Privacy Policy

This Privacy Policy explains how CherryWave LLC (“Conecto,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data in connection with the Conecto website, applications, platform, APIs, chat widget, and related services (the “Service”). It also explains the choices and rights available to individuals.

When Conecto is a controller

Conecto is a controller or “business” for personal data used to manage our website, accounts, billing, security, direct customer relationships, and our own business operations.

When Conecto is a processor

Customers use Conecto to communicate with their own prospects, customers, and website visitors. For personal data contained in those communications and records (“Customer Data”), the Customer generally determines why and how the data is processed. The Customer is the controller or business, and Conecto acts as its processor or service provider. If you interacted with a company through a Conecto-powered widget, message, or ticket, contact that company first to exercise your rights. We will assist the Customer as required by law and our agreement.

This Policy does not replace a Customer’s own privacy notice and does not govern a third party’s independent practices.

The personal data we collect depends on your relationship with Conecto, the features used, workspace settings, and the information you or a Customer chooses to provide. The table is limited to fields and records handled by the current Service; a row applies only when the corresponding feature is used.

Conecto does not create or store advertising identifiers, hardware identifiers, or other device identifiers, and does not request precise GPS location. The random browser-stored value used by the widget identifies a chat session, not a device.

Please do not submit sensitive personal data unless it is necessary for an authorized use, you have a lawful basis, and appropriate safeguards are in place. Customers control the fields and content their end users submit and are responsible for minimizing that collection.

We obtain personal data from:

• You directly, when you create an account, configure a workspace, submit a form, contact us, or use the Service.
• Customers and authorized users, when they upload, enter, import, or generate Customer Data or invite teammates.
• End users, when they interact with a Conecto-powered chat, ticket form, email, bot, help center, or other communication.
• Network requests and browser storage, through authentication cookies, the widget’s random chat-session value, current page URL, IP address, HTTP request headers, and GCP request and application logs described in Section 2.
• Connected services, such as Google, Stripe, Shopify, a Customer’s website, MCP servers, webhooks, or APIs that a Customer authorizes.
• Public sources, when a Customer instructs us to retrieve public website content for its knowledge base.

The table below describes our main purposes. The “legal basis” column applies where laws such as the GDPR or UK GDPR require one. If we rely on legitimate interests, those interests include operating and improving a secure business service, communicating with customers, preventing misuse, and protecting our rights, balanced against the rights of affected individuals.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect prior processing. Where data is required to enter or perform a contract, failing to provide it may prevent us from providing the relevant Service.

The dashboard uses HttpOnly authentication cookies for access and refresh tokens and, after Google sign-in, a Google access token until logout. Browser local storage holds the selected theme, inbox scope, sound preference, presence intention, and an integration setup claim when needed. Those local preference values are not sent to the backend merely because they are stored in the browser; a presence status is sent only when the dashboard uses it to update availability.

A Conecto chat widget embedded on a Customer website stores a random chat-session identifier and interface state in the visitor’s browser so a conversation can continue across pages or visits. The session identifier is sent to the backend with widget requests; interface state stays in the browser unless a user action invokes a backend feature. The Customer controls whether to enable an in-widget consent notice and is responsible for notices and consent required for its website.

We do not currently use third-party advertising cookies or track people across unrelated websites for behavioral advertising. Most browsers let you remove or block cookies and local storage, but doing so may prevent sign-in, chat continuity, and other features from working. Because we do not sell personal data or use it for cross-context behavioral advertising, Global Privacy Control and “Do Not Track” signals do not change those practices; we will treat legally recognized signals as required if our practices change.

When a Customer enables an AI feature, Conecto may send the minimum context reasonably needed for the request—such as selected conversation history, knowledge-base content, instructions, and results from configured tools—to OpenRouter and the model provider selected for that request. The provider returns generated content, classifications, summaries, or tool instructions to Conecto.

Customers decide whether to enable AI, what sources and integrations it can use, and how output is reviewed. Conecto’s AI features do not make decisions on Conecto’s behalf that produce legal or similarly significant effects about individuals. A Customer may configure automated replies, routing, or actions and is responsible for providing notices, lawful instructions, human review, and opt-outs required for its use case.

We disclose personal data only as described in this Policy, at a Customer’s direction, or with your consent. The main recipient categories are:

• Workspace members and administrators. Content and account information may be visible to people authorized by the Customer, according to their roles and workspace settings.
• Professional advisers. Lawyers, auditors, insurers, accountants, and other advisers may receive data subject to confidentiality obligations.
• Legal and safety recipients. We may disclose data to courts, regulators, law enforcement, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, and the integrity of the Service.
• Corporate transaction parties. Data may be disclosed in connection with due diligence, financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.
• At your direction. We disclose data when you ask us to, connect an integration, make information public, or otherwise authorize the disclosure.

Our provider list may change as the Service evolves. Providers may process data only for the contracted service, subject to appropriate confidentiality, security, and data protection obligations.

