1. Who We Are and Scope of This Policy

Basyt, we, us, our, or the Company means Basyt LLC.

This Policy applies to:

The public marketing website, including basyt.chat.
The Basyt Chat platform, dashboard, and application environment.
Domains or subdomains owned, controlled, or used by Basyt to operate the Service, including basyt.chat, basyt.com, and their related subdomains.
Messaging channels, integrations, APIs, Basyt AI features, automation features, and related services.

This Policy does not apply to third-party websites or services that we do not own or control, even if they are linked to or integrated with the Service. Those services are governed by their own privacy policies and terms.

2. Basyt’s Role in Data Processing

Basyt provides a B2B SaaS service for businesses and stores. Our role in processing data may vary depending on the type of data and the context:

For account, contact, billing, website usage, and Service usage data, Basyt may act as the party that determines the purposes and means of processing to the extent necessary to operate the Service and manage the customer relationship.
For End User data, conversation content, and data that the Customer enters, imports, or connects through integrations, Basyt often acts as a service provider or processor on behalf of the Customer and according to the Customer’s instructions, depending on applicable laws.

In many cases, the business Customer is responsible for determining why its End Users’ data is collected and how it is used, and is responsible for providing privacy notices and obtaining required consents or legal bases.

3. Definitions

For purposes of this Policy:

Customer means the company, store, organization, or business entity that creates an account, uses the Service, or subscribes to a plan.

Users means the Customer’s team members, customer service agents, administrators, employees, or collaborators authorized by the Customer to access its account or workspace.

End User means a person or entity that communicates with the Customer through channels connected to the Service, such as WhatsApp, Instagram, Facebook, TikTok, Telegram, email, SMS, website widget, or other channels.

Customer Data means data, content, messages, files, records, or information submitted by the Customer, its Users, or its End Users, or imported or processed through channels and integrations connected to the Service.

Personal Data means any information that identifies or can be reasonably linked to a natural person, directly or indirectly, according to applicable laws.

4. Data We Collect or Process

We may collect or process the following categories of data depending on how you use the Service, which features you enable, and which integrations you connect.

A. Account and Business Identity Data

This may include:

Name.
Email address.
Phone number if provided.
Company or store name.
Country, region, or preferred language.
User role or permissions inside the account.
Workspace information and settings.
Login data and security settings.

B. User and Team Data

This may include:

Team member names.
Email addresses.
User roles and permissions.
User activity inside the platform.
Invitation or workspace membership status.
Notes, tasks, or assignments created by Users inside the Service.

C. End User Data

When a Customer uses Basyt to manage customer conversations, we may process data related to End Users, such as:

Name or display name.
Phone number.
Email address.
Channel or account identifiers.
Profile image or public information from the communication channel.
City or country if available from the channel or integration.
Data sent by the End User within a conversation.
Data added by the Customer or its team to the End User profile.

D. Conversation Content and Files

We may process:

Incoming and outgoing messages.
Saved or automated replies.
Internal team notes.
Tags and labels.
Assignments and conversation statuses.
Files, attachments, images, and documents sent or uploaded.
Conversation history and related events.

E. Channel and Integration Data

When channels or external services are connected, we may process data needed to operate the integration, such as:

Account, page, or channel identifiers.
Connection settings.
Access tokens, refresh tokens, or connection keys where technically required.
Connection status and granted permissions.
Sync events or integration errors.
Data sent by the channel or external service to Basyt based on the Customer’s settings.

We treat access tokens and connection keys as operationally sensitive data and use them only to operate the integrations enabled by the Customer.

F. E-commerce and Order Data

When a store or commerce platform such as Salla, Shopify, or others is connected, we may process, depending on available permissions:

Order data.
Order, payment, or shipping status.
Product data or product links.
Customer data related to an order.
Cart, invoice, or order note information where available.
Commerce context the Customer chooses to display inside a conversation.

The purpose of this processing is to help the Customer and its team understand conversation context and provide better customer service to End Users.

G. Basyt AI and Knowledge Data

If the Customer enables or uses Basyt AI features, we may process:

Knowledge documents uploaded by the Customer.
Questions and instructions added by the Customer.
Portions of conversations needed to generate a response, summary, or knowledge retrieval result.
AI agent settings, rules, or context.
AI outputs and related usage logs.

