EU Privacy Summary

Last Updated: December 2, 2025

We understand that companies in the European Union have particular concerns about how their data is used and protected. This page summarizes how FlutterChatIO handles data in compliance with the General Data Protection Regulation (GDPR).

Our Commitment: FlutterChatIO is committed to protecting your privacy and giving you control over your data. We process personal data lawfully, fairly, and transparently.

1. Your Rights Under GDPR

As a data subject in the EU, you have the following rights regarding your personal data:

📋

Right to Access

Request a copy of all personal data we hold about you.

✏️

Right to Rectification

Request correction of any inaccurate or incomplete personal data.

🗑️

Right to Erasure

Request deletion of your personal data ("right to be forgotten").

⏸️

Right to Restrict

Request limitation of how we process your personal data.

📦

Right to Portability

Receive your data in a structured, machine-readable format.

🚫

Right to Object

Object to processing of your data for certain purposes.

2. Data Subject Requests (DSR)

You can exercise any of your GDPR rights by submitting a Data Subject Request. Here's how:

How to Submit a Request:

Email us at [email protected] with the subject line "GDPR Data Subject Request" and include:

Your full name and email address associated with your account
The specific right you wish to exercise
Any additional details to help us locate your data

Response Time: We respond to all GDPR requests within 14 days, exceeding the GDPR requirement of 30 days. Complex requests may take up to 30 days, and we will notify you if additional time is needed.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contract Performance: Processing necessary to provide our services to you (e.g., delivering chat messages, managing your account)
Legitimate Interests: Processing for our legitimate business interests (e.g., improving our services, security monitoring) where these don't override your rights
Legal Obligations: Processing required to comply with applicable laws (e.g., tax records, fraud prevention)
Consent: Processing based on your explicit consent (e.g., marketing communications), which you can withdraw at any time

4. International Data Transfers

FlutterChatIO uses service providers located outside the European Economic Area (EEA). When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs): We use EU-approved contractual terms with our service providers
Data Processing Agreements: All sub-processors have signed DPAs that include GDPR-compliant provisions
Security Measures: Technical and organizational measures to protect data during transfer and storage

For a complete list of our sub-processors and their locations, please visit our Sub-processors page.

5. Data Retention

We retain your personal data only for as long as necessary:

Account Data: Retained while your account is active, plus 30 days after deletion
Chat Messages: Retained for the duration of your subscription; deletable upon request
Payment Records: Retained for 7 years (legal requirement)
Usage Logs: Retained for 90 days

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption of data in transit (TLS/HTTPS) and at rest
Secure WebSocket connections (WSS) for real-time messaging
Access controls and authentication mechanisms
Regular security assessments and monitoring
Employee training on data protection

7. Data Protection Officer

For any questions or concerns about how we handle your personal data, or to exercise your GDPR rights, please contact us:

Contact Our Privacy Team

We're here to help with any privacy-related questions or requests.

[email protected]

8. Supervisory Authority

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU data protection authorities can be found on the European Data Protection Board website.