Data Protection & Privacy

"Personal Data" means any information relating to an identified or identifiable natural person, as defined by Article 4(1) of the General Data Protection Regulation (EU) 2016/679. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

"Data Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For the purposes of this Policy, the Data Controller is NLP GmbH.

"Data Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller.

"Data Subject" means an identified or identifiable natural person whose Personal Data is processed. In the context of this Policy, the Data Subject is you — the User of the MultipleChat platform.

"Third-Party AI Provider" means any external company or entity whose artificial intelligence models, APIs, or services are integrated into or made accessible through the MultipleChat platform, including but not limited to OpenAI LLC, Anthropic PBC, Google LLC, Meta Platforms Inc., Mistral AI SAS, Perplexity AI Inc., xAI Corp., and any other AI company whose models or APIs MultipleChat accesses on behalf of Users, whether now or in the future.

"User Content" means any text, files, images, documents, prompts, instructions, or other material that you submit to the MultipleChat platform, whether through conversation interfaces, file uploads, API calls, or any other method.

"Generated Content" means any text, images, code, documents, presentations, or other output produced by AI Models through the MultipleChat platform in response to User Content.

"Conversation Data" means the complete record of User Content and Generated Content within a conversation session, including metadata such as timestamps, model selection, token counts, and session identifiers.

"Sub-Processor" means any Data Processor engaged by MultipleChat to process Personal Data on its behalf in connection with the provision of the Services.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of Personal Data to third countries approved by the European Commission under Commission Implementing Decision (EU) 2021/914.

"Applicable Data Protection Law" means any and all data protection and privacy legislation applicable to the Processing of Personal Data under this Policy, including but not limited to: the General Data Protection Regulation (EU) 2016/679 ("GDPR"); the Swiss Federal Act on Data Protection ("FADP") as revised September 1, 2023; the UK General Data Protection Regulation and the UK Data Protection Act 2018; the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"); the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA"); and any other applicable national, federal, or state data protection law.

"Tokens" has the meaning given in the Terms of Service — the unit of computational resource consumed when the platform processes an AI request on a User's behalf.

2.1 Data Controller. The Data Controller for all Personal Data processed through the MultipleChat platform is NLP GmbH, a company registered in Switzerland under company number CHE-232.104.780, with its registered office at Untere Wiltisgasse 5, CH-8700 Küsnacht, Switzerland.

2.2 Contact for Data Protection Matters. All data protection inquiries, data subject access requests, erasure requests, portability requests, complaints, and any other communication relating to the Processing of your Personal Data should be directed to: [email protected]. We will acknowledge receipt of your request within 5 business days and provide a substantive response within 30 days, as required by Applicable Data Protection Law.

2.3 EU Representative. Where required by Article 27 of the GDPR, MultipleChat will designate a representative in the European Union. Details of the EU representative, if appointed, will be published on the MultipleChat website and updated in this Policy.

2.4 Relationship to Other Documents. This Policy is incorporated by reference into the Terms of Service and the Refund Policy. In the event of any conflict between this Policy and the Terms of Service on data protection matters, this Policy prevails. In the event of any conflict between this Policy and Applicable Data Protection Law, Applicable Data Protection Law prevails.

4.1 Data We Do NOT Collect. MultipleChat does not collect: biometric data; health or medical data; genetic data; data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; data concerning a person's sex life or sexual orientation; criminal conviction or offence data; or any other special category of Personal Data as defined by GDPR Article 9. You must not submit such data to the platform. See Section 25 for detailed guidance.

4.2 Data Minimization. We collect only the data that is necessary for the specific purposes described in Section 6. We do not collect data speculatively, and we do not maintain data for longer than necessary. This is not a courtesy — it is a legal obligation under GDPR Article 5(1)(c) and the Swiss FADP.

4.3 Accuracy. We take reasonable steps to ensure that Personal Data is accurate and kept up to date. You are responsible for ensuring that the information in your account settings is current. You can update your account information at any time through the platform settings, or by contacting [email protected].