Conecto does not sell personal data for money. We also do not “share” personal data for cross-context behavioral advertising or process it for targeted advertising as those terms are defined by applicable U.S. state privacy laws. We do not use or disclose sensitive personal information to infer characteristics about individuals. Therefore, we do not offer “Do Not Sell or Share” or “Limit the Use of My Sensitive Personal Information” links. If these practices change, we will update this Policy and provide required choices before the change applies.

We retain personal data only as long as reasonably necessary for the purposes described in this Policy. Retention depends on the data’s nature, workspace settings, contractual commitments, the sensitivity and risk of the data, available deletion controls, and legal, accounting, security, and dispute-resolution requirements.

When retention is no longer necessary, we delete, de-identify, or isolate the data. Residual copies may remain for a limited period in backups or where deletion is impracticable, but they remain protected and are not used for unrelated purposes.

Conecto hosts its primary application, database, and storage in EU regions and uses technical safeguards including encryption in transit, encrypted credential storage, access controls, authentication protections, and data minimization. Some enabled features send limited data to third-party providers; applicable international-transfer safeguards depend on the provider and processing location.

We use administrative, technical, and organizational safeguards designed to protect personal data, including transport encryption, access controls, role-based permissions, credential protection, encrypted storage for certain integration secrets, logging, monitoring, and data minimization. We assess safeguards in light of the nature of the data and risks involved. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur.

You are responsible for protecting your credentials, choosing appropriate workspace permissions, configuring integrations securely, and notifying us promptly of suspected account compromise at legal@conecto.chat.

• Account information. You can update certain profile and workspace details in the dashboard.
• Customer Data. Authorized Customers can access, export, correct, and delete certain Customer Data through the Service or by contacting us.
• Communications. You can unsubscribe from promotional email using the link in the message. We may still send transactional, security, billing, and legal notices.
• Cookies and storage. You can use browser controls to delete or block browser storage, subject to the functionality limits described above.
• Notifications. Browser notifications can be changed in the Service and your browser or device settings.
• Integrations. Authorized workspace members can disconnect integrations in the Service or through the third-party provider.

To submit a privacy request, email legal@conecto.chat with “Privacy request” in the subject line. Tell us the right you want to exercise, your country or state, and the account, workspace, or Customer involved. If Conecto processes the data only for a Customer, we may direct the request to that Customer.

We may ask for information reasonably necessary to verify your identity and authority. Authorized agents may submit requests where permitted, but we may require proof of authorization and direct identity verification. We will respond within the period required by applicable law. Some rights are subject to exceptions, and we may retain data where legally permitted or required.

EEA, United Kingdom and Switzerland

Depending on the circumstances, you may have the right to access, correct, erase, restrict, or port personal data; object to processing based on legitimate interests or for direct marketing; and withdraw consent. You may also lodge a complaint with the data protection authority where you live or work or where you believe a violation occurred. We encourage you to contact us first so we can try to resolve the concern.

You have the right to object at any time to processing of your personal data for direct marketing. You may also object to processing based on our legitimate interests, and we will stop unless we have compelling legitimate grounds or need the data for legal claims.

California and other U.S. states

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with applicable comprehensive privacy laws may have rights to confirm processing; access, correct, delete, or obtain a portable copy of personal data; obtain information about categories of data, sources, purposes, and recipients; opt out of sale, targeted advertising, or certain profiling; limit certain uses of sensitive data; and appeal a denied request. Available rights vary by state and are subject to exceptions.

If we deny your request and your state gives you an appeal right, reply to our decision or submit a new contact form marked “Privacy appeal.” California residents may also request information under California’s “Shine the Light” law about certain disclosures for third parties’ direct marketing; we do not make those disclosures.

The Service is a business product and is not directed to children under 13. Conecto accounts are limited to people 18 or older. We do not knowingly collect personal data directly from children under 13 without legally valid parental consent. If you believe a child provided personal data to Conecto in violation of this Policy, contact us so we can investigate and take appropriate action.

Customers must not deploy Conecto on a child-directed website or service, or use it to collect personal data from children under 13, without our prior written approval and without complying with applicable child-privacy laws, including notice, consent, minimization, security, access, and deletion obligations.

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own notices, not this Policy. Review those notices before connecting an account or providing data. A Customer website that embeds Conecto remains responsible for its own privacy practices and notices.

We may update this Policy to reflect changes to the Service, law, providers, or our practices. We will post the updated version and revise the “Last updated” date. If a change materially affects how we use personal data, we will provide additional notice through the Service, by email, or by another appropriate method before the change takes effect where required.

CherryWave LLC is responsible for this Policy. To exercise a privacy right, ask a question, request transfer-safeguard information, or make a complaint, use our contact form and identify the request as privacy-related. You may also contact us by post:

If you are in the EEA, United Kingdom, or Switzerland, you may lodge a complaint with your local data protection authority. If your request concerns Customer Data, include the name of the Customer or website through which you interacted so we can route the request appropriately.