Your data, handled the way it should be.

Sign-in is handled by a dedicated identity provider, not rolled by hand.

• Authentication and identity are managed by Auth0 (Okta) — a specialist identity platform — so credentials are never stored in plaintext by us.
• Sign in with email or Google. Enterprise SSO is available for teams.
• Sessions use secure, same-site cookies; login endpoints are rate-limited to slow brute-force attempts.

Card data never touches our servers.

• All payments are processed by Stripe, a PCI-DSS Level 1 certified processor.
• MultipleChat never sees or stores full card numbers, CVV codes, or bank details — Stripe handles them directly.
• We retain only billing metadata: amounts, status, invoice records, and a Stripe customer ID.

We collect the minimum needed to run your account — and no special-category data.

• We practise data minimization: only what's necessary for the service, never speculative collection.
• We do not collect biometric, health, genetic, or other special-category data — and you shouldn't submit it.
• Account data is deleted 30 days after you request account deletion. You can access, export, correct, or erase your data at any time.

Your conversations are yours — stored so you have history, deletable whenever you want.

• Conversations and uploaded files are stored while your account is active and can be deleted by you at any time.
• Chat data is encrypted in transit and at rest.
• Stored on Microsoft Azure infrastructure (see Hosting).

Your content is never used to train AI models. Not by us. Not by the providers.

• Your conversations, documents, and files are never used to train or fine-tune any AI model.
• This is enforced contractually: we use API agreements with the model providers that exclude customer data from training.
• Providers do not retain your data beyond the time needed to generate a response.

We never sell your data. It's shared only with the vendors needed to run the service.

• MultipleChat does not sell your personal data, and does not share it with third parties for advertising profiling.
• Data is shared only with vetted sub-processors under data processing agreements and EU Standard Contractual Clauses (SCCs).
• A Data Processing Agreement (DPA) is available for business and enterprise customers.

Run on Microsoft Azure, with encryption in transit and at rest.

• The platform runs on Microsoft Azure infrastructure in the United States.
• Azure provides the underlying compute, storage, and networking, backed by Microsoft's own enterprise security and compliance certifications.
• All platform data is encrypted in transit and at rest. Because hosting is in the US, personal data of users in the EU, UK, and Switzerland is transferred under EU Standard Contractual Clauses (SCCs).

Defence in depth — at the edge, in transit, at rest, and in the application.

• Cloudflare provides edge security: a Web Application Firewall (WAF), DDoS protection, and TLS termination.
• Data is encrypted in transit (TLS) and at rest. Traffic is forced over HTTPS with HSTS.
• Application hardening includes a Content Security Policy, CSRF protection, server-side rate limiting, input sanitization, and secure same-site session cookies.
• We notify affected users and authorities of any qualifying data breach in line with GDPR Articles 33 and 34.

A Swiss company, operating under Swiss and EU law, with binding commitments.

• MultipleChat is operated by NLP GmbH (Küsnacht, Switzerland · CHE-232.104.780).
• We comply with the Swiss Federal Act on Data Protection (FADP, revised 2023), the GDPR, UK GDPR, and CCPA/CPRA.
• International data transfers are governed by EU Standard Contractual Clauses.
• We use analytics and session tools (e.g. Google Analytics, Microsoft Clarity, Hotjar) — all disclosed, with consent controls. See the Cookie Policy.

Who we work with

The core infrastructure providers that help run MultipleChat. The complete list — including analytics and advertising vendors — is in the Privacy Policy, §9.