What this policy covers
- Our website, chaidojo.com, and the demos we set up for organisations considering Chaidojo.
- Our sales contact with people at organisations that may be interested in Chaidojo, including calls and emails.
- The Chaidojo platform, which runs on your organisation's own infrastructure (its own cloud account or its own servers), unless we host it for your organisation.
- Connections to other services that an authorised user of your organisation sets up, such as Amazon, Google, Meta, Shopify, Flipkart or Unicommerce.
Our role. For information about website visitors, people who try our demos, prospects we contact, and the people we work with at client organisations, Chaidojo is the controller. We decide how and why that information is used, and this policy applies to it in full.
For content and data inside your organisation's Chaidojo deployment, your organisation is the controller. Where we handle that data, for example when we support your deployment or host it for your organisation, we act as your organisation's processor. We act only on its instructions and under the data processing terms in our master services agreement with it. Your organisation's own privacy policy governs that data, and questions about it should go to your organisation first.
When your organisation uses Chaidojo, the platform, the data it brings and its AI processing all stay on your organisation's own infrastructure, unless we host it for your organisation. On request, Chaidojo hosts the platform and supplies the AI models in Chaidojo's account with Amazon Web Services in the US, with a separate environment for each organisation it hosts. That data belongs to your organisation, and your organisation controls it. We work with it only to set up, support and maintain the platform, on your organisation's instructions.
Information we collect
When you visit our website. The website does not use analytics, advertising or tracking cookies. Our hosting provider may record standard technical information, such as your IP address, browser type and the pages requested, to keep the site secure and working. If you book a demo, the booking is handled by Google Calendar, and you give your name and email to schedule the call. If you email us, we receive what you send.
When you try a Chaidojo demo. If we set up a demo for you, we hold your name and email to sign you in. We record how you use the demo, such as the parts you open, the questions you ask and any feedback you leave, so our team can follow up. Any files you add to a demo are held in the demo environment. Demos run on our Amazon Web Services account in the US, and questions you ask are processed by AI models as described in section 6.
When we speak with you. If you join a call with us, we may record and transcribe it using a call recording service, so we can keep accurate notes and follow up. We tell you at the start of the call, and you can ask us not to record it.
When we contact you about Chaidojo. We look for people at organisations that may benefit from Chaidojo. We collect business contact details from public sources, such as company websites and LinkedIn, and from business contact data providers. These details are your name, job title, employer, work email and professional profile. We keep a record of our emails with you in our email and sales outreach tools.
When your organisation uses Chaidojo. For each user, your organisation's deployment holds a name, work email address, organisation and role. It also holds sign-in and security records (when and how you signed in) and records of the changes users make in Chaidojo's apps. We hold the names, contact details and billing records of the people we work with at your organisation.
Content your organisation brings. Files, documents, datasets, messages and instructions that your users upload or create, and the reports and documents Chaidojo produces from them. These stay in your organisation's deployment.
Data from connected services. When an authorised user of your organisation connects a service, your organisation's deployment receives the data that connection is set up to read. Examples: sales, traffic and advertising reports from Amazon; website visits from Google Analytics; ad results from Meta or Google Ads; orders from Shopify, Flipkart or Unicommerce; emails or files from Google Workspace or Microsoft 365 when your organisation chooses that. We ask each service only for the access the reports need, and read-only access wherever the service offers it.
Your organisation's deployment does not send usage information, content or connected-service data back to Chaidojo.
How we use information
We use information to:
- provide the platform: run your workflows and reports, and show the results to the people your organisation allows;
- keep it secure: authenticate users, prevent misuse, and investigate problems;
- support you, and tell you about changes to the service;
- follow up with you about a demo you have tried;
- contact you about Chaidojo if you work at an organisation we think may benefit from it, and keep a record of our conversations;
- record and transcribe calls, with notice, to keep accurate notes;
- meet our legal obligations.
We do not sell personal information, use it for advertising, or build profiles of individuals for marketing. We do not use your organisation's content or connected-service data to train AI models. We do not make decisions about anyone that are based solely on automated processing and have legal or similarly significant effects.