6.1 Service Delivery. We use your Account Data, Authentication Data, and Conversation Data to: create and manage your account; authenticate your identity; route your queries to the appropriate AI models; deliver AI-generated responses; maintain your conversation history; process file uploads for AI analysis; manage your subscription and billing; and provide the full range of platform features available to your subscription tier.

6.2 Platform Operations. We use Technical Data, Log Data, and anonymized Usage Data to: monitor platform performance and uptime; identify and resolve technical issues; prevent, detect, and respond to security threats; detect and prevent abuse, fraud, and policy violations; manage server capacity and infrastructure; and ensure the platform operates reliably for all Users.

6.3 Service Improvement. We use anonymized and aggregated Usage Data to: understand which features are most valuable to Users; identify areas of the platform that need improvement; test new features and optimisations; and analyse platform performance trends. This data is anonymized and cannot be linked back to any individual User.

6.4 Legal Compliance. We use Billing Data, Log Data, and Account Data to: comply with Swiss tax and financial reporting obligations; respond to valid legal process (court orders, subpoenas, regulatory requests); enforce our Terms of Service and Refund Policy; and protect the rights, safety, and property of MultipleChat and its Users.

6.5 Customer Support. We use Support Data, Account Data, and relevant Conversation Data (only when you reference a specific conversation in a support request) to: respond to your inquiries; investigate reported issues; resolve billing disputes; and improve our support processes.

7.1 No Training by MultipleChat. MultipleChat does not train, fine-tune, adapt, distil, or otherwise develop any AI model using User Content, Conversation Data, Generated Content, uploaded files, or any other data you provide to the platform. We do not use your data to build proprietary models. We do not use your data to improve third-party models. We do not use your data for machine learning research. This applies to all data from all Users on all subscription tiers.

7.2 No Training by Third-Party AI Providers. MultipleChat accesses all Third-Party AI Providers exclusively through their commercial or enterprise API tiers. Under the terms of these commercial API agreements, providers are contractually prohibited from using API-submitted data for model training. This is fundamentally different from using free consumer-facing products such as ChatGPT.com, Gemini.google.com, or Claude.ai, where different data terms may apply. By routing through MultipleChat, your organisation benefits from commercial API data protections without needing to manage individual provider agreements.

7.3 What "No Training" Means Technically. When you send a message through MultipleChat, the following happens: (a) your message is encrypted in transit via TLS 1.3 and transmitted to the relevant provider's API endpoint; (b) the provider processes the message through their inference pipeline and generates a response; (c) the response is returned to MultipleChat and displayed to you; (d) your message and the response are stored encrypted in our infrastructure for your conversation history. At no point in this process is your data added to any training dataset, fine-tuning corpus, reinforcement learning pipeline, or any other model improvement process.

7.4 Temporary Provider Retention. Some Third-Party AI Providers temporarily retain API-submitted data for a limited period (typically 30 days) solely for the purpose of abuse monitoring and safety compliance. This is a standard industry practice required by the providers' own safety policies and, in some cases, by law. This temporary retention is not training — it is a security measure. After the retention period, the data is deleted from the provider's systems. See Section 8 for provider-specific details.

7.5 Contractual Enforceability. Our commitment not to use your data for AI training is not a marketing statement — it is a contractual term of your agreement with MultipleChat, enforceable under Swiss law. Any breach of this commitment by MultipleChat would constitute a breach of contract actionable under Swiss Code of Obligations.

8.1 Provider Terms Are Separate. Each Third-Party AI Provider has its own privacy policy and data processing terms. While we require all providers to operate under commercial API terms that prohibit training on customer data, we cannot control or guarantee the internal operations of independent companies. We encourage enterprise customers to review the API-specific privacy policies of each provider they use through MultipleChat.

8.2 Data Transmitted to Providers. When you send a message to an AI model, MultipleChat transmits: your message text (User Content); any attached files or context included in the conversation; system-level instructions necessary for the model to function correctly; and relevant conversation context if the conversation has multiple messages. MultipleChat does not transmit your name, email address, payment information, or account credentials to any AI provider.

