ChatShape

GDPR overview

The privacy policy devotes a full section to the GDPR, addressed to EU and EEA residents. It lists the rights of access, rectification, erasure, restriction, objection, withdrawal of consent and complaint to a supervisory authority, and states a legal basis for each purpose: contractual necessity, legitimate interest or consent. Cross-border transfers rely on the European Commission's standard contractual clauses, with Article 46.2(c) cited by name. Requests go to help@mail.chatshape.com. Two things are missing: no Article 27 EU representative is designated, and neither a DPA nor a subprocessor list is published. Note also that compliance is never claimed in so many words, and the document carries no effective date.

Who owns the data?

The terms of service are silent on ownership: across two short sections they cover billing, refunds and email, and never say who owns uploaded content or the chatbot's output. The privacy policy fills part of the gap by naming the vendor the data controller of your personal data, which it defines as including your email address, first and last name, cookies, usage data and the text supplied when creating chatbots. That data may be disclosed to subsidiaries, employees, contractors and service providers, on lawful request by public authorities, or in a merger, acquisition or asset sale. The vendor states it does not sell it. Customer logos may be reused on the ChatShape website.

Reuse rights

Nothing in the terms grants or restricts a licence over what you get out of the tool: there is no reuse clause, no restriction on commercial use of the chatbot's answers, and no assignment of rights in either direction. The silence leaves the customer free in practice but unprotected by any written commitment. What the terms do settle is commercial. The product is sold as a monthly subscription, no refunds are provided, partial or full, and you may cancel at any time, with billing stopping on cancellation. The vendor also reserves the right to change pricing, policies, features and access restrictions at its own discretion. Your email address may be used for account, product and marketing messages, with an unsubscribe option.

Data retention & training

Hosting summary

The privacy policy is explicit on jurisdiction: data is transferred to and processed in the United States, and users outside the US are told so directly. For transfers out of the EU the vendor relies on the European Commission's standard contractual clauses, citing Article 46.2(c) of the GDPR. Beyond that one country nothing is named: no region, no data centre, no hosting provider. No subprocessor list is published; Google Analytics is named for audience measurement, and card payments go through third-party processors described as PCI-DSS compliant, the vendor stating it never stores card details. Security is described only in general terms, with backups kept and access limited to authorised personnel. No SOC 2 or ISO 27001 certification is mentioned and no DPA is published. One caution on the network evidence: the domain resolves to 76.76.21.21, geolocated in the United States on Amazon's AS16509, but that is an anycast edge node fronting the site, not proof of where data is stored.