The Customer should not upload or process sensitive or unauthorized data through AI features unless it has an appropriate legal basis and clear authority to do so.

H. Billing and Subscription Data

We may process:

Subscription plan.
Subscription status.
Invoices.
Payment history or failed payment status.
Company details for billing purposes.
Limited information from payment providers, such as card last digits, payment identifier, or transaction status, where sent by the payment provider.

Basyt does not intend to store full payment card details on its systems. Sensitive payment data is typically processed by third-party payment providers according to their own terms and policies.

I. Usage Data and Technical Logs

We may collect or process:

IP address.
Browser type, device, and operating system.
Login and logout times.
Pages or features used.
Usage events inside the Service.
Error and performance logs.
Security and abuse detection information.
Session or technical event identifiers.

J. Support and Communication Data

When you contact us, we may process:

Your name and email address.
The content of your message or request.
Support conversation history.
Attachments or screenshots you send.
Account information related to helping us resolve the issue.

K. Cookies and Similar Technologies

We may use cookies and similar technologies to operate the website and platform, manage sessions, remember preferences, improve performance, understand usage, support security, or measure campaigns when appropriate tools are enabled. Our Cookie Policy provides more details.

5. Sources of Data

We may receive data from:

The Customer directly when creating an account or using the platform.
Users inside the Customer’s workspace.
End Users when they send messages or interact with the Customer’s channels.
Channels and integrations connected by the Customer to the Service.
Payment, infrastructure, or support providers where necessary.
Technical logs generated by use of the website or platform.

End Users are usually not required to create a direct account with Basyt for their data to be processed as part of a Customer’s conversations. In these cases, End User data comes from the Customer or from channels connected by the Customer to the Service.

6. How We Use Data

We use data for the following purposes:

Creating accounts and operating the Service.
Enabling Users to manage conversations and End Users.
Connecting channels and integrations selected by the Customer.
Displaying customer, order, and product context inside conversations.
Providing Basyt AI and automation features when enabled.
Sending operational, security, or account-related notifications.
Providing technical support and customer service.
Managing subscriptions, billing, and payments.
Improving Service performance, reliability, and user experience.
Monitoring security and preventing fraud or abuse.
Analyzing usage in an aggregated or limited way to improve the product.
Complying with legal and regulatory obligations.
Enforcing the Terms of Service and related policies.
Protecting the rights of Basyt, its Customers, Users, and partners.

We do not use End User data to send direct marketing to End Users on behalf of Basyt unless there is an independent and appropriate legal basis. Communications with End Users through the platform are usually sent by or on behalf of the business Customer.

7. Legal Bases for Processing

Depending on applicable law and context, we may rely on one or more of the following legal bases:

Performance of a contract: to provide the Service and manage accounts, plans, and billing.
Legitimate interests: to improve the Service, prevent fraud, protect security, provide support, and understand usage, provided these interests are not overridden by individual rights where applicable.
Legal compliance: to keep certain records, respond to lawful requests, or meet regulatory obligations.
Consent: where consent is required by law, such as for certain cookies, messages, or specific processing activities.
Customer instructions: when we process End User data on behalf of the Customer based on the Customer’s settings and instructions.

The Customer is responsible for determining the appropriate legal basis for processing its End Users’ data when the Customer determines the purposes and means of that processing.

8. Customer Responsibilities Toward End Users

When a Customer uses Basyt Chat to manage End User conversations, the Customer is responsible for:

Informing End Users that their data may be processed through customer service tools or service providers used by the Customer.
Providing an appropriate privacy policy to its End Users.
Obtaining required consents for messages, campaigns, or notifications.
Honoring deletion, correction, unsubscribe, opt-out, or do-not-contact requests.
Using channels and integrations according to laws and channel provider policies.
Not uploading or processing sensitive or prohibited data unless it has a clear legal basis and appropriate safeguards.

If Basyt receives a request from an End User regarding data controlled by a Customer, we may direct the request to the Customer or work with the Customer to handle the request under applicable laws.

9. Artificial Intelligence and Basyt AI

Basyt AI features may help improve customer service workflows by suggesting responses, summarizing conversations, searching knowledge documents, assisting with classification or routing, or performing helper tasks.

