Privacy Policy

1. Who we are

Chepa is an AI-powered customer email automation service. When you use Chepa, you trust us with data about you and your customers. This policy explains what we collect, how we use it, and what rights you have.

2. Data we collect

Account data: your name and email address when you register.

Email content: when you connect an inbox, we read incoming customer emails to generate replies. We store the subject, body, sender address, and thread history in our database to display them in your dashboard and to generate AI responses.

OAuth tokens: when you connect Gmail or Shopify, we store the access and refresh tokens required to interact with those services on your behalf. These tokens are encrypted at rest using AES-256-GCM.

IMAP / SMTP credentials: if you connect a custom mailbox, your password is encrypted with AES-256-GCM before storage — we never store it in plaintext.

Shopify data: if you connect a Shopify store, we access order information (order status, tracking, customer name) solely to include it in automated email replies.

Billing data: payments are processed by Stripe. We store your Stripe customer ID but not your card details — those stay with Stripe.

Usage data: we track how many emails your bot has processed to enforce plan limits.

3. How we use your data

• To provide the service — reading emails, generating AI replies, and sending them on your behalf.
• To enforce plan limits and manage your subscription.
• To display your conversation history in the dashboard.
• To authenticate you and keep your account secure.

We do not sell your data. We do not use your email content to train AI models.

4. Third-party services

Chepa relies on the following third parties to operate:

• Anthropic (Claude): email content is sent to Anthropic's API to generate replies. Anthropic's privacy policy governs that usage.
• Google: Gmail OAuth tokens are managed through Google's API. Google's privacy policy applies to Gmail access.
• Shopify: store and order data is accessed through Shopify's API.
• Stripe: handles all payment processing. Card data never touches our servers.
• Vercel: our hosting provider. Your data may be processed on Vercel infrastructure.

5. Data retention

We retain your email threads and account data for as long as your account is active. If you delete a connection, the associated threads are removed. If you close your account, all your data is deleted within 30 days.

6. Security

All credentials (OAuth tokens, IMAP passwords) are encrypted at rest with AES-256-GCM. Data in transit is protected by TLS. Access to the database is restricted to the application.

7. Your rights

You can request access to, correction of, or deletion of your personal data at any time by contacting us. You can also revoke Gmail and Shopify access directly from your Google or Shopify account settings.

8. Contact

For any privacy-related questions or requests, contact us at servicechepa@gmail.com.