8.3 Provider Changes. Third-Party AI Providers may change their data handling practices, API terms, or privacy policies at any time. MultipleChat monitors provider terms and will update this section if material changes occur. If a provider's data handling practices become incompatible with our commitments, we will remove that provider from the platform.

9.1 We Never Sell Your Data. MultipleChat will never sell, rent, lease, trade, or otherwise commercially transfer your Personal Data to any third party for any purpose. This is an absolute prohibition with no exceptions.

9.2 No Advertising Networks. We do not share any data with advertising networks, data brokers, marketing platforms, social media companies, or analytics services that profile users for advertising purposes.

9.3 Legal Requirements. We may disclose Personal Data when required to do so by applicable law, valid court order, subpoena, or binding regulatory request. In such cases, we will: comply with the minimum scope of the legal requirement; notify you of the disclosure where legally permitted; and challenge overbroad or unlawful requests where appropriate.

9.4 Business Transfers. In the event of a merger, acquisition, reorganisation, or sale of MultipleChat's assets, your Personal Data may be transferred to the acquiring entity. In such a case: the acquiring entity will be bound by the terms of this Policy for existing data; you will be notified of the transfer before it occurs; and you will be given the opportunity to delete your data before the transfer is completed.

9.5 Sub-Processor Register. Enterprise customers can request a complete, up-to-date list of all Sub-Processors, including their specific data processing activities, by contacting [email protected].

10.1 Infrastructure Stack. The MultipleChat security architecture consists of six layers: (1) Edge Protection — Cloudflare provides DDoS mitigation, Web Application Firewall rules, bot management, rate limiting, and SSL/TLS termination at the network edge before any request reaches our infrastructure; (2) Authentication — Auth0 (Okta) provides enterprise-grade identity management with multi-factor authentication support, brute-force protection, anomaly detection, credential stuffing prevention, and session management; (3) Application Layer — application logic runs on Microsoft Azure's Switzerland North and West regions, benefiting from Azure's physical security, network isolation, and compliance certifications; (4) Data Storage — all data at rest is encrypted with AES-256 encryption, with access controlled by role-based access policies and all access logged and audited; (5) AI Provider Communication — queries to Third-Party AI Providers are transmitted over TLS 1.3 encrypted channels using their commercial API endpoints; (6) Payment Processing — Stripe handles all payment card processing at PCI DSS Level 1 compliance, the highest level of certification available.

10.2 Network Security. All network traffic between MultipleChat components is encrypted. We employ network segmentation to isolate different parts of the infrastructure. Firewall rules restrict inbound and outbound traffic to known, necessary endpoints. Intrusion detection systems monitor for anomalous network activity.

10.3 Application Security. We follow secure software development practices including: regular dependency scanning for known vulnerabilities; input validation and sanitisation on all user-facing interfaces; parameterised database queries to prevent SQL injection; output encoding to prevent cross-site scripting; CSRF protection on all state-changing operations; and security-focused code review processes.

10.4 Security Monitoring. We maintain 24/7 automated security monitoring covering: server and application health; unusual login patterns or access attempts; abnormal traffic patterns or potential DDoS activity; error rate anomalies; and resource utilisation that may indicate compromise.

10.5 Security Audits. MultipleChat conducts regular security assessments including: internal security reviews; dependency and vulnerability scanning; and infrastructure configuration audits. Enterprise customers may request details of our security assessment schedule and findings (under NDA) by contacting [email protected].

11.1 Data in Transit. All data transmitted between your browser/device and MultipleChat's servers is encrypted using TLS 1.3 — the latest and most secure version of the Transport Layer Security protocol. We enforce HTTPS on all endpoints. Connections using older, less secure protocols (TLS 1.0, TLS 1.1) are rejected. HTTP Strict Transport Security (HSTS) headers are deployed to prevent protocol downgrade attacks.

11.2 Data at Rest. All data stored on MultipleChat's infrastructure — including Conversation Data, Account Data, uploaded files, and Log Data — is encrypted at rest using AES-256 encryption, which is the encryption standard used by financial institutions, government agencies, and military systems worldwide.