If you are in the UK or the European Union, these are the legal bases we rely on:
| Purpose | Legal basis |
|---|---|
| Providing, securing and supporting the platform for a client | Performing our agreement with your organisation; our legitimate interest in running a secure service |
| Demo sign-in, usage records and follow-up | Our legitimate interest in showing and improving Chaidojo and following up with interested organisations |
| Business-to-business sales emails and prospect records | Our legitimate interest in telling organisations about Chaidojo; your consent where the law requires it |
| Recording and transcribing calls | Our legitimate interest in keeping accurate records; you can ask us not to record |
| Billing, tax and accounting records | Complying with the law |
| Responding to authorities and legal claims | Complying with the law; our legitimate interest in protecting our rights |
Marketing choices. Every sales email we send has an unsubscribe link. You can also write to us to stop our emails. We will then stop contacting you, keeping only what we need to remember your choice.
Data from Amazon, Google and other platforms
When a business authorises Chaidojo to access its account on another platform (for example through Login with Amazon, or Google's or Meta's consent screens):
- the data goes into that business's own Chaidojo deployment, on its own infrastructure, unless we host it for that business;
- we use that data only to provide the reports and features that business asked for;
- we do not sell it, share it with other customers, or use it to advertise to anyone;
- we access it only through the platform's official API and within the permissions the business granted;
- the business can withdraw access at any time, from that platform's own settings or by asking us. Chaidojo then stops reading it. Copies in the business's deployment are deleted as the business instructs. Any copies Chaidojo itself holds, for example in a demo, are deleted within 30 days unless the business asks us to keep its reports;
- if we become aware of a security incident affecting that data, we tell the business and the platform promptly, as the platform's terms require;
- we follow each platform's developer terms, including the Amazon Ads and Selling Partner data protection policies.
Chaidojo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Our staff do not read Google user data unless the business asks us to for support, it is needed for security or to comply with the law, or the data has been aggregated and anonymised.
Personal data inside your organisation's data
Business data often contains personal details, such as customers' phone numbers or employees' names. Chaidojo is built to keep these to the minimum a report needs. Where a report needs only counts, phone numbers and email addresses are replaced by coded values as they arrive, and the original values are not stored. Reports show totals and rates, not lists of people, unless your organisation decides otherwise. Coded values can still count as personal data in law, and we protect them in the same way.
AI processing
Some features use large language models to read your organisation's content and write text, such as reports, summaries, letters and explanations.
This happens through the AI service your organisation chooses, in the location it chooses. Content goes from your organisation's deployment directly to that service and does not pass through Chaidojo's systems, unless we host it for your organisation.
If we host Chaidojo for your organisation, content is sent to AI models through Chaidojo's account with Amazon Web Services in the US, and we act as your organisation's processor for it. Amazon Web Services keeps neither the content nor the responses, and the content is not used for training.
Our demos use AI models through Chaidojo's account with Amazon Web Services in the US. Amazon Web Services does not keep the content or the responses. We keep only the record of the questions you ask, as section 2 explains.
The models process content only to return a response. We do not use your content to train AI models. Your organisation's agreement with its AI service governs how that service handles content. For our demos, and for organisations we host, Amazon Web Services does not use content to train models or share it with the companies that develop them. Organisations can choose to send only coded identifiers in place of personal names, and to fill the names back in on their own infrastructure.
Where information is stored, and transfers abroad
Your organisation's deployment, the data in it and its AI processing are on your organisation's own infrastructure, in the region it chooses, unless we host it for your organisation. Deployments we host, our website and our demos, including the AI models they use, run on Amazon Web Services in the US. Some of our other providers are also in the US, or in the EU.
When personal data leaves the UK, we protect it in one of these ways:
- the receiving country has UK adequacy regulations, such as EU and EEA countries, or the receiving US company is certified under the UK Extension to the EU-US Data Privacy Framework; or
- we use the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
When personal data from the EU leaves the European Economic Area, we rely on EU adequacy decisions, including the EU-US Data Privacy Framework, or on the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards.
