privacy policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter “data”) in connection with our website (smartchat.marketing), our application SmartChat (app.smartchat.marketing) and the related functions and content. The EU General Data Protection Regulation (GDPR) applies. For the terms used (e.g. “processing” or “controller”), the definitions in Art. 4 GDPR apply.

1. Controller

HACO d. Gschnitzer Franz Josef KG, Angerweg 43 - Gasteig, 39040 Ratschings (BZ), South Tyrol, Italy.
Phone: +39 391 1464820. Email: team@smartchat.marketing.
Authorized representative and responsible person: Simon Gschnitzer.

2. Terms used

“Personal data” is any information relating to an identified or identifiable natural person. “Processing” is any operation in connection with personal data (e.g. collecting, storing, using, transmitting, deleting). “Controller” is whoever decides on the purposes and means of the processing. “Processor” is whoever processes data on behalf of the controller.

3. Who is responsible for what (SmartChat as a service)

SmartChat is a tool with which our customers (businesses) run their own WhatsApp marketing. That is why we distinguish two roles:

• We as controller: for the data of visitors to this website and the data of our customers themselves (account, onboarding/business profile, billing, AI chat, connected channels).
• We as processor (Art. 28 GDPR): for the data of the contacts that a customer collects and messages through SmartChat (e.g. recipients of their WhatsApp newsletters). Here the respective customer is the controller; we process this data exclusively on their behalf on the basis of a data processing agreement (DPA).

4. Types of data processed, data subjects and purposes

We process in particular: master data (e.g. company name), contact data (e.g. email address, phone number), content data (e.g. text entries in the AI chat, uploaded documents, images, message content), usage and metadata (e.g. pages visited, access times, device/browser information, IP address) and, for paid use, contract and payment data.

Data subjects are visitors to the website, registered users (our customers and their team members) and the contacts collected by customers (end contacts). Purposes are: providing the website and the service, performing the contract and communication, security and abuse prevention and, only with consent, reach measurement and marketing.

5. Applicable legal bases

We process data on the basis of your consent (Art. 6(1)(a), Art. 7 GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), for compliance with legal obligations (Art. 6(1)(c) GDPR) and for the protection of legitimate interests in a secure, functional and economical offering (Art. 6(1)(f) GDPR). For the processing of end contact data on behalf of customers, Art. 28 GDPR also applies.

6. Security measures

We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. These include in particular: strict tenant separation at database level (Row Level Security, each customer environment is logically separated), encrypted storage of sensitive credentials such as WhatsApp and integration tokens (AES-256-GCM; these are never output to the browser frontend), encrypted data transmission (TLS/HTTPS), signature verification of incoming webhooks and access restrictions. Write access to the database takes place exclusively server-side.

7. Cooperation with processors and third parties

Where we disclose data to other companies or grant them access, this happens only on the basis of a legal permission (e.g. transmission to a payment service provider to perform the contract), your consent, a legal obligation or our legitimate interests (e.g. hosting, message delivery). With service providers who process on our behalf, we conclude data processing agreements under Art. 28 GDPR. The services used are named below.

8. Hosting and infrastructure

The application (app.smartchat.marketing) runs on a server in Germany. The marketing website (smartchat.marketing) is hosted and delivered via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (content delivery network). We operate the database, login and file storage ourselves on our own server. When the site is accessed, these providers process technically necessary access data (e.g. IP address, time, requested resource, browser type). The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR. For transfers to third countries see section 18.

9. Access data and log files

When the website and application are accessed, server access data is generated (e.g. requested resource, time, browser type, IP address). We process it on the basis of our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We also use IP addresses only briefly to limit abusive requests (rate limiting) and do not store them permanently in our database for this purpose. Access/log data is kept only as long as necessary for security and operation and then deleted, unless a statutory retention obligation applies.

10. Fonts

We load the fonts of this marketing website (smartchat.marketing) from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your browser connects to Google servers, and Google receives your IP address. Note: Landing pages created by customers via SmartChat (landing pages) may - depending on the selected brand font - load a font from an external provider; the respective customer is responsible for these pages operated by the customer.

11. Registration and user account

To use the service you create an account. For this we process your email address and a password (login runs through our own server; the password is stored only encrypted/hashed). We do not require further mandatory details at registration. The legal basis is Art. 6(1)(b) GDPR. If you invite team members, we process their email address to deliver the invitation. At registration and login we store the time and technical metadata for protection against abuse (Art. 6(1)(f) GDPR).

12. Onboarding and business profile

To make the service usable, we process the information you provide about your business: e.g. company name, website address(es), answers from onboarding, industry, address, logo/brand colors and, optionally, documents and media you upload (which may contain personal content). From this information SmartChat creates a business profile that the AI assistant uses to create and run your marketing. Media publicly embedded in your landing pages (e.g. logos, images) are stored in publicly accessible storage; please do not upload confidential documents there.