11.3 Key Management. Encryption keys are managed through Azure Key Vault, which provides hardware security module (HSM) backed key storage. Access to encryption keys is restricted to essential infrastructure services and is logged and audited. Key rotation policies are in place and executed on a regular schedule.

11.4 Database Encryption. All database systems use transparent data encryption (TDE) in addition to storage-level encryption, providing defence in depth. Database connections use encrypted channels. Database backups are encrypted with the same standards as live data.

12.1 Principle of Least Privilege. Access to User data is restricted to the minimum number of authorised personnel who require it for legitimate operational purposes — such as debugging a reported technical issue or responding to a support request that references specific account data. No employee has blanket access to all User data.

12.2 Role-Based Access Control. All access to production systems and User data is governed by role-based access control (RBAC). Different roles have different access levels, and access is granted based on job function and necessity. Access permissions are reviewed regularly.

12.3 Multi-Factor Authentication. All employees and contractors with access to production systems or User data are required to use multi-factor authentication. Password policies enforce minimum complexity and regular rotation.

12.4 Access Logging. All access to production systems and User data is logged with timestamps, user identifiers, and the nature of the access. These logs are retained and reviewed for anomalous activity. Logs cannot be tampered with or deleted by the personnel whose access they record.

12.5 Employee Security. All personnel with access to User data undergo background checks as permitted by applicable law. All personnel are bound by confidentiality obligations. All personnel receive data protection and security awareness training. Access is revoked immediately upon role change or termination.

12.6 No Routine Surveillance. MultipleChat does not perform bulk surveillance, systematic reading, or routine monitoring of User conversations. We do not read your conversations unless you specifically bring a conversation to our attention in a support request, or unless required by a valid legal process.

13.1 Primary Infrastructure Location. MultipleChat's primary infrastructure — including application servers, databases, file storage, and backup systems — is hosted on Microsoft Azure's Switzerland North and Switzerland West regions, located in the cantons of Zurich and Geneva respectively. This means your data at rest is physically located within Switzerland.

13.2 Swiss Data Residency. Switzerland holds a European Commission adequacy decision under GDPR Article 45(1), meaning that transfers of Personal Data from the EU/EEA to Switzerland are treated as equivalent to intra-EU transfers and do not require additional safeguards such as Standard Contractual Clauses. Switzerland's own Federal Act on Data Protection (FADP), as revised in 2023, provides data protection standards that are recognised internationally as among the strongest in the world.

13.3 Edge Caching. Cloudflare's global edge network may temporarily cache static assets (such as CSS, JavaScript, and images) at edge locations worldwide to improve performance. This caching involves only static platform assets — not User Content, Conversation Data, or any Personal Data.

13.4 Backup and Disaster Recovery. Database backups are stored in encrypted form within Azure's European regions. Backup data is subject to the same encryption standards and access controls as live data. Disaster recovery procedures are documented, tested, and designed to minimise data loss and recovery time.

14.1 Switzerland to EU/EEA. Transfers of Personal Data between Switzerland and the EU/EEA do not require additional safeguards, as Switzerland holds an EU adequacy decision and the EU holds recognition of adequacy under the Swiss FADP.

14.2 Transfers to the United States. When your queries are processed by US-based AI providers (OpenAI, Anthropic, Google, Meta, Perplexity, xAI), your User Content is transmitted to servers located in the United States. These transfers are governed by: EU Standard Contractual Clauses (SCCs) as approved by European Commission Implementing Decision (EU) 2021/914; the EU-US Data Privacy Framework, where applicable; and supplementary technical measures including encryption of data in transit (TLS 1.3) and contractual prohibitions on data use beyond the stated processing purpose.

14.3 Transfers to Other Jurisdictions. Cloudflare's edge network operates globally, but as noted in Section 13.3, only static platform assets are cached at edge locations — not Personal Data. Auth0 may process authentication data in EU or US data centres, governed by Okta's own data processing agreements and SCCs.

14.4 Transfer Impact Assessment. MultipleChat has conducted Transfer Impact Assessments (TIAs) for all international data transfers, evaluating the legal framework of the destination country, the specific data transferred, and the supplementary measures in place. TIA summaries are available to enterprise customers upon request.

