Privacy Policy

Last updated: 28 October 2026

1. Who We Are

TidyChat (the "Service") is operated by Aida Technologies S.R.L. ("TidyChat", "we", "us", or "our"), a company registered in Romania, with its registered office at Bulevardul Pipera nr. 198/4, Parter, Bl. L1/B2, Scara 1, Ap. 1, Voluntari, Ilfov County, Romania.

Contact: [email protected]

This Privacy Policy explains how we collect, process, store, protect, and delete personal data when you visit our website, create an account, or use the Service.

For personal data relating to account administration, billing, security, and our own business operations, Aida Technologies S.R.L. generally acts as the data controller.

For personal data uploaded, received, or processed by business customers within their workspaces, including contacts, conversations, and lead records, the business customer generally acts as the data controller, and TidyChat acts as a data processor under our Data Processing Agreement (DPA).

2. Personal Data We Collect

Depending on how you interact with the Service, we may process the following categories of personal data:

Account and Identity Data

Names, email addresses, authentication credentials, account identifiers, workspace memberships, and account settings.

Workspace and Customer Data

Contacts, phone numbers, conversations, messages, lead records, custom fields, uploaded files, media attachments, and other information stored or processed within a customer's workspace.

This data is processed on behalf of the workspace owner in accordance with the DPA.

Billing and Transaction Data

Billing details, payment references, invoices, account balances, usage charges, and transaction histories. Payment card information is handled by our payment processing providers.

Technical and Usage Data

IP addresses, device and browser information, authentication events, security logs, application activity, and technical information necessary to operate, monitor, and protect the Service.

AI Processing Data

Messages, conversation context, customer-provided instructions, and other information necessary for AI-powered features, including automated responses, lead qualification, and conversation analysis.

Communications and Support Data

Information provided when contacting our support team, requesting assistance, or communicating with us about the Service.

3. Purposes and Legal Bases for Processing

Where the GDPR applies, we process personal data for the following purposes and on the following legal bases:

Our legitimate interests include maintaining a secure and reliable platform, preventing misuse, protecting our users, and managing our business operations.

When we process workspace customer data as a processor, the business customer is responsible for identifying and establishing the applicable legal basis for that processing.

Providing the account and billing information necessary to create and operate a paid account is generally a contractual requirement. If required information is not provided, we may be unable to create an account, process payments, or provide the relevant Service features.

Optional information is not required unless specifically indicated.

4. Workspace Data and Customer Responsibilities

Business customers control the personal data they collect, upload, and process through their TidyChat workspaces.

They are responsible for ensuring that their collection and use of personal data, including automated messaging and AI-assisted communications, complies with applicable privacy, electronic communications, and marketing laws.

TidyChat processes this information to provide the Service and in accordance with the customer's documented instructions and our DPA.

Individuals whose personal data is processed through a business customer's workspace should generally contact that business directly regarding their privacy rights.

We assist business customers with applicable data protection obligations as described in our DPA.

5. Sharing Data and Sub-processors

We share personal data only where necessary for legitimate business operations, service delivery, legal compliance, or other purposes permitted by applicable law.

Categories of recipients may include:

• Cloud hosting and infrastructure providers.
• Messaging platforms and communication gateways.
• AI model and processing providers.
• Payment processing and billing providers.
• Security, monitoring, and technical support providers.
• Professional advisers, regulators, or authorities where legally required.

Our current sub-processors and their relevant processing activities are identified on our Sub-processor page.

We require processors acting on our behalf to comply with appropriate contractual data protection and security obligations.

We do not sell personal data.

6. International Data Transfers

TidyChat operates from Romania and may use service providers that process personal data outside the European Economic Area (EEA).

Where personal data is transferred to countries outside the EEA, we rely on an applicable lawful transfer mechanism, such as:

• An adequacy decision issued by the European Commission.
• European Commission Standard Contractual Clauses (SCCs), together with supplementary safeguards where necessary.
• Another lawful transfer mechanism permitted under applicable data protection law.

Information about relevant service providers is available on our Sub-processor page.

You may contact [email protected] for further information about applicable international transfer safeguards and how to obtain a copy of relevant safeguards, subject to lawful confidentiality restrictions.

7. Data Retention and Deletion

We retain personal data only for as long as necessary to provide the Service, fulfil contractual and legal obligations, maintain security, and protect legitimate interests.

Our standard workspace deletion process includes a 30-day retention and recovery period following a confirmed workspace deletion request.

7.1 Active Workspaces

Customer data, including conversations, contacts, leads, messages, and associated media, remains available while the workspace is active, unless deleted earlier by the customer or otherwise required by law.

Cancellation of a paid service, expiration of a prepaid balance, or disconnection of a messaging channel does not automatically constitute a request to delete the workspace or its stored data.

7.2 Workspace Deletion

When a workspace owner or an authorized TidyChat administrator initiates workspace deletion:

• The workspace is suspended and access is restricted.
• A 30-day recovery period begins.
• During this period, an authorized owner may request cancellation of the deletion.
• If deletion is not cancelled, the workspace and its associated operational data are permanently deleted from active production systems at the end of the 30-day period, subject to the exceptions described below.

This includes associated conversations, messages, leads, contacts, configuration data, and uploaded media.

7.3 Account Deletion

Deletion of an individual user account is handled separately from workspace deletion.

Where an account deletion also requires deletion of a workspace owned by that user, the applicable workspace deletion process will be initiated.

Deletion of an individual account does not automatically require deletion of a workspace owned or administered by other users.

