > Compliance to download your complete data archive.
Cryptographic Erasure: Trigger /api/gdpr/erase to immediately shred OAuth tokens, unlink social accounts, and queue all records for irreversible purge.
Consent Audit Ledger: View and record your consent history with timestamped IP and user-agent records via /api/gdpr/consent.
Record of Processing Activities (ROPA): Audit processing activities dynamically via /api/gdpr/ropa in compliance with GDPR Article 30.

6. Security Measures & Sub-Processors (Articles 28 & 32)

We implement comprehensive organizational and technical security measures to protect personal data against accidental loss, unauthorized access, or disclosure:

Encryption at Rest: AES-256-GCM encryption with unique initialization vectors (IVs) and PBKDF2 key derivation for all stored OAuth access tokens and credentials.
Encryption in Transit: TLS 1.3 enforced for all external API communications and browser sessions with HSTS preloading.
AI Zero-Retention Inference: LLM inference requests processed via DeepSeek API do not use customer data or review content for model training.
Official Platform APIs: Direct verified integration with official Google Business Profile APIs and Meta Instagram Graph APIs under EU Standard Contractual Clauses (SCCs).

7. Data Retention & Automated 90-Day Purge Policy

In accordance with the storage limitation principle (GDPR Article 5(1)(e)), AleafChat maintains data only for as long as necessary:

When an account is disconnected or deleted, all active OAuth tokens are immediately revoked. Associated temporary cache and telemetry logs are retained for a maximum of 90 days to resolve any pending dispute or chargeback requests, after which automated background jobs execute an irreversible hard deletion from all database tables and backups.

8. Contacting Our Data Protection Officer (DPO)

If you have any questions about this GDPR Compliance Statement, wish to execute a Data Processing Agreement (DPA), or have a privacy request:

Direct Live Chat Support

Chat directly with our administrative team for immediate assistance.

Email Privacy Team

privacy@aleafchat.com (48-hour SLA)