When these features are used, portions of conversation data, documents, instructions, or account context may be processed to generate the requested outputs.

We may use AI service providers or infrastructure providers to process these requests. We aim to use service providers that apply appropriate controls for business data, and we process this data only as needed to provide the feature.

Basyt does not use Customer Data to train general-purpose models owned by Basyt for public or commercial resale. However, the Customer must not submit data to AI features unless it has the right to use, share, and process that data.

AI outputs may be inaccurate, incomplete, or inappropriate for some situations. Users should review important or sensitive outputs before relying on them.

10. Sharing Data with Service Providers and Third Parties

We do not sell End User data. We may share or process data with trusted service providers as needed to provide, operate, and protect the Service, such as:

Cloud hosting and infrastructure providers.
Database, storage, and backup providers.
Channel, messaging, and integration providers.
Payment and billing providers.
AI and automation providers.
Email and notification providers.
Analytics, monitoring, and security providers.
Support and customer service tools.
Legal advisors, accountants, or competent authorities where legally required or appropriate.

We aim to share only the minimum data necessary and to use service providers with appropriate confidentiality or data protection obligations based on the nature of the Service.

11. Channels and External Platforms

When a Customer connects an external channel or platform, such as messaging, commerce, team, or automation platforms, data may be exchanged between Basyt and that platform according to the Customer’s settings and integration permissions.

External platforms are governed by their own policies. Basyt does not control how those platforms process data outside the Service. The Customer should review those platforms’ policies and ensure its use of them is lawful and appropriate.

Disconnecting an integration may stop new data syncing, but it does not necessarily delete data previously processed inside Basyt or inside the external platform.

12. Hosting and Data Location

Basyt relies on cloud hosting and infrastructure providers to store and operate the Service. Customer data may be stored or processed on servers or data centers located in the European Union or other regions depending on the Service architecture, operational requirements, and infrastructure providers.

We aim to use service providers that apply appropriate security measures and controls to protect data. However, processing locations may vary based on technical availability, scaling needs, backups, or supporting service providers.

13. International Data Transfers

Because Basyt LLC is a U.S. company and may rely on global service providers, data may be transferred to or processed in countries different from the country of the Customer, User, or End User.

Where applicable laws require safeguards for international transfers, we aim to use appropriate mechanisms and safeguards such as contractual terms, data processing agreements, or other reasonable protections depending on the context and applicable law.

14. Subprocessors and Data Processing Agreement

Basyt may use service providers or subprocessors to help provide the Service. These categories may include hosting, storage, channels, payments, artificial intelligence, automation, email, analytics, security, and support.

Where required by applicable laws, processing of personal data on behalf of the Customer may be subject to a Data Processing Agreement or Data Processing Addendum. If a Data Processing Agreement is published by Basyt or agreed in writing, it forms a supplemental part of the relationship between Basyt and the Customer to the extent it relates to personal data processing.

Basyt may update service providers or subprocessors from time to time as needed to operate and improve the Service, while continuing to apply appropriate measures to protect data.

15. Data Retention

We retain data for as long as necessary for the purposes described in this Policy, including operating the Service, managing accounts, providing support, complying with legal obligations, preventing fraud and abuse, resolving disputes, and enforcing agreements.

Retention periods vary depending on the type of data and purpose:

Account and subscription data is usually retained while the account exists and afterward as needed for legal or accounting requirements.
Conversation and End User data is retained according to account settings, Customer usage, and available deletion or retention practices.
Security and error logs may be retained for a limited period for monitoring, protection, and investigation.
Invoices and payment records may be retained according to accounting and tax requirements.
Backups may remain for a limited period within backup cycles before being deleted or overwritten.

After account deletion or termination of the Service, we aim to delete or deactivate data that is no longer needed within a reasonable period, taking into account technical, legal, and security limitations.

16. Data Deletion and Export

The Customer may request deletion of its account or certain data, or ask about export options, by contacting [email protected] or through available tools inside the Service.

Where the nature of the Service, technical settings, and plan allow, we may allow the Customer to export certain data from its account. Some data may not be exportable if it is related to security or technical records, third-party accounts, or if export would risk exposing another person’s data.