14.5 Data Minimisation in Transfers. When transmitting data to Third-Party AI Providers, we transmit only the User Content and conversation context necessary for the AI model to process the query. We do not transmit your name, email address, IP address, payment information, account identifier, or any other identifying metadata to AI providers.

16.1 Right of Access (GDPR Art. 15). You have the right to obtain confirmation as to whether your Personal Data is being processed, and if so, to access that data together with information about: the purposes of Processing; the categories of data concerned; the recipients to whom data has been disclosed; the retention periods; the existence of your other rights; the source of data (if not collected from you); and whether automated decision-making or profiling is applied.

16.2 Right to Rectification (GDPR Art. 16). You have the right to obtain the correction of inaccurate Personal Data without undue delay. You can update most account information directly through your account settings. For data that cannot be self-corrected, contact [email protected].

16.3 Right to Erasure (GDPR Art. 17). You have the right to obtain the deletion of your Personal Data in certain circumstances — see Section 17 for detailed erasure procedures and exceptions.

16.4 Right to Restriction of Processing (GDPR Art. 18). You have the right to request that we restrict Processing of your Personal Data where: you contest the accuracy of the data (restricted while we verify); you believe the Processing is unlawful but prefer restriction over deletion; we no longer need the data but you require it for legal claims; or you have objected to Processing under Article 21 and the objection is pending.

16.5 Right to Data Portability (GDPR Art. 20). You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. See Section 18 for detailed portability procedures.

16.6 Right to Object (GDPR Art. 21). You have the right to object to Processing based on legitimate interest (Article 6(1)(f)) at any time. Upon receipt of your objection, we will cease Processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the Processing is necessary for the establishment, exercise, or defence of legal claims.

16.7 Right Regarding Automated Decision-Making (GDPR Art. 22). See Section 19.

16.8 Right to Withdraw Consent. Where Processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal. Note: most of our Processing is based on contract performance or legitimate interest, not consent.

16.9 Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority. See Section 29 for details of relevant authorities.

16.10 How to Exercise Your Rights. To exercise any of the above rights, contact [email protected] with the subject line "Data Subject Rights Request" followed by the specific right you wish to exercise. We will acknowledge your request within 5 business days and provide a substantive response within 30 days. For complex requests, we may extend the response period by a further 60 days with notification. We will not charge a fee for processing reasonable rights requests. We may request additional information to verify your identity before processing your request.

17.1 Self-Service Deletion. You can delete individual conversations, individual uploaded files, or all conversations from your account at any time through the platform interface. Deleted conversations are permanently removed from our live systems within 24 hours and from backups within 30 days.

17.2 Account Deletion. You can request complete account deletion by contacting [email protected]. Upon receiving your verified request, we will: cancel any active subscription; permanently delete all Account Data, Conversation Data, uploaded files, and Generated Content associated with your account within 30 days; retain billing records for 7 years as required by Swiss tax law (these cannot be deleted earlier); and send you a confirmation once the deletion is complete.

17.3 Exceptions to Erasure. We may be unable to delete specific data where: retention is required by Swiss tax law (billing records, 7 years); retention is required by another legal obligation; the data is necessary for the establishment, exercise, or defence of legal claims; or the data is subject to a legal hold in connection with ongoing or anticipated litigation. In such cases, we will inform you of the specific exception and retain only the minimum data required.

17.4 Third-Party AI Provider Data. When you delete your data from MultipleChat, this does not retroactively delete data that has already been transmitted to Third-Party AI Provider APIs. However, as described in Section 8, providers retain API-submitted data only temporarily (typically up to 30 days) for abuse monitoring, after which it is deleted from their systems in accordance with their own retention policies. MultipleChat cannot force providers to delete data ahead of their standard retention schedules.

18.1 Export Formats. You have the right to export your data in structured, commonly used, and machine-readable formats. MultipleChat supports export of Conversation Data in JSON format, Account Data in JSON format, and uploaded files in their original formats.

18.2 How to Export. You can export your data through the platform interface (where available) or by contacting [email protected] with the subject line "Data Portability Request." We will provide the export within 30 days of your verified request.

