Chatvertise

Privacy Policy

Last updated: September 22, 2026. The English version of this policy is the binding version.

1. Controller

Codeventure e.U., Mühlbachgasse 7, 4533 Piberbach, Austria — email: office@chatvertise.app. We are the controller for the personal data processed through Chatvertise ("the Service").

2. Data we process

  • Account data: name, email address, login credentials, organization name, chosen language and time zone — to provide login and the Service (Art. 6(1)(b) GDPR). Authentication (including password storage and Google/GitHub sign-in) is handled by our provider Supabase (see section 4).
  • Advertising data: OpenAI Ads API keys (stored AES-256-GCM encrypted), campaign structures, ad creatives and performance metrics retrieved from the OpenAI Advertiser API on your behalf (Art. 6(1)(b) GDPR).
  • Billing data: subscription plan and payment status. Payment details (card numbers etc.) are processed directly by Stripe; we never see them (Art. 6(1)(b) GDPR).
  • Team and invitation data: names and email addresses of team members and of persons you invite to your organization — to provide multi-user access (Art. 6(1)(b) GDPR). Invitation records are deleted after acceptance or expiry (7 days).
  • Notification emails: we send operational emails (e.g. rejected ads, budget warnings, account status, weekly reports) based on our legitimate interest in a functioning service (Art. 6(1)(f) GDPR); you can disable each category in your settings. Product news is sent only with your prior consent (opt-in, Art. 6(1)(a) GDPR) and can be revoked at any time in your settings.
  • Custom-audience data: if you upload customer lists (email addresses, phone numbers, hashed identifiers) for OpenAI custom audiences, we transmit this data on your behalf and on your instruction directly to OpenAI and do not store it beyond the transfer. For this data you remain the controller and we act as your processor (Art. 28 GDPR — see our DPA); you are responsible for a valid legal basis for the persons on your lists.
  • Conversion tracking: pixels you place on your own website transmit data to OpenAI directly, not to us — there we only manage the configuration (pixel IDs, event definitions). If you enable Shopify sales tracking (see the next bullet), conversion events are additionally sent through our servers to OpenAI on your behalf. In both cases you remain the controller for your shop visitors' and customers' data and we act as your processor for the server-side path (Art. 28 GDPR); informing your website visitors and customers and obtaining any required consents is your responsibility.
  • Shopify data: if you connect a Shopify store, you authorize our app via Shopify's OAuth flow; we store the resulting access tokens AES-256-GCM encrypted, plus the product data you choose to import (product title, description, image URL, price, product URL). We use the read-only scopes read_products and read_orders. read_orders is used solely for optional sales/conversion tracking: when you enable it, Shopify notifies our server about each new order and we forward only the order number, order value, currency and the landing URL (which may contain an ad-click identifier) to OpenAI's Conversions API on your behalf. The order notification technically contains further order details (including customer data); we do not read, store or forward those — the payload is processed transiently and reduced to the four fields above. We never store your Shopify customers' names, email addresses, addresses or payment information. When you generate ads from a product, its text is sent to OpenAI to draft ad copy and its image is uploaded to and hosted by OpenAI for the ad creative (see section 4). You are responsible for holding the rights to the product content you import and advertise and for informing your store's customers about the conversion tracking (see the previous bullet).
  • Call requests: if you use the "Book a call" form on our website, we receive your name, email address and — if provided — company, phone number and message by email (delivered via Resend) and use them solely to respond to your request (Art. 6(1)(b) GDPR — pre-contractual inquiry). We do not store these requests in our database; the email is deleted once the inquiry has been handled, unless it leads to a contract.
  • Technical data: server logs (IP address, timestamps) for security and operation (Art. 6(1)(f) GDPR).

3. Cookies, analytics and consent

Strictly necessary cookies: a session cookie for login and preference cookies for your language and interface settings (e.g. the collapsed sidebar). These are required to operate the Service (Art. 6(1)(b) and (f) GDPR) and are always active.

