What CarlyChat collects.

If you have an account

• Account. Your name, email address and, if you set one, a password. The password is stored as a scrypt hash, not as text. If you sign in with a code, we email it to you and keep a hash of it for up to ten minutes. If you sign in with Google or GitHub, we receive your name and email address from them.
• Sign-in. A cookie that keeps you signed in for 30 days. We store a hash of it, not the cookie itself.
• Chatbots. Everything you add: settings, text, questions and answers, the pages we crawl from websites you give us, the text of files you upload, actions, and CRM or webhook addresses.
• Keys. Your account and chatbot API keys and signing secrets, stored encrypted. Tokens for AI apps you connect are stored as hashes.
• Usage. Messages and chatbots counted per month, for plan limits.
• Payments. Stripe handles checkout and billing. We store your Stripe customer and subscription IDs and the subscription status. We never see your card number.

If you chat with a chatbot

A chatbot belongs to the business whose website it is on. CarlyChat stores the conversation for that business.

• Conversations. Every message you send and every answer, your ratings, and whether you asked for a person. They are kept until the business deletes them or its account.
• Page. The website and page you were on, and any details the website passes to the chat, such as a product or account ID.
• Contact details. The email address, name and answers you type into the chat (for example to be contacted, or on a form), or that the website passes if you are signed in there. Bookings you make through the chat are linked to them.
• In your browser. The chat keeps the ID of your conversation in your browser, so it continues when you open another page.

Recordings and analytics

We use PostHog on carlychat.com and inside the chat on websites that use CarlyChat. It records your session: pages viewed, clicks, what you type (including chat messages and email addresses), the page as you see it, and errors. Password fields and API keys are hidden from recordings. PostHog links a session to your account when you are signed in, and to a website's customer when that website verifies who you are. An email address you type in the chat is saved on your session. PostHog stores this data in the United States.

Where data goes

• OpenAI. When a chatbot answers with AI, your message, the recent messages in the conversation, the page you are on, the contact details the chat has, and matching parts of the chatbot's knowledge are sent to OpenAI to write the answer. So are conversations a business asks us to summarize or draft a reply to.
• Stripe. Payments for paid plans.
• PostHog. The recordings and analytics above.
• CarlyEmail. The emails CarlyChat sends go through CarlyEmail, another Carly product: sign-in codes to the address you give, and a notice to a business's team, with the conversation, when a visitor asks for a person.
• Amazon Web Services. CarlyChat and its database run on AWS in the United States. Database backups are kept for 7 days. We use IP addresses to limit how often requests can be made and delete them within about ten minutes after the limit period ends; an address that hits a limit is written to our server logs, which are kept for a year. Backups made before September 16, 2026, when CarlyChat ran on Railway, are deleted by December 15, 2026.
• Services a business connects. A business can send its conversations and contact details to its own CRM or webhook, and send form answers to Carly Assistant to book meetings.

We do not sell this data.

Deleting your data

• Account holders. On your Account page, choose Delete my account forever. This deletes your account, your chatbots and their conversations, and signs out connected AI apps. If you have a paid plan, cancel it first. We keep your account ID and Stripe customer ID so later payment events can be matched and refunded. Copies in backups are removed as the backups expire.
• Chat visitors. Ask the business whose website you chatted on; it can delete your conversation. You can also ask for a person in the chat on carlychat.com and tell us which website it was.
• Anything else. For a copy of your data, a deletion, or any question about this page, email support@calbotservice.com.