Last updated: 29 October 2026 · Effective: 29 October 2026
English · Français · Nederlands · Deutsch
This Privacy Policy explains how Encore Interactive Inc. (“Encore Interactive”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal information in connection with our ChatOpsPro live-chat and AI assistant service (the “Service”), including our website, embeddable chat widget, operator web console and mobile applications, and any connected messaging channels such as Facebook Messenger, Instagram, WhatsApp, SMS, telephone, and email.
We are committed to protecting your privacy and to handling personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable laws of the Province of New Brunswick and Canada, the EU General Data Protection Regulation (GDPR) where it applies, and applicable United States privacy laws including the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA). This Policy also satisfies the privacy-policy requirements of the Meta Platform Terms and Developer Policies and of the Google API Services User Data Policy.
Encore Interactive Inc. is a company incorporated in Canada with its registered office in Saint John, New Brunswick. We provide the Service to business customers (“Customers”), who embed our chat widget on their websites and connect their messaging channels so that their website visitors and customers (“End Users”) can communicate with them.
Which features are active differs from Customer to Customer: many of the capabilities described below are optional, configurable, or limited to particular subscription plans, and each Customer decides what to enable for its own audience.
This Policy covers the Service as offered in Canada, the United States, and the European Economic Area (EEA), and addresses the requirements of PIPEDA, the EU GDPR, and the CCPA/CPRA.
United Kingdom. The Service is not offered to, marketed to, or targeted at individuals or businesses in the United Kingdom. We do not claim compliance with the UK GDPR, we have not appointed a representative under Article 27 of the UK GDPR, and this Policy should not be read as an undertaking to meet UK data-protection requirements. If you are in the United Kingdom and have communicated with a business through the Service, that business is the controller of your information — please direct your questions and requests to it.
To operate the Service we generate information about conversations rather than only storing what was said. Depending on the features a Customer has enabled, this can include:
See Automated processing & artificial intelligence for how these are produced and the rights that apply to them.
We do not ask for sensitive personal information, and the Service is not designed to collect it. Because conversations are free-form, you may nevertheless choose to include it, and some Customers operate in fields — for example healthcare or mental-health practices — where enquiries and appointment details inherently reveal information about health. Where a Customer enables our heightened-privacy configuration for such settings, the Service can automatically remove direct identifiers from message text before it is sent to our AI provider and, at the Customer’s option, before it is stored. Those Customers are also excluded from the diagnostic logging described in section 5. The Customer is responsible for having a lawful basis for any sensitive information it collects through the Service. We do not sell or share sensitive personal information, and we do not use it for advertising or profiling for our own purposes.
We use personal information to:
Where a Customer turns it on, links the assistant provides can carry parameters identifying the conversation they came from, so that the Customer’s own website analytics can tell that a visit originated in a chat. Those parameters travel to the analytics or e-commerce tools that Customer uses on its own site, under that Customer’s control and its own privacy policy. This feature is off unless a Customer configures it.
Legal bases (GDPR). Where the GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service to Customers and respond to End Users); legitimate interests (to secure, maintain, and improve the Service, provided these interests are not overridden by your rights); consent (for optional cookies and equivalent device storage, for the behavioural features described in section 3.2 where a Customer has enabled our consent gate, and for certain marketing communications — in each case withdrawable at any time); and compliance with a legal obligation. Where we act as a processor, we process personal data only on the documented instructions of the relevant Customer.
Canada (PIPEDA). We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we obtain consent (express or implied, as appropriate) as required by law.
The Service uses artificial intelligence to help answer questions and assist human operators. Conversation content may be sent to our AI sub-processor (OpenAI) to generate responses and operator suggestions, to translate between languages, to summarize and classify conversations, and to understand images and documents that End Users choose to send. This processing is used solely to deliver the Service. Our AI sub-processor does not use data submitted through the Service’s business API to train its models.
AI-generated answers are grounded in the knowledge base and settings configured by each Customer. Where a Customer has connected its own business systems, the assistant may query those systems while answering, which means the details of your request can be passed to them. Automated responses may occasionally be inaccurate; a human operator can take over a conversation at any time.
