Privacy notice

Updated 27 October 2026

Who we are. Afterchat is run by Nord Ecom Oy (business ID 3319424-3), Finland. For anything about your data, email hello@afterchat.chat.

Two roles. For people who use afterchat.chat (who sign up, or work in Afterchat as part of a team), we decide what is kept and why: we are the controller, and this notice is what applies. For people who chat with a company through an Afterchat chat, that company decides; we handle the data on its behalf as its processor, and its own privacy notice applies. Requests about those chats are best sent to the company. If you send them to us, we pass them on.

What we keep about you, and why.

• Your account: your email address, your name if you give it, the workspaces you belong to and what you do in them. To run the service you signed up for (contract, GDPR article 6(1)(b)).
• Emails: sign-in links and the notifications you turn on. Same reason.
• Security and operations records: IP address, browser, times, and errors, kept up to 90 days. To keep the service secure and working (our legitimate interest, article 6(1)(f)).
• If you joined the waitlist: your email and, if you told us, what you sell. With your consent (article 6(1)(a)), which you can take back any time.

We don't show ads, don't use tracking or analytics cookies, and never sell or share your data for marketing. The only cookies keep you signed in.

Chats on a company's site. The chat keeps the messages, a name and email address if the customer gives them, and the page the chat started on. It uses the browser's IP address to limit abuse, without storing it. It keeps the conversation in the visitor's browser (local storage) so the chat survives a reload. The company uses it to answer, to hand over to its team, to build its knowledge vault and to count what customers ask for, and decides how long chats are kept.

AI. To write answers, summaries and suggestions, messages are sent to an AI model through OpenRouter, which passes them to the model's provider (Anthropic). Neither may use them to train models. The searchable versions of entries and messages are made inside Cloudflare.

Who helps us.

• Supabase: database and sign-in, in the EU (Ireland).
• Cloudflare: hosting, email and search, on its global network.
• OpenRouter and Anthropic: AI models, in the United States.

Where data leaves the EU, it is covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, whichever applies to that provider.

How long. Your account until you close it, then deleted within 30 days. The record of each AI call (what was sent and what came back) for 30 days. Security and operations records up to 90 days. Waitlist entries until you get access or ask us to delete them.

Your rights. You can ask to see, correct or delete your data, to restrict or object to how we use it, and to get a copy to take elsewhere. Email hello@afterchat.chat and we'll answer within a month. You can also complain to a data protection authority; in Finland that is the Data Protection Ombudsman (tietosuoja.fi).

Changes. When this notice changes we update the date above, and for a change that matters we email everyone with an account first.