18.3 Scope of Portability. The right to portability applies to Personal Data that you have provided to us, processed on the basis of consent or contract, and processed by automated means. It does not extend to data derived from your Personal Data through our own analytical processing, or to data that we are legally required to retain.

19.1 No Automated Decision-Making with Legal Effects. MultipleChat does not make any decisions based solely on automated processing — including profiling — that produce legal effects concerning you or similarly significantly affect you. AI-generated responses are informational outputs, not automated decisions with legal effect.

19.2 Usage-Based Features. Some platform features involve automated processing of your usage patterns — for example, Smart Mode's automatic model selection is based on the content and complexity of your query, not on profiling of your personal characteristics. This type of processing does not produce legal or similarly significant effects.

19.3 Abuse Detection. Our abuse prevention systems (as described in the Terms of Service) use automated analysis of usage patterns to identify potential policy violations. However, no account is suspended, terminated, or subject to adverse action based solely on automated analysis — a human review is always conducted before any enforcement action is taken.

20.1 Age Requirement. The MultipleChat platform is not intended for use by individuals under the age of 16 (or the applicable minimum age in your jurisdiction). By creating an account, you represent and warrant that you are at least 16 years of age. If you are between 16 and 18, you represent that your parent or legal guardian has reviewed and agreed to these terms on your behalf.

20.2 No Knowing Collection from Children. We do not knowingly collect Personal Data from children under the age of 16. If we become aware that we have collected Personal Data from a child under 16 without parental consent, we will take immediate steps to delete that data from our systems.

20.3 Reporting. If you believe that a child under 16 has provided Personal Data to MultipleChat, please contact [email protected] immediately. We will investigate and, if appropriate, delete the data and terminate the account.

Authentication Cookies (Auth0/Okta). These cookies maintain your logged-in session, handle multi-factor authentication state, and prevent unauthorized access to your account. They are strictly necessary for the platform to function. Without them, you would be logged out on every page load.

Session Management Cookies. These cookies store your current session state, including your selected AI model, conversation context, and interface preferences. They expire when your session ends or after a defined inactivity period.

Security Cookies (Cloudflare). Cloudflare sets cookies to distinguish between humans and automated bots, to mitigate DDoS attacks, and to enforce Web Application Firewall rules. These are essential for protecting the platform and all Users from security threats.

Stripe Cookies. Stripe sets cookies necessary for payment processing, fraud detection, and PCI DSS compliance during checkout and subscription management.

ClickCease. MultipleChat uses ClickCease to detect and prevent click fraud on our paid advertising campaigns. ClickCease monitors click patterns on our ads to identify automated, fraudulent, or abusive clicking behaviour that wastes advertising budget. Data collected includes: IP addresses, click timestamps, user agent strings, referral data, and click frequency patterns. This processing is based on our legitimate interest (GDPR Article 6(1)(f)) in protecting our business from advertising fraud. ClickCease is operated by Cheq AI Technologies Ltd.

ClickGuard. MultipleChat may additionally use ClickGuard for click fraud detection and invalid traffic filtering across paid advertising campaigns. ClickGuard collects similar data to ClickCease — including IP addresses, click patterns, device fingerprints, and behavioural signals — to identify and block fraudulent clicks in real time. This processing is based on our legitimate interest (GDPR Article 6(1)(f)) in protecting our advertising spend from fraud.

Cookie Consent Banner. When you first visit the MultipleChat website, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies. You can change your preferences at any time by accessing the cookie settings link in the website footer or by contacting [email protected].

Browser Settings. You can also control cookies through your browser settings. Most browsers allow you to block third-party cookies, clear existing cookies, and set preferences for specific websites. Note that blocking essential cookies may prevent the platform from functioning correctly.

Opt-Out Links. Many of the advertising platforms listed above provide their own opt-out mechanisms: Google (Ad Settings at adssettings.google.com); Meta (Ad Preferences at facebook.com/adpreferences); LinkedIn (Ad Preferences in your LinkedIn settings); X (Personalization and data settings in your X account); Reddit (Privacy settings in your Reddit account); Microsoft (Privacy dashboard at account.microsoft.com/privacy).