Where a Customer enables the voice assistant, a second AI sub-processor (ElevenLabs) conducts the spoken part of the call: it converts what you say into text and converts the assistant’s replies back into speech. The answers themselves are produced by us from that Customer’s knowledge base, on the same basis as a written chat. See section 3.1 for what is passed to that provider and what is stored afterwards.
Beyond generating replies, the Service automatically evaluates conversations as described in section 3.4: summarizing them, assessing their sentiment, classifying the topic, judging whether a human should be brought in, scoring how frustrated a visitor appears, assessing how ready a sales enquiry is, and — where a Customer’s plan includes it — supplying the assistant with summaries of your previous conversations with that same Customer. Where the GDPR applies, you have the right to object to this processing; see Your privacy rights.
We do not use your personal information to make decisions that produce legal or similarly significant effects about you without human involvement. These evaluations inform how a conversation is handled and what a Customer’s staff see; they do not by themselves determine access to a product, service, price, or benefit.
To understand how demanding requests to our AI provider are and to diagnose faults, we can record a small random sample of AI requests and their responses — which include the conversation text sent at that moment — to our cloud provider’s log service, retained for 30 days and then deleted automatically. This logging is off unless we deliberately enable it, applies to a fraction of requests, and is never applied to Customers who have enabled a heightened-privacy or redaction configuration (see section 3.5).
Where a Customer connects a Facebook Page, Instagram account, or WhatsApp business number, we process data received through the Meta platforms strictly to deliver the messaging feature they have enabled:
If you removed our application from your Facebook or Instagram account, or if you want your messaging data deleted, follow the instructions at our data-deletion page.
A Customer can connect its own Google account to turn on two optional features: adding the sales enquiries the Service captures to a Google Sheets spreadsheet the Customer chooses, and booking appointments on a Google Calendar the Customer chooses. The connected Google account always belongs to the Customer’s business, never to an End User. Through that connection we:
We store the connection’s access credentials, the account’s email address, the chosen spreadsheet and calendar, and an identifier for each event we create so that a booking can later be rescheduled or cancelled. Free/busy results are used only while available times are worked out and are not stored. Disconnecting the Google account in the Service deletes the stored credentials immediately.
Limited Use. ChatOpsPro’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. In particular:
We do not sell personal information. We share it only as follows:
We do not use the Service to serve advertising, and we do not disclose personal information to advertising networks or data brokers.
We are based in Canada, and our service providers may process data in Canada, the United States, the European Union, and other jurisdictions. Where personal data protected by the GDPR is transferred outside the EEA, we rely on an adequacy decision (Canada benefits from a partial EU adequacy decision) or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with additional measures where required. You may contact us for more information about these safeguards.
We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including to provide the Service to Customers, to comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete it or irreversibly anonymize it. Our current periods are:
| Category | Retention |
|---|---|
| Conversations and their messages, files, images, and voice-call transcripts | Set by each Customer for its own account; the default is 90 days after the last activity in a conversation, after which the conversation, its attachments, and any visitor record left with no remaining conversations are deleted automatically. A Customer may choose a longer period or elect to retain indefinitely. |
| Visitor browsing / session records (section 3.2) | 90 days from the end of the session, then deleted automatically. |
| Sales enquiries (leads) recorded for a Customer | Retained as the Customer’s business record until the Customer deletes them or closes its account. |
| Diagnostic AI logs (section 5.3) | 30 days, then deleted automatically. |
| Customer account, subscription, and billing records | For the life of the account and afterwards as required for tax, accounting, and legal-defence purposes. |
| Data we hold as a processor, on termination | Deleted or returned on the Customer’s instruction and on termination of their account, subject to legal retention requirements. |
A Customer can also delete an individual visitor’s data, or export it, at any time — see How to request deletion or a copy.
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, encryption at rest for our database (and its backups), our uploaded-file storage, and our server volumes, access controls and least-privilege practices, separation of each Customer’s data, authenticated and tenant-scoped interfaces, restriction of the widget to a Customer’s approved website addresses, rate limiting and abuse controls, and optional two-factor authentication and passkey sign-in for Customer accounts. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and the relevant authorities as required by law.
