Privacy Policy

Who is responsible

The controller of your personal data in all Chakloon services is Haydamax OÜ, registry code 17351554, Narva mnt 5, 10117 Tallinn, Estonia (we, us). For data protection questions write to privacy@chakloon.com. Where we process data on behalf of someone else, this is said below, in the section on Sign in with Chakloon in other applications.

This policy covers every service of the Chakloon package. Some services add their own details in their own rules, for example Zori Terms and Research Consent and Chacki AI Terms.

What data we process

Account

For your Chakloon Passport account: @handle, display name, e-mail address, date of birth (to check the minimum age), a password stored only as a hash, the services you use and your settings. If you sign in with Google, GitHub, Telegram, Discord, Facebook or W3ID, we receive from that provider your account identifier there, your name, your e-mail address if the provider gives it, and your avatar. The provider learns that you signed in to Chakloon.

Content you publish

On the social network and in Chak: posts, comments, likes, profile information, photos and other files, who you follow and who follows you, profile pages, short links and their click statistics. Public content can be seen by anyone who opens it.

For every click on a Chak link we store the time, the country, the device and browser, the referring domain, the full User-Agent string, the full Referer and a mark whether the click came from a bot. Our own geo service derives the country code from the IP address; the IP address itself is not stored with the click. The owner of the link sees only aggregated statistics, and we do not count unique visitors.

Messages in Chakloon Chat

Messages, photos, video, voice and video messages, files and locations you choose to send, the conversations they belong to and who takes part in them, read and typing marks, and, if you allow notifications, a push token of your device. Chakloon Chat is not end-to-end encrypted: messages are stored on our servers so that they reach all your devices, like cloud chats in other messengers. Access on our side is limited to the people who run the service and handle reports.

Search, News and Weather

The search queries you enter in Chakloon Net, the stories you open in Chakloon News and the cities you look up in Chakloon Weather, so that we can show you results. They appear in our server logs. We do not build a profile of your searches.

Web pages in search and news

To run the search engine, our crawler ChakloonBot reads publicly accessible web pages whose robots.txt allows it, and we keep their text, a text snapshot and their links. Chakloon News keeps the headline, the link and a short excerpt of stories from the feeds of publishers. These pages may contain personal data of the people they mention. We receive such data from the public websites, not from the people themselves.

Zori

Your date, time and place of birth, the forecasts made for you, the marks in your blind diary, your scores and the birth data of other people you enter to check compatibility. A mark for the health sphere is data about your health: Zori saves it only with your explicit consent. Your days go into the common result of the research study only with your separate consent. Details are in Zori Terms and Research Consent.

Chacki

Your conversations with Chacki, including those you have deleted from your list, which are hidden from you but kept, the files you attach to them, the image prompts you write, the images generated for you, which are kept in our media storage, and your daily usage against the limits.

In version 0.2 Chacki keeps a memory about you: up to 40 facts of up to 300 characters each, which the model writes down during the conversation, with newer facts pushing out older ones. Chacki also keeps a snapshot of your Chakloon Passport profile, refreshed every 6 hours, and the state of its mood in conversations with you, and for version 0.1 a profile with your name, city and interests. All this is stored in our database on our servers in the EU. The command forget me erases the memory and the profile of version 0.1; Chacki recognises it only in English, Ukrainian or Russian phrasing. Version 0.1 passes nothing to external processors.

Business services

For Chakloon Ads, Chakloon Console, Chakloon Platform, Chakloon Sign, Chakloon Papers and Chakloon Legal: your business details, campaigns and banners, the domains you add and how you proved them, API keys and usage counts, documents sent for signature together with the signers' names, e-mail addresses and the audit trail, file hashes and receipts, and the answers you give to build a legal document.

The registry of Chakloon Papers is public. For each record anyone can see the record number and time, the title of the work, your display name in Chakloon Passport as the name of the applicant, the name, type and size of the file, its hash, the text of the statement and the hash of the receipt. Your e-mail address, @handle, account identifier and IP address are stored with the record but never shown. Records are permanent, see Chakloon Papers Terms.

For the consent log that the Chakloon Legal widget keeps for a website, the owner of that website is the controller and we act as its processor, see Chakloon Legal Terms.

Payments

When you pay, the payment itself is handled by Stripe on its own payment page. Your card number never reaches us. We receive the payment status, the amount, the date and the information needed for the invoice, and we keep your Kassero balance and its movements.

Server logs

IP address, the request, the time and the browser or app version, for security and to keep the services running. When a page shows an ad of Chakloon Ads, our server also uses a hash of the IP address and user-agent of the request to limit how often the same ad is shown.

Audience measurement

Our own installation of Umami counts page views. It sets no cookies and does not store IP addresses.