Do Not Track. Some browsers transmit a "Do Not Track" (DNT) signal. There is currently no industry standard for how websites should respond to DNT signals. MultipleChat does not currently alter its tracking practices in response to DNT signals, but you can use the cookie consent banner and the opt-out mechanisms described above to control tracking.

Impact of Opting Out. If you reject non-essential cookies, all analytics, advertising, and remarketing tools listed above will be deactivated. This will not affect your ability to use the MultipleChat platform. Essential cookies (authentication, session, security, payment) will continue to function as they are required for the service.

For a complete list of individual cookies set by the MultipleChat platform, including their names, purposes, durations, and classifications, please refer to our separate Cookie Policy.

22.1 Incident Response Plan. MultipleChat maintains a documented incident response plan covering: detection and identification of security incidents; containment and mitigation measures; evidence preservation; notification procedures; root cause analysis; and remediation and prevention of recurrence.

22.2 Supervisory Authority Notification. In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of natural persons, MultipleChat will notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. The notification will include: the nature of the breach; the categories and approximate number of Data Subjects affected; the likely consequences of the breach; and the measures taken or proposed to address the breach.

22.3 Data Subject Notification. Where a Personal Data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR Article 34. The notification will describe the nature of the breach in clear and plain language, provide the contact details of our data protection point of contact, describe the likely consequences, and describe the measures taken or proposed to address the breach.

22.4 Enterprise Breach Notification. Enterprise customers with a Data Processing Agreement may have additional breach notification requirements specified in their DPA, including shorter notification timelines and additional reporting obligations. We honour all contractual breach notification commitments.

24.1 DPA Availability. Business and enterprise customers can request a signed Data Processing Agreement (DPA) compliant with GDPR Article 28. Our DPA is pre-drafted and ready for execution — it is not a negotiation-from-scratch process.

24.2 DPA Contents. Our standard DPA includes: the subject matter and duration of Processing; the nature and purpose of Processing; the type of Personal Data and categories of Data Subjects; the obligations and rights of the Controller; Standard Contractual Clauses (SCCs) as approved by the European Commission; a complete and up-to-date list of Sub-Processors; detailed technical and organisational measures (TOMs); data breach notification procedures (72-hour notification to Controller); audit rights provisions; data return and deletion obligations upon termination; and provisions for cross-border data transfers.

24.3 Sub-Processor Notifications. Enterprise customers with a DPA are entitled to advance notification of any changes to our Sub-Processor list, including the addition or replacement of Sub-Processors. Notification will be provided with sufficient advance notice to allow the Controller to object to the change.

24.4 How to Request a DPA. To request a DPA, contact [email protected] with the subject line "DPA Request" and include your company name, jurisdiction, and the name and email of the person authorised to sign. We will provide the DPA document within 5 business days.

25.1 What Constitutes Special Category Data. Special category data includes: data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data for identification purposes; data concerning health; data concerning a person's sex life or sexual orientation; and criminal conviction or offence data.

25.2 Prohibition. You must not input, upload, or otherwise submit special category data to MultipleChat. This includes submitting such data in conversation prompts, uploaded files, or any other format. MultipleChat does not have the technical or organisational measures necessary to process special category data in compliance with GDPR Article 9, and the transmission of such data to Third-Party AI Providers would expose it to processing environments that are not designed for special category data.

25.3 If Special Category Data Is Submitted. If you inadvertently submit special category data, you should immediately delete the relevant conversation. If you are unable to do so, contact [email protected] and we will assist with deletion. MultipleChat accepts no liability for the processing of special category data that you submit in violation of this section.

26.1 When We Conduct DPIAs. MultipleChat conducts Data Protection Impact Assessments (DPIAs) as required by GDPR Article 35 whenever a Processing activity is likely to result in a high risk to the rights and freedoms of Data Subjects. This includes assessments of: new features that involve significant Processing of Personal Data; changes to our Sub-Processor list; new Third-Party AI Provider integrations; and any material change to our data handling practices.

