01Information processed
Hoplon processes subscriber account details (names, business details, email addresses, team members), workspace content (knowledge, products, scripts, approved documents), chatbot conversations, details visitors choose to share (such as name, email or phone), leads, bookings, banking requests, usage records, invoices and security logs.
02Visitor technical details
When a visitor chats, Hoplon records the visitor’s IP address, approximate country (provided by our network provider, Cloudflare), the page they are chatting from, browser type and language. These details help businesses understand where enquiries come from and help us prevent abuse. The widget stores a session identifier in the visitor’s browser storage so the conversation continues across pages; it does not set advertising cookies.
03Why it is used
Data is used to answer visitors, run lead, booking and request workflows, measure plan usage, send service emails, protect the service against abuse and support billing. We do not sell personal data.
04Sensitive and banking data
Card numbers, PINs, OTPs, IBANs and identity numbers typed into chat are masked before anything is stored. In banking mode, identity-check answers and phone numbers are stored only as one-way hashes and replies come only from content the bank has approved.
05Service providers
To run the service we use hosting, Cloudflare (network security and country lookup), the AI providers configured by the platform owner (which receive the relevant conversation context to produce an answer) and an email delivery provider. They process data only to provide their service to us.
06Retention and exports
Conversations and related records are kept for the retention period set for each workspace and then removed automatically. Subscribers can download a portable JSON export at any time from Privacy & retention.
07Security
Hoplon uses HTTPS, access controls, tenant isolation, CSRF protection, secure sessions, prepared database statements, encrypted credentials, audit logs and restrictive browser-security headers.
08Your rights
Visitors should first contact the business whose website they used, because that business decides how its chatbot data is used. Subscribers and visitors can also ask us to access, correct or delete personal data through the contact page; we answer within a reasonable time and as the applicable law requires.