With your consent (Art. 6(1)(a) GDPR) we additionally use the following services on our website:

  • Google Analytics 4 (provided by Google Ireland Limited) to understand how our website is used. It sets cookies and processes usage data such as pages viewed, approximate location (from a shortened IP address), device and browser type, and a pseudonymous identifier. We use Google Consent Mode v2: no analytics cookies are set and Google Analytics is not loaded until you consent.
  • Google Ads conversion tracking (provided by Google Ireland Limited; "marketing" category) to measure the success of our own advertising on Google — for example completed sign-ups. It uses the same Google tag as Google Analytics but is only activated with your marketing consent; it may set advertising cookies (e.g. _gcl_*, approx. 90 days) and process a pseudonymous click identifier.
  • OpenAI Ads conversion pixel ("oaiq", provided by OpenAI; "marketing" category) on our own website to measure the success of our advertising in ChatGPT — for example completed sign-ups and subscriptions. It is only loaded after you consent.

On your first visit a consent banner lets you accept all cookies, allow only necessary cookies, or enable analytics and marketing separately. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer, with effect for the future; on withdrawal the respective tracking cookies set by us are deleted and the tools stop loading. Your choice is stored in a "cv_consent" cookie for up to 180 days. Google Analytics cookies (_ga, _ga_*) can persist for up to 2 years. Google Analytics, Google Ads and the OpenAI conversion pixel may transfer data to the USA; such transfers rely on the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses.

Our free AI readiness check tool queries the Google PageSpeed Insights API (Google LLC, USA) directly from your browser when — and only when — you actively run a check; Google then receives the website address you entered and your IP address. No analysis data is stored by us.

Independently of consent we use Vercel Web Analytics and Vercel Speed Insights, privacy-friendly, cookieless measurement provided by our hosting provider Vercel Inc. They record aggregated page views and web performance metrics (visited route, browser/device type, country derived from a discarded IP address) without cookies, without cross-site tracking and without building visitor profiles (Art. 6(1)(f) GDPR — legitimate interest in the stability and improvement of the Service).

4. Processors and recipients

  • Vercel Inc. — hosting, content delivery, and cookieless web analytics / performance measurement (see section 3)
  • Google Ireland Limited — Google Analytics 4 website usage analytics (analytics consent) and Google Ads conversion tracking (marketing consent); Google LLC (USA) — PageSpeed Insights API when you use our AI readiness check tool; data may be transferred to the USA (see section 3)
  • OpenAI — in addition to the Advertiser API requests below, our own website loads the OpenAI Ads conversion pixel to measure our advertising, only with your consent (see section 3)
  • Supabase — database hosting and authentication (login, Google/GitHub sign-in, auth emails), region: EU (Frankfurt, eu-central-1)
  • Google and GitHub — only if you choose to sign in with them: they authenticate you and share your email address and name
  • Stripe, Inc. — subscription billing and tax calculation
  • Resend, Inc. — transactional email delivery (alerts, weekly reports, team invitations, auth emails, call requests from our website)
  • OpenAI — Advertiser API requests made on your behalf using your API key; AI features (Growth/Pro): campaign context and, for AI campaign generation, imported Shopify product texts are transmitted to generate ad copy and recommendations, and product images are uploaded to and hosted by OpenAI for ad creatives; no end-customer personal data is included
  • Shopify — we read your connected store's product catalog and receive order notifications for optional sales tracking on your behalf via the Admin API (read-only scopes read_products, read_orders) under the OAuth authorization you grant; we are not affiliated with Shopify Inc.

Data processing agreements (DPAs) are in place with all processors. Transfers outside the EU/EEA rely on EU Standard Contractual Clauses.

5. Retention

Account data is kept for the duration of the contract and deleted upon account deletion. Billing records are retained as required by tax law (7 years under § 132 BAO, Austria). Synced performance data is deleted together with the connected ad account.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority — for us the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, dsb.gv.at). Contact: office@chatvertise.app.

7. Changes

We will update this policy when the Service or legal requirements change and indicate the date of the latest revision above.