Depending on where you live, you may have some or all of the following rights. If we process your data on behalf of a Customer, we will refer your request to that Customer or act on their instructions.
You may request access to the personal information we hold about you, ask us to correct inaccurate information, and withdraw consent (subject to legal or contractual restrictions). You may also address concerns to the Office of the Privacy Commissioner of Canada.
You have the right to access, rectify, erase, restrict, or object to processing of your personal data — including the automated evaluation and profiling described in section 5.2 — the right to data portability, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection supervisory authority.
As explained in section 2, the Service is not offered to individuals in the United Kingdom and we do not claim compliance with the UK GDPR. If you are in the UK, please contact the business you communicated with, which is the controller of your information.
Subject to applicable law, you may have the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of your personal information, to correct inaccurate information, to limit the use of sensitive personal information, and to not be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.
To exercise any of these rights, contact us using the details in How to contact us. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on your request.
You can request deletion of your data, or a copy of it, at any time:
The chat widget does not set any cookies. It stores a small number of values in your browser’s own local and session storage on the device you are using, and our operator console stores your signed-in session the same way. We use one short-lived first-party cookie, in the operator console only, to secure the connection of a Facebook or Instagram account. We do not use advertising cookies, third-party analytics trackers, or advertising pixels anywhere in the Service.
| Stored value | Where | Purpose | Kept for |
|---|---|---|---|
_cw_session | Widget — local storage | The token that authenticates your own chat session, so only you can read your conversation | Until the conversation ends, you start a fresh one, or you clear site data |
_cw_name, _cw_email, _cw_phone, _cw_custom | Widget — local storage | Remembers contact details you entered, and attributes the site supplied, so you are not asked again on your next visit | Until you clear site data |
_cw_visits | Widget — local storage | Counts how many separate visits you have made, so operators can see you are a returning visitor | Until you clear site data |
_cw_session_start, _cw_journey | Widget — session storage | The start time of this visit and the pages you have viewed during it, used to decide whether a proactive message applies | Discarded when you close the browser tab |
_cw_consent | Widget — local storage | Records your consent choice where the business has enabled the consent bar | Until you change it or clear site data |
_cw_camp_…, _cw_flow_…, _cw_news_… | Widget — local storage | Remembers that a particular message, guided flow, or announcement has already been shown, so it is not repeated | Until you clear site data |
_cw_open, _cw_chat_active, _cw_needs_prechat, _cw_panel_w, _cw_panel_h | Widget — local storage | Keeps the chat window’s state and size as you move between pages | Until you clear site data |
_cb_auth | Operator console — local storage | Keeps a Customer’s user signed in | Until sign-out or expiry |
chatops_meta_connect | Operator console — first-party cookie | Protects the connection of a Facebook or Instagram account against tampering | Minutes; cleared as soon as the connection completes |
Bot protection. Our sign-up and waitlist forms use Cloudflare Turnstile to distinguish people from automated abuse. It runs in your browser and receives your IP address and technical signals about your browser for that purpose.
Your choices. The values needed to hold a conversation, keep you signed in, and record your consent choice are strictly necessary — without them the Service cannot function. Where a business enables our consent bar, the behavioural features described in section 3.2 — live visitor presence, returning-visitor counting, and proactive messages — are withheld until you accept, and you can change or withdraw your choice at any time from the “Cookie settings” link in the widget; withdrawing it stops that monitoring and clears the values behind it. You can also clear or block local storage through your browser settings, though doing so may affect chat functionality.
The Service is intended for use by businesses and adults. It is not directed to children, and we do not knowingly collect personal information from children under the age of 13 (or the minimum age required by local law). If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, where required, provide additional notice. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy.
For privacy questions, requests, or complaints, contact our privacy contact:
EU representative (GDPR Article 27). For individuals in the European Economic Area, our representative in the EU is:
This Policy is governed by the laws of the Province of New Brunswick and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles. If you are located in the EEA and are not satisfied with our response, you may contact your local supervisory authority. If you are in Canada, you may contact the Office of the Privacy Commissioner of Canada.