Mentions légales

Chat on Page Privacy Policy

Version 1.5 · 1 November 2026

Ce document existe en anglais et en néerlandais. Ci-dessous se trouve la version anglaise ; celle-ci s’applique aux clients en dehors de la Belgique et des Pays-Bas. Version néerlandaise

1. Who we are

Chat on Page is a service of Gintronics BV, Tategemstraat 22, 8790 Waregem, Belgium, company number and VAT BE 0554.684.305 ("we", "us"). For questions about privacy or to exercise your rights, contact us at info@gintronics.com. We have not appointed a data protection officer.

This policy exists in Dutch and English. For people in Belgium and the Netherlands the Dutch version prevails, for everyone else the English version.

2. Our role: controller or processor

We process personal data in two different roles:

• As controller for visitors of chatonpage.com, for people who contact us or request a trial, and for our customers and their users (account, billing, use of the portal, the agent app, the API and the MCP server). This policy describes that processing.
• As processor for the conversations in the chat widget on our customers' websites. The company that offers the chat on its website is the controller for those conversations and for the contact details visitors leave there; we process them only on its behalf and according to its instructions, under our Data Processing Agreement. If you chatted on a company's website, read that company's privacy policy and contact it to exercise your rights (see article 10).
• As processor also for the support correspondence a customer has imported for Field knowledge, from a connected mailbox (Gmail, Google Workspace, Microsoft 365, Outlook.com or IMAP), a help desk (Zoho Desk, Zendesk, Freshdesk, Trengo or Gorgias) or a file. See article 11.

3. What we process, why and on what basis

We do not use your personal data for automated decision-making with legal or similarly significant effects. We do not sell personal data.

4. Who receives data

We use the following service providers (processors). They only receive the data they need for their task.

Google Ads and Meta (Facebook, Instagram) receive data via cookies and conversion messages only after your consent; they act as independent controllers for their own purposes. See the cookie policy.

If a customer works with a partner (a web agency), that partner can view the customer's account, including conversations, within the limits of the partner terms. We may also disclose data if required by law or a court order, or to defend our rights.

5. International transfers

We store all data of the Service in the European Union. Google and Meta (marketing cookies, with consent) and the delivery of push notifications by Google and Apple may involve transfers to the United States; these take place under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. If you use the Service from outside the EU, for example from the United States, your data is transferred to and stored in the EU.

6. How long we keep data

• Server logs: 14 days.
• Account data: as long as your account exists, and up to 90 days after the end of the contract.
• Invoices and accounting records: for the period required by law (currently 10 years in Belgium).
• Activity log: 60 days.
• Marketing cookies: see the cookie policy; your consent choice is remembered for 6 months.
• Conversations in the demo chat on chatonpage.com: anonymised after 90 days.
• Voice messages in the chat are only converted into text and are not stored.
• Field knowledge: imported support correspondence and uploaded files at most 7 days; the general question and answer until the customer deletes the article or the contract ends; the code per conversation until the end of the contract (see article 11).

7. Security

We take appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), strict separation of the data of different customers, passwords and API keys stored only as hashes, optional two-step verification, limits and blocks against abuse, an activity log and automatic anonymisation of conversations. No system is completely secure; if a data breach occurs that poses a risk to you, we will inform you and the supervisory authority as required by law.

8. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to object to processing based on legitimate interest, to receive your data in a portable format, and to withdraw your consent at any time (without affecting earlier processing). Send your request to info@gintronics.com; we may ask you to confirm your identity and will answer within one month.

You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, or with the supervisory authority in your country.

9. Additional information for residents of the United States

Depending on the state where you live (for example California under the CCPA/CPRA, or Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to know which personal information we collect and how we use and disclose it, to access, correct or delete it, and to opt out of the sale of personal information, of sharing for cross-context behavioural advertising and of targeted advertising. To the extent these laws apply to us:

• The categories of personal information we collect, their sources, purposes and recipients are described in articles 3 and 4: identifiers and contact details, commercial information (subscriptions and payments), internet activity on our website and in the portal, and the content of your communications with us.
• We do not sell personal information and do not share it for cross-context behavioural advertising. Advertising cookies of Google and Meta load on chatonpage.com only if you accept them in the cookie banner; you can refuse or withdraw this at any time via Cookie settings at the bottom of every page.
• We do not use sensitive personal information for purposes other than providing the Service, and we do not knowingly collect personal information of children under 16.
• You can exercise your rights by email to info@gintronics.com, also through an authorised agent. We verify your request with the information we already have, and we will not discriminate against you for exercising your rights.