Some of our team, including people who support client deployments, work from India. When they access personal data, including client data with that organisation's permission, they follow the same security controls and confidentiality duties as our UK team. Where a team member in India is not employed by Chaidojo Limited, we protect the data with the UK International Data Transfer Agreement, and with the EU Standard Contractual Clauses for data from the EU.
How long we keep information
- Information in your organisation's deployment, including its content, connected-service data, user accounts and sign-in records: for as long as your organisation decides. When our agreement ends, our access ends, and we help your organisation return or delete data as the agreement says.
- Data in a deployment we host for your organisation: deleted within 90 days after our agreement ends, unless your organisation asks for it back first.
- Contact details we hold for your organisation: while our agreement lasts, and up to 90 days after it ends.
- Contracts, invoices and financial records: 6 years after the end of the financial year they relate to, as UK tax and company law requires.
- Demo activity: up to 12 months after the demo ends.
- Sales records about prospects: up to 24 months after our last contact, unless your organisation becomes a client. If you opt out, we keep your email address on a suppression list so we do not contact you again.
- Call recordings: up to 90 days after the call. Transcripts and call notes: up to 12 months after the call, or for as long as our agreement with your organisation lasts if it becomes a client.
- Website enquiries: as long as needed to answer them, and no more than 24 months.
- Security and access logs for our own systems: up to 12 months.
- Deleted information may remain in our backups for up to 35 days until they are overwritten.
How we protect information
- All connections to Chaidojo are encrypted in transit (HTTPS).
- Our own systems encrypt information at rest, and deployments are set up to do the same.
- Each organisation's data stays on its own infrastructure, separate from every other organisation's, unless we host it for your organisation. Each organisation we host gets its own separate environment.
- Access is limited to the people and services that need it. Only members of Chaidojo's own team, employees and individual contractors bound by confidentiality, support client deployments, from the UK and India. No outside support company has access. Our team accesses an organisation's deployment only with its permission, to set up, support or maintain it.
- Keys for connected services are kept only on the deployment that uses them.
- Changes to settings and data in Chaidojo's apps are recorded against the person who made them.
No system is perfectly secure. If we become aware of a breach affecting your organisation's data, we will tell your organisation without undue delay. For information we control, we will also tell the Information Commissioner's Office within 72 hours where required. Where the law requires, we will tell affected people directly, as will be the case for anyone covered by India's Digital Personal Data Protection Act. We will also notify the Data Protection Board of India where that Act requires.
Your choices and rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you;
- correct it;
- ask us to delete it;
- object to or restrict some uses of it, or receive a copy to take elsewhere;
- withdraw a consent you gave;
- object at any time to our sales emails;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects;
- nominate someone to act for you;
- complain to a data protection authority: in the UK, the Information Commissioner's Office; in the EU, the authority where you live or work; in India, the Data Protection Board of India.
Chaidojo is a UK company, so UK data protection law (the UK GDPR and the Data Protection Act 2018) applies to the information we handle. If you are in the European Union, the GDPR also applies, and in India, the Digital Personal Data Protection Act, 2023.
If your information is part of an organisation's data in Chaidojo, please contact that organisation first: it decides how its data is used, and we will help it respond. For anything else, write to us using the details below. We do not charge for requests. We may ask you to confirm your identity before we act. We will reply within one month. If a request is complex, the law lets us take up to two more months; if we need to, we will tell you.
If you are in the United States. We do not sell personal information or share it for cross-context behavioural advertising. If you live in a state with a privacy law, you can ask to access, correct or delete your information by contacting us.
Children
Chaidojo is a service for businesses and is not intended for anyone under 18. We do not knowingly collect information about children.
Changes to this policy
We will post any change on this page and update the effective date. If a change is significant, we will tell your organisation's administrators before it takes effect. Earlier versions of this policy are available on request.
Contact us
- Email:
- contact@chaidojo.com
- Post:
- Chaidojo Limited, 51 The Stream, Ditton, Aylesford, Kent ME20 6AG, England
- Grievance Officer:
- Christian Chadwick, at the email and address above
- ICO registration number:
- ZC275585
The Grievance Officer answers questions and complaints about how we handle personal information, within the time the law allows.