Privacy Policy

This policy covers our website, the Chista customer application, our support channels, and related services. It does not cover third-party websites, social platforms, or services that you use or connect to, which have their own policies.

For account and business data — the information you give us to create and run your Chista account — we act as the business responsible for that data (a “controller”).

For personal information contained inside your uploaded content and campaign materials — for example, photos of people, customer lists, or testimonials you supply — we process it on your instructions as a service provider. You are responsible for collecting that information lawfully, providing any required notices, and obtaining any required consents or releases.

• Identifiers and account data — name, email address, authentication metadata (such as sign-in events and email verification status), and your Terms and Privacy consent with its timestamp.
• Business profile and Brand Brain data — business name and identity, industry, location, website and social links, audience, tone, products and services, goals, posting frequency, and preferred channels.
• Customer content and assets — logos, photos, videos, documents, captions, campaign briefs, and revision and approval records.
• Transaction and subscription metadata — plan, status, and, once payments are enabled, invoice and limited payment metadata received from our payment processor. We never receive or store full card numbers.
• Connected-platform metadata — connection status and publishing status when you authorize a platform. There are no live platform connections today, and access credentials for future connections will be held in dedicated secret storage, not in ordinary application tables.
• Device and usage data — IP address, browser and device information, pages and actions, timestamps, diagnostic information, and security logs.
• Communications — messages, support requests, and related correspondence.

We receive information directly from you and from the authorized users of your business account; automatically from your device and browser; from our service providers; and from connected platforms, only when you have authorized a connection.

• Provide, authenticate, personalize, and operate the service.
• Create, organize, revise, and manage your content and campaigns at your direction.
• Provide customer support and respond to your requests.
• Maintain security, prevent fraud and abuse, and diagnose problems.
• Handle billing and subscriptions once payment features are enabled.
• Publish content to platforms you have connected and authorized, after you approve it.
• Analyze usage and improve our products and features.
• Comply with legal obligations and enforce our Terms.
• Send service, account, and — where permitted — marketing communications.

AI generation is not enabled yet. Once it is, selected inputs and assets you submit — such as brand details, campaign briefs, and uploaded images — may be sent to contracted AI providers in order to generate the content you request.

Before that launch we will publish the specific providers and subprocessors involved and the contractual limits that apply to them, and update this policy accordingly.

Website chat assistant. The “Ask Chista” assistant on our public website sends the questions you type, together with the recent messages of that same conversation, to a contracted AI service provider so a reply can be generated. In this version Chista does not save those messages as a chat transcript in our database; the conversation is kept only in your browser for the current session and disappears when you clear it or close the tab. Limited technical request and security logs may still be created. Please do not submit sensitive information — payment details, passwords, health information, government identifiers, or other people’s personal information — in the chat.

We disclose information to:

• Infrastructure providers for hosting, database, file storage, and authentication.
• Development and hosting platforms used to build and run the service.
• Email and customer support vendors.
• Payment processors, once payment features are enabled.
• AI providers, once AI generation is enabled.
• Social platforms you connect and authorize, at your direction.
• Professional advisers such as accountants and lawyers.
• Legal authorities where required by law, legal process, or to protect rights and safety.
• An acquirer or successor in a merger, acquisition, financing, or sale of assets.

Where contractually available, we require service providers to use information only to provide services to us and to protect it appropriately.

We do not sell personal information, and we do not currently share personal information for cross-context behavioral advertising or targeted advertising. If that ever changes, we will update this policy and provide any required opt-out mechanisms before the practice begins.

We use cookies and browser local storage that are necessary for the service: keeping you signed in, protecting against abuse, remembering preferences, and diagnosing errors. These are always on because the service cannot work without them.

We also offer optional website analytics through Google Analytics 4 (measurement ID G-YQEKB4JEF7). The Google tag is not loaded and no analytics data is collected unless you explicitly choose “Allow analytics”. Your choice is stored in your browser’s local storage and applies to that browser only. Analytics measures public marketing pages only: your signed-in Chista workspace, the sign-in flow and administrative pages are excluded from measurement. IP anonymisation is enabled, and we do not send your name, email or business content to Google Analytics.

You can change your choice at any time using the Analytics preferences control in the site footer or on this page. Turning analytics off stops further measurement in that browser.

We keep information for as long as needed to provide the service and maintain your account, and afterwards as needed for legal, tax, security, and dispute-resolution purposes. When information is no longer needed, we delete or de-identify it, subject to routine backups and legal exceptions.

We use reasonable administrative, technical, and organizational safeguards, including encryption in transit, reputable infrastructure providers, and row-level access rules that scope records and uploaded files to the account that owns them.

No service can guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

• Edit your profile, business, and brand information in the app at any time.
• Opt out of marketing email using the unsubscribe link; transactional and account messages may continue.
• Disconnect any platform integration you have authorized.
• Delete uploaded assets and content from your workspace.
• Close your account or request deletion by writing to info@thechista.com.

Depending on where you live and whether a given law applies to us, you may have rights to access or know what we hold, correct it, delete it, obtain a portable copy, opt out of sale, sharing, or targeted advertising, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. Authorized agents may submit requests on your behalf, and some laws provide a right to appeal a denial.

These rights depend on your jurisdiction and on whether the relevant law applies to Chista. To make a request, email info@thechista.com. We may need to verify your identity before responding.

For California residents, the categories of personal information we may collect, the purposes for collecting them, and the categories of recipients are described in the sections above. We retain information according to the criteria described under Retention rather than a fixed schedule, and we do not sell or share personal information as those terms are used in California law.

Chista is pre-launch, so this notice describes current and planned practices rather than a twelve-month history, and we do not claim that the CCPA currently applies to Chista.

Information may be processed and stored in the United States and in other locations where our providers operate. If we begin serving jurisdictions that require additional transfer mechanisms, we will implement them before doing so.

Chista is a business service and is not directed to children under 18. We do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy. The effective date above shows when the current version took effect, and we will provide reasonable notice of material changes. This policy works together with our Terms of Service.

Chista LLC — info@thechista.com