Last updated: 16 July 2026
This Privacy Policy explains how Chatonio ("Chatonio", "we", "us") handles personal information in connection with the Chatonio operator app for iOS (the "App"). The App is a professional tool that lets customer-support operators sign in to their Chatonio account and handle customer conversations. It is intended for business users, and is not directed to the general public or to children.
Who this policy covers
The App is used by operators — the staff of businesses that use Chatonio. This policy describes the information we process about you as an operator when you use the App. The messages and customer data you handle inside the App belong to the business that employs you (our customer), which is the controller of that data; Chatonio processes it on that business's behalf under our customer agreement.
Information we collect
Account information — your name, email address, and password (stored only as a secure hash), plus optional profile details such as a display name and avatar.
Authentication data — access and refresh tokens and, if you enable it, two-factor authentication settings. On your device these tokens are held in the iOS Keychain.
Push notification token — when you enable notifications, Apple issues a device token that we store so we can alert you about new or escalated conversations through the Apple Push Notification service.
Usage and content you access — the conversations, messages, tickets, and contacts you view or act on, and the actions you take (replying, assigning, tagging, adding notes, changing status).
Technical and log data — IP address, device and operating-system type, app version, timestamps, and diagnostic or error logs generated when you use the service.
How we use your information
Provide, operate, and maintain the App and your Chatonio account.
Authenticate you and keep your session secure.
Deliver the push notifications you have enabled.
Route and display the conversations assigned to you.
Protect the service against fraud, abuse, and security threats.
Provide customer support and respond to your requests.
Comply with our legal obligations.
How your information is shared
We do not sell your personal information, and we do not use it for advertising or cross-app tracking. We share information only with service providers that help us run the service, including:
Apple — to deliver push notifications through the Apple Push Notification service.
Cloud hosting and infrastructure providers — to store and process data securely on our behalf.
Email delivery providers — to send account and service-related emails.
We may also disclose information where required by law or to protect our rights, our users, or the public.
Data retention
We keep account and usage information for as long as your account is active and as needed to provide the service. Push notification tokens are removed automatically when they become invalid or when you disable notifications or sign out. We retain certain information for longer where necessary to meet legal, security, and accounting obligations.
Security
We protect your information with encryption in transit (HTTPS/TLS) and at rest, secure credential storage in the iOS Keychain, hashed passwords, and optional two-factor authentication. No method of transmission or storage is completely secure, but we use industry-standard measures to protect your data.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise these rights, contact us at the address below. Because much of the content in the App belongs to the business that employs you, some requests may need to be directed to that business.
International transfers
We may process and store information in countries other than your own. Where we transfer personal data across borders, we take steps to ensure it remains protected in line with applicable law.
Children's privacy
The App is a business tool intended for adults and is not directed to children under 16. We do not knowingly collect personal information from children.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice.
Contact us
If you have questions about this Privacy Policy or how we handle your information, contact us at mail@chatonio.com
Website visitors and the marketing site
When you visit chatonio.com or our Help Center we process limited technical data needed to deliver and secure the site (for example, your IP address for security and rate-limiting via our edge/CDN provider). We do not run third-party analytics or advertising trackers on our website. Storage placed in your browser is described in our Cookie Policy.
Help-center portal clients
If you contact a business through a Chatonio-powered help center, we process your email address, the messages and files you send, and related metadata in order to deliver support on that business's behalf. In this case the business you contacted is the controller of your data, and Chatonio acts as its processor.
The embedded chat widget and Live Visitors
Our customers can embed the Chatonio chat widget on their own websites. On our own website we use the same widget. When the widget loads it stores a random visitor identifier in the browser and, where the "Live Visitors" feature is enabled, we may process: IP address, approximate location (country, and where configured city and network/ISP), browser and operating system, the page URL and browsing path during the visit, referrer and campaign (UTM) parameters, and whether the visitor is new or returning. This lets support agents see who is active and offer timely help.
Where this data is processed for one of our customers' websites, that customer is the controller and Chatonio is the processor; the customer is responsible for the notice and consent shown to their visitors. Where it is processed on Chatonio's own website, Chatonio is the controller.
Service providers and subprocessors
We share data with the providers needed to run the Service — for example, cloud hosting and object storage, email delivery, payment processing, edge/CDN and security, and AI model providers — each only to the extent needed to provide the Service and under appropriate contractual protections.
International transfers and retention
Your data may be processed in countries other than your own. We keep personal data only as long as needed for the purposes described here or as required by law, after which it is deleted or anonymised.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below. Where a business used Chatonio to serve you, we will refer your request to that business as the controller.
Contact
For privacy questions or to exercise your rights, email privacy@chatonio.com or reach us through our Help Center.