13. AI assistant and AI-supported processing

SmartChat includes an AI assistant that creates content (e.g. landing pages, newsletters, follow-ups) and, if you have activated it, answers incoming messages. For AI processing we use Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA (model of the Claude series). The content required for the respective task is transmitted to Anthropic (e.g. your business profile, chat inputs and, with auto-reply activated, the text of the message to be answered). The transmission is based on a data processing agreement; for transfers to the USA as a third country see section 18. Replies generated automatically by the AI to end contacts are labeled as such.

14. Processing on behalf of our customers (end contacts)

If a customer collects contacts via SmartChat (e.g. via a landing page, a website widget, manual entry or import) and messages them, we process their data exclusively on their behalf (Art. 28 GDPR). This includes in particular name, email address, phone number, language, consent status and the content of conversations and messages (incoming/outgoing). For this data the respective customer is the controller and is themselves responsible for the lawfulness of the consents. A merely incoming message from a contact never automatically creates marketing consent. The details of this processing on behalf - instructions, sub-processors, deletion and audit rights - are governed by our data processing agreement (DPA).

15. Double opt-in and logging

Marketing messages may only be sent to contacts who have previously expressly consented (double opt-in). After sign-up the contact receives a confirmation request; only after confirmation is the contact recorded as having consented. As proof we log the timing and the channel of the consent or confirmation as well as technical details such as IP address and browser. Unsubscribing is possible at any time (via WhatsApp by the message “STOP”). Unsubscribed contacts are blocked for sending.

16. Sending messages via WhatsApp

To send and receive WhatsApp messages we use the WhatsApp Business Cloud API from Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (where applicable with the involvement of Meta Platforms, Inc., USA). Phone numbers of end contacts, message content and delivery metadata are processed. The terms of Meta/WhatsApp also apply. The legal basis is Art. 6(1)(b) or (f) GDPR in conjunction with Art. 28 GDPR; for transfers to third countries see section 18.

17. Sending email

We send system and transactional emails (e.g. opt-in confirmation, account and notice emails) via Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France (server location EU). Email addresses, names and email content are processed. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR.

18. Transfers to third countries

Some of the services used process data outside the EU/EEA, in particular in the USA (Cloudflare, Anthropic, Amazon Web Services, Google and Meta). These transfers take place only where suitable safeguards exist: for the USA on the basis of the EU-U.S. Data Privacy Framework (where the recipient is certified) and/or the EU Commission's standard contractual clauses under Art. 46 GDPR.

19. Payment processing

For paid use, payment processing and invoicing run through our payment service provider Polar. Polar processes the payment and invoice data (e.g. name, email address, billing address, payment method) under its own responsibility; Polar's privacy notices also apply. We ourselves essentially store only a customer ID and the subscription status, no complete payment data. The legal basis is Art. 6(1)(b) GDPR.

20. Cookies and consent

Cookies are small files stored on your device. We use technically necessary means (e.g. to store your cookie choice or your login status) without separate consent on the basis of our legitimate interest. We use cookies and technologies for marketing and reach measurement only if you actively agree in the cookie banner. Your consent is voluntary and can be withdrawn at any time with effect for the future. Change cookie settings

21. Reach measurement and marketing tracking (website only)

If you agree in the cookie banner, we use the Meta Pixel and the associated Conversions API. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. With it we measure the effectiveness of our advertising (e.g. page view, click on “Start for free”). Usage data (e.g. page views, IP address, browser information and cookie identifiers such as _fbp and _fbc) may be transmitted to Meta, including to servers in the USA.

Also only with your consent we use the Google Tag (gtag.js) , through which, depending on configuration, Google Analytics and/or Google Ads conversion measurement run. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Here too, usage data (e.g. page views, IP address, device/browser information, cookie identifiers) may be transmitted to Google, including to the USA.

The legal basis is your consent (Art. 6(1)(a) GDPR). Without your consent, neither Meta nor Google scripts are loaded and no data is sent to Meta or Google. This tracking takes place only on the website, not within the application. You can also declare a general objection to usage-based advertising via youronlinechoices.com.

22. Contacting us

If you contact us by email or phone, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). Our contact form on the website is purely client-side: it opens your own email program with a pre-filled message; no data is transmitted to any server of ours. We keep requests only as long as necessary to handle them.

23. Deletion of data

We only store personal data for as long as it is necessary for the respective purposes or as long as statutory retention obligations (e.g. under commercial and tax law) require; after that, the data is deleted or its processing is restricted. You can delete contacts in the application at any time; related aggregated statistics are anonymized in the process. After the contract ends, you can export your data within 30 days; after that, it is deleted on request or as part of our routine, unless retention obligations prevent this. You can send a deletion request to team@smartchat.marketing at any time; we confirm the deletion within 30 days.

24. Rights of data subjects

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Registered users can also export their data as a file directly in the application. To exercise these rights, a message to team@smartchat.marketing is enough.

25. Right of withdrawal and right to object

You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You can object at any time to the processing of data concerning you, in accordance with the legal requirements (Art. 21 GDPR), in particular to processing for direct marketing purposes.

26. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in Italy with the Garante per la protezione dei dati personali, or with the supervisory authority of your place of residence or work.

27. Updates and changes

We update this privacy policy whenever changes to our data processing make it necessary. If you have questions about data protection, you can reach us at team@smartchat.marketing.

Last updated: July 13, 2026