10. Visitors of our customers' websites

When you use the chat on the website of one of our customers, that company determines why and how your conversation is processed. In short, and depending on that company's settings:

• The widget stores a random code in your browser so that your conversation continues on other pages; it does not use tracking cookies (see the cookie policy).
• Your messages are processed by AI (Mistral AI, in the EU) to generate answers from the company's own website and documents. If you use voice, your recording is only converted into text and not stored.
• The chat asks for your name, email address or phone number when you want to be contacted by a staff member or receive a copy of the conversation by email, or in a form the company has added to its chat. Giving these details is always your choice.
• Conversations are stored in the company's account and automatically anonymised after the retention period the company has chosen (between 30 days and 1 year). Contact details you left as a request for contact remain available to the company until they are deleted at its request or at the end of its contract with us.

To exercise your rights regarding a conversation, contact the company on whose website you chatted. If you contact us, we will forward your request to that company and assist it.

11. Connected mailboxes and help desks (Field knowledge)

A customer can connect its support mailbox or help desk so that Chat on Page turns answered customer questions into general articles for its chatbot and help centre. The following applies:

• Read-only. For Gmail and Google Workspace we only request permission to read emails (gmail.readonly). For Microsoft 365 and Outlook.com we request Mail.Read to read emails (and Mail.Read.Shared for a shared mailbox), User.Read to know the account's email address and offline_access to read new emails every day. With these permissions Chat on Page cannot send, change, move or delete emails. For an IMAP connection Chat on Page signs in with the username and password the customer provides; there too Chat on Page only reads and does not change emails, folders or read status.
• What we read. For emails since the date the customer chooses: headers (sender, recipients, subject, date and references to earlier messages) and the text. For Gmail and Microsoft 365 we do not download attachments; for IMAP the full message is fetched, but only the text is read and attachments are not stored. We skip newsletters, automated messages and addresses the customer excludes. For a help desk we read the resolved tickets (solved or closed) changed since that date, with their public messages and the name and email address of the senders; we do not read internal notes.
• What we keep. Per connection: the email address or username of the account, for IMAP the server, for Zoho Desk the organisation and departments, for Zendesk, Freshdesk and Gorgias the address of the help desk, for Zendesk and Gorgias also the email address of the account, the support and excluded addresses the customer provides, and, encrypted, the password (IMAP), the refresh token (Gmail, Microsoft, Zoho) or the API key (Zendesk, Freshdesk, Trengo, Gorgias). Imported conversations are stored encrypted until they are processed and then deleted, in any case within 7 days. An uploaded file is deleted as soon as it has been read or reading it fails, and in any case within 7 days. After that only the question and answer in general terms remain, without names, email addresses, phone numbers, order or customer numbers and links to personal documents, together with an irreversible code per conversation with its date, language and the reason it was not used, if any, so the same conversation is not imported twice.
• Who receives the data. Mistral AI (France, EU) writes the summary, as a processor. We do not sell the data, do not use it for advertising and do not use it to develop, improve or train generalised AI models. Mistral AI processes the data only for this feature (writing the summary and making the articles searchable) and not to train its AI models. We do not transfer data received from Google APIs (Gmail) to any other AI service. Chat on Page staff do not read it, except with the customer's permission for a specific request, to investigate abuse or a security issue, or where required by law.
• Disconnecting. The customer can disconnect at any time in the portal. We then delete the access credentials, stop an import that is still running (what it has already read is deleted) and revoke the permission at Google (unless the same Google account is still connected for another chatbot). You can also remove Chat on Page's access yourself in your Google, Microsoft or Zoho account settings, change your password for IMAP, or revoke or renew the API key in Zendesk, Freshdesk, Trengo or Gorgias.
• Google API Services User Data Policy. Chat on Page's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Children

Chat on Page is intended for businesses and is not directed at children. We do not knowingly process personal data of children under 16 as controller.

13. Changes

We may update this policy. The version and date at the top show when it was last changed. We will inform customers of material changes by email or in the portal.