7.4 Technical Logs and Temporary Data

Routine technical logs, AI processing logs, temporary processing records, and other operational data are retained for no longer than 30 days, unless a longer period is necessary for a documented security investigation, legal obligation, or legal claim.

Temporary data export files are automatically deleted within 7 days of creation.

Security incidents and relevant audit records may be retained for longer where necessary and legally justified. Such retention is limited to the information necessary for the relevant purpose and is subject to periodic review.

7.5 Backups

Backup copies are maintained for service continuity, disaster recovery, and security purposes.

Following deletion from active production systems, any remaining personal data in backups is removed through the regular backup rotation process, within a maximum of 30 additional days.

Backup data is not used for routine business operations. If a backup is restored, applicable deletion requests must be reapplied.

7.6 Legal and Financial Records

Certain records may be retained after account or workspace deletion where required by applicable law or necessary for the establishment, exercise, or defence of legal claims.

These may include:

• Invoices and statutory accounting records.
• Payment and refund transaction evidence.
• Records necessary to demonstrate contractual acceptance or legal compliance.
• Information relevant to unresolved disputes, fraud investigations, or legal proceedings.

Under applicable Romanian accounting legislation, relevant accounting records are generally retained for five years, calculated from 1 July of the year following the financial year in which they were created, unless another statutory period applies.

Such retained records are restricted to their applicable legal purpose and are deleted or anonymised when the relevant retention obligation or lawful justification expires.

7.7 Deletion Requests

You may submit a privacy or deletion request to [email protected].

Where TidyChat acts as a processor, requests concerning workspace customer data may need to be handled by the relevant business customer acting as controller.

We may retain specific information where deletion is restricted or prohibited by applicable law.

8. Your Privacy Rights

Subject to applicable law, including the GDPR and the Israeli Protection of Privacy Law where applicable, you may have the following rights:

• Access: Request confirmation of whether we process your personal data and obtain a copy of relevant data.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of personal data in circumstances provided by law.
• Restriction: Request restriction of processing where applicable.
• Portability: Request certain personal data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests, including direct marketing where applicable.
• Withdrawal of consent: Withdraw consent at any time where consent is the legal basis, without affecting processing carried out before withdrawal.
• Automated decision-making rights: Exercise applicable rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, contact [email protected].

We may need to verify your identity before processing a request.

We respond within the timeframes required by applicable law.

Where we process personal data on behalf of a business customer, we may direct the request to that customer and provide reasonable assistance in accordance with our DPA.

Supervisory Authority

If you believe that your personal data has been processed in violation of applicable data protection law, you may lodge a complaint with a competent supervisory authority.

In Romania, the competent data protection authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

• Website: https://www.dataprotection.ro
• Email: [email protected]
• Address: B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania.

Where applicable, you may also lodge a complaint with the competent supervisory authority in another EU or EEA country, including where you habitually reside, work, or where the alleged infringement occurred.

9. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorized access, unlawful processing, accidental loss, alteration, and disclosure.

These measures include, as appropriate:

• Encryption in transit using TLS/HTTPS.
• Workspace-level data isolation and access controls.
• Authentication and authorization controls.
• Security monitoring and audit logging.
• Restricted access to production systems and personal data.
• Backup and recovery procedures.
• Security incident detection and response measures.

No electronic system can guarantee absolute security. We regularly assess and improve our safeguards according to the nature of the Service and associated risks.

10. Artificial Intelligence Processing

TidyChat uses third-party AI model providers to support automated conversations, response generation, lead qualification, and related features.

When these features are used, relevant message content, conversation context, and applicable instructions may be transmitted to the AI provider for processing.

AI processing is carried out to deliver the requested functionality and in accordance with applicable agreements and provider data-processing terms.

For supported API services, customer content is not used by the provider to train its general-purpose AI models where this is excluded under the applicable provider terms and configuration.

Provider-specific retention and security practices are governed by the applicable processing arrangements.

We may change or add AI providers over time. Current providers are identified on our Sub-processor page.

AI-generated responses and lead assessments may be inaccurate and should be reviewed where appropriate.

TidyChat provides human handoff functionality that allows authorized workspace members to take over conversations.

Business customers remain responsible for their use of AI-generated outputs and for determining whether any additional notices, safeguards, or human review are required for their processing activities.

11. Automated Processing and Lead Qualification

The Service may automatically classify conversations, evaluate lead characteristics, assign lead scores, or recommend follow-up actions based on the information processed within a workspace.

These functions are designed to assist business users in managing communications and prioritizing potential customers.

Business customers determine how these features are configured and how their results are used.

Where automated processing is used to make decisions that have legal or similarly significant effects on individuals, the relevant data controller is responsible for complying with applicable legal requirements, including those relating to automated decision-making and profiling.

12. Data Protection Officer and Privacy Contact

For privacy-related inquiries, requests, or concerns, please contact:

• Aida Technologies S.R.L.
• Bulevardul Pipera nr. 198/4, Parter, Bl. L1/B2, Scara 1, Ap. 1, Voluntari, Ilfov County, Romania
• Email: [email protected]

Where a Data Protection Officer (DPO) is legally required and appointed, the relevant contact details will be published and communicated as required by law.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Service, data processing activities, legal obligations, or security practices.

The latest version will be published on our website with the date of the most recent update.

Where changes materially affect the processing of personal data, we will provide additional notice where required by applicable law.

Continued use of the Service does not replace any consent or other legal basis required for processing personal data.

14. Contact

For questions concerning this Privacy Policy or the processing of personal data, please contact us at [email protected].