We will review deletion requests within a reasonable period and aim to process eligible requests according to the Data Deletion Policy and applicable laws. We may need to retain certain information for legal, security, accounting, or abuse-prevention reasons.

17. Privacy Rights

Depending on applicable laws, your location, and Basyt’s role in the processing, you may have certain rights, such as:

Requesting access to your data.
Requesting correction of inaccurate data.
Requesting deletion of certain data.
Requesting restriction of or objecting to processing.
Requesting a portable copy of your data where applicable.
Withdrawing consent where processing is based on consent.
Filing a complaint with a competent data protection authority where legally available.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity or authority before handling the request.

If you are an End User of a business using Basyt Chat, we may direct you to that business because it may be responsible for your data.

18. End User Requests

If you are an End User who communicated with a business using Basyt Chat, that business may be responsible for determining why your data is processed and how it is used. Therefore, it may be most appropriate to submit privacy requests directly to that business.

If you contact us directly about your data as an End User, we will try to help you or direct your request to the appropriate business Customer where possible and legally appropriate.

19. Security and Data Protection

We use reasonable administrative, technical, and organizational measures to help protect data from unauthorized access, loss, misuse, or unlawful alteration. Depending on the context, these measures may include access controls, permission management, security monitoring, encryption in transit, backups, and limiting access to data based on need.

However, no internet-connected service can be guaranteed to be 100% secure. The Customer is also responsible for protecting login credentials, managing User permissions, using strong passwords, and monitoring account usage.

20. Security Incidents

If we become aware of a security incident affecting personal data in a way that requires notice under applicable law, we will take reasonable steps to assess the incident, reduce its impact, and notify Customers or competent authorities where required.

We may rely on available information, the nature of the incident, and our role in the processing to determine the scope, method, and timing of notice.

21. Cookies and Analytics

We may use cookies and similar technologies for operational, security, analytics, and preference purposes, and may use third-party tools to understand website usage, improve performance, or measure campaigns when enabled.

You can usually control cookies through browser settings or any preference tool we provide. Disabling certain necessary cookies may cause parts of the website or Service not to work properly.

Please review our Cookie Policy for more details.

22. Marketing and Operational Communications

We may send Customers or Users operational messages related to the account, security, billing, or the Service. These messages are necessary to manage the Service and may not always be disabled while the account is active.

We may also send marketing messages or product updates if we have an appropriate legal basis or consent where required. You may unsubscribe from marketing messages using the link or instructions in the message, or by contacting us.

Unsubscribing from marketing does not stop important operational or legal messages.

23. Sensitive Data and Prohibited Content

The Service is not specifically designed to process highly sensitive categories of data, such as sensitive health data, highly sensitive financial data, national identification numbers, biometric data, or children’s data, unless the Customer has a clear legal basis, appropriate safeguards, and its use complies with laws and Basyt’s Terms.

The Customer must not enter, upload, or process sensitive or prohibited data through the Service unless it is necessary, legally authorized, and consistent with Basyt policies and the policies of connected service providers.

24. Children’s Privacy

The Service is intended for businesses and is not directed to children or minors. We do not intentionally collect children’s data directly. If you believe that a child’s data has been processed through the Service without an appropriate legal basis, please contact us at [email protected].

We may direct the request to the responsible business Customer if the data was provided through that Customer or within its conversations with End Users.

25. External Links and Websites

The website or Service may contain links to external websites or services. We do not control the privacy practices or content of those websites and services. We recommend reviewing their privacy policies before using them or sharing your data with them.

26. Business Changes

If Basyt is involved in a merger, acquisition, reorganization, sale of assets, financing, or transfer of business, some data may be transferred to the relevant party as part of that process, subject to continued protection under an appropriate privacy policy or data protection arrangement as required by applicable law.

27. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, laws, or how we process data. We will post the updated version on the website with a new “Last updated” date.

If changes are material, we may provide appropriate notice by email, inside the Service, or through a prominent notice on the website where practical or legally required.

Your continued use of the Service after the updated Policy is posted means you have been informed of the changes, without limiting any rights you may have under applicable laws.

28. How to Contact Us

If you have questions about this Policy or how we process data, or if you want to exercise privacy rights, you may contact us at:

Basyt LLC
Wyoming, United States

Privacy Policy