26.2 DPIA Availability. Summaries of relevant DPIAs are available to enterprise customers and supervisory authorities upon request.

27.1 External Links. The MultipleChat platform may contain links to third-party websites or services. This Policy does not apply to those third-party websites or services. We encourage you to review the privacy policies of any third-party site you visit.

27.2 AI-Generated Links. AI-generated responses may include links to external websites. These links are generated by the AI model, not curated by MultipleChat. MultipleChat does not control, endorse, or take responsibility for the content, privacy practices, or security of any external website linked in an AI-generated response.

28.1 Right to Amend. MultipleChat reserves the right to update or modify this Policy at any time. We will make reasonable efforts to notify you of material changes, including: posting a notice on the MultipleChat platform; sending an email to the address associated with your account; and updating the "Last Updated" date at the top of this Policy.

28.2 Material Changes. If we make changes that materially alter the way we process your Personal Data, or that reduce your rights under this Policy, we will provide at least 30 days' advance notice before the changes take effect. If you do not agree with the changes, you may delete your account before they take effect.

28.3 Continued Use. Your continued use of the Services after a change to this Policy constitutes acceptance of the revised Policy. The most current version of this Policy is always available at multiplechat.ai/data-protection.

29.1 Right to Complain. If you believe that our Processing of your Personal Data violates Applicable Data Protection Law, you have the right to lodge a complaint with a supervisory authority. You may lodge a complaint with the authority in your habitual residence, your place of work, or the place of the alleged infringement.

29.2 Swiss Authority. The Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC) — Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, CH-3003 Bern, Switzerland.

29.3 EU/EEA Authorities. If you are located in the EU/EEA, you may lodge a complaint with the data protection authority in your Member State. A directory of EU data protection authorities is maintained by the European Data Protection Board (EDPB) at edpb.europa.eu.

29.4 UK Authority. If you are located in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom.

29.5 Contact Us First. Before lodging a formal complaint, we encourage you to contact us at [email protected] so we can attempt to resolve your concern directly. We take all data protection complaints seriously and will work to address them promptly and thoroughly.

30.1 Governing Law. This Policy is governed by and construed in accordance with the laws of Switzerland, without regard to conflict of law principles. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded.

30.2 Jurisdiction. Any dispute arising out of or in connection with this Policy shall be submitted to the exclusive jurisdiction of the courts of Zurich, Switzerland, except where mandatory consumer protection law requires a different jurisdiction.

30.3 Mandatory Consumer Protection Law. Nothing in this Policy restricts your rights under mandatory consumer protection or data protection law that cannot be waived or limited by contract. Where Applicable Data Protection Law provides you with rights that are more favourable than those set out in this Policy, those more favourable rights prevail.

If any provision of this Policy is held by a court of competent jurisdiction to be invalid, unlawful, or unenforceable, that provision shall be severed from this Policy, and the remaining provisions shall continue in full force and effect. The invalid provision shall be replaced, to the extent possible, with a valid provision that achieves the same economic and legal effect as the original provision.

This Policy, together with the Terms of Service and the Refund Policy, constitutes the entire agreement between you and MultipleChat regarding the Processing of your Personal Data. It supersedes all prior or contemporaneous oral or written communications, proposals, representations, or agreements relating to the subject matter of this Policy. No statement, representation, or promise made by any MultipleChat employee, contractor, or representative that is not contained in this Policy shall bind MultipleChat.

33.1 Data Protection Inquiries. For all data protection inquiries, data subject rights requests, DPA requests, complaints, and any other communication relating to this Policy, contact:

33.2 Response Times. We will acknowledge receipt of your inquiry within 5 business days and provide a substantive response within 30 days. For complex requests, we may extend the response period by a further 60 days with notification to you.

33.3 Subject Lines. To help us process your request efficiently, please use the following subject lines: "Data Subject Access Request" for access requests; "Data Deletion Request" for erasure requests; "Data Portability Request" for export requests; "DPA Request" for Data Processing Agreement requests; "Data Protection Complaint" for complaints; and "General Data Protection Inquiry" for all other inquiries.