Purposes and legal bases

• To provide the services you asked for and to run your account, including sign-in through a provider you chose, push notifications you allowed, Zori forecasts and diary, Chacki answers and the publication of your records in the public registry of Chakloon Papers, which you choose when you make a record: performance of the contract (Article 6(1)(b) GDPR).
• To save Zori health marks and to include your days in the Zori research study: your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), two separate consents. You can withdraw each of them at any time, as easily as you gave it; this does not affect processing before the withdrawal.
• To keep the services secure, to keep server logs, to find spam and abuse, to handle reports, to enforce our terms and to establish or defend legal claims: our legitimate interests (Article 6(1)(f) GDPR), namely the interest of us and of all users in services that are safe and free from abuse.
• To measure audience in aggregate with Umami: our legitimate interest in knowing which pages are used, so that we can improve them, without identifying anyone (Article 6(1)(f) GDPR).
• To improve Chacki with conversations, including those you have deleted from your list: our legitimate interest in an assistant that answers better and more safely (Article 6(1)(f) GDPR). You can object to this at any time at privacy@chakloon.com.
• To record clicks on Chak links, show their owners aggregated statistics and recognise clicks by bots: the legitimate interest of link owners in knowing how their links are used and our interest in protecting the service from abuse (Article 6(1)(f) GDPR).
• To limit how often the same ad of Chakloon Ads is shown: the legitimate interest of us, of advertisers and of readers in ads that do not repeat too often, using only a hash of the IP address and user-agent of the request (Article 6(1)(f) GDPR).
• To run the search index of Chakloon Net and the story pages of Chakloon News: the legitimate interest of internet users in finding information and our interest in offering a search engine and a news service (Article 6(1)(f) GDPR).
• To calculate compatibility in Zori with the birth data of another person you enter: your legitimate interest and ours in the calculation you asked for (Article 6(1)(f) GDPR).
• To report child sexual abuse material to NCMEC: the legitimate interest in protecting children (Article 6(1)(f) GDPR); where the law requires a report to the authorities, a legal obligation.
• To keep accounting records, to answer lawful orders of authorities, to handle notices of illegal content and to inform the authorities of threats to life or safety under the Digital Services Act: legal obligations (Article 6(1)(c) GDPR).
• To send you notices about your account and material changes to our terms: performance of the contract.

Do you have to give us data

To open a Chakloon Passport account you must give the data the registration form marks as required, such as an e-mail address, a handle, a date of birth and a password, or use a sign-in provider. Without them we cannot open the account, because we need them to provide the services and to check the minimum age. No law obliges you to give them. Everything else, such as profile details, Zori birth data or files, you give voluntarily; without it only the function concerned does not work.

Processors and recipients

Recipient	Role	What they receive	Where
Hetzner Online GmbH	Processor: servers and object storage	All data stored in the services	Germany and Finland
Our own mail server	Run by us	E-mails sent to and from our addresses	Our own servers
Umami, installed by us	Run by us	Page views without cookies and without IP	Our own servers
Stripe	Independent controller for the payment	Card and payment data you enter on Stripe's page	See Stripe's privacy policy
Anthropic PBC	Processor: Chacki text answers in version 0.2	Text of the Chacki conversation and its attached files	USA
OpenAI	Processor: Chacki image generation	The image prompt	USA
Google (Firebase Cloud Messaging)	Processor: Chat push notifications	Sender name, notification text, conversation identifier	Google's infrastructure, also outside the EEA
Google, GitHub, Telegram, Discord, Meta (Facebook), W3ID	Independent controllers, only if you choose that sign-in	The fact that you signed in to Chakloon	See the provider's privacy policy
Applications of other developers	Independent controllers, only if you sign in to them with Chakloon	The data you allow the application to receive	Where the developer is
NCMEC (National Center for Missing & Exploited Children)	Recipient of reports of child sexual abuse material	The material and the account data needed for the report	USA
Authorities	Recipients where the law requires it	Data named in a lawful order	Competent country

People you write to in Chakloon Chat receive your messages, and readers of public content see what you made public. We do not give personal data to anyone else.

Sign in with Chakloon in other applications

When you sign in to an application of another developer with Chakloon, we have two roles. For your Chakloon Passport account we remain the controller under this policy. For the sign-in that we carry out for the developer and the result we pass to its application, we act as the developer's processor under Article 28 GDPR, as set out in the API Terms. What the application does with the data it receives is the developer's responsibility as controller, and the developer's own privacy policy applies to it.

International transfers

Our servers are in the European Union, in Germany and Finland. Data leaves the European Economic Area only in these cases: to Anthropic PBC and OpenAI in the USA for Chacki, to Google for Chat push notifications, to NCMEC in the USA for reports of child sexual abuse material, and to an authority outside the EEA where the law allows it.

Transfers to Anthropic, OpenAI and Google rely on the Standard Contractual Clauses approved by the European Commission or another transfer mechanism under Chapter V GDPR, as part of their data processing terms. Reports to NCMEC rely on Article 49(1)(d) GDPR, important reasons of public interest in the protection of children. You can ask for information about these safeguards and a copy of them at privacy@chakloon.com.

Our accounts with Anthropic and OpenAI are API accounts. We do not allow them to use your data to train their models, and data sent through their APIs is not used for training by default.

Retention

• Account data: as long as the account exists.
• Content and messages: until you or, for a shared conversation, the other participants delete them, or until the account is deleted.
• Zori data: until you delete it in Zori or delete your account. Health marks are deleted as soon as you withdraw the consent for them, and your days stop counting in the study as soon as you withdraw the consent to the study.
• Chacki conversations, including those you have deleted from your list, and the memory of Chacki: until you ask us to erase them at privacy@chakloon.com or delete your Chakloon Passport account, which erases everything in Chacki. Facts in the memory can also be pushed out by newer ones or erased with the command forget me.
• Data of business services: as long as you keep it in the service or the account exists; records in Chakloon Papers are permanent, as explained in the Chakloon Papers Terms; the consent log of Chakloon Legal is kept while the website is in its owner's cabinet, for as long as the owner decides; invoices and payment records as below.
• Server logs: 30 days. Technical logs of Chakloon Chat: 14 days.
• Data for the frequency limits of Chakloon Ads: only as long as needed for these limits.
• Reports about content or people: up to 12 months, so that repeat infringers can be recognised.
• Payment records: 7 years, as accounting law requires.
• Pages in the search index: as long as the page is publicly available and open to our crawler.
• Data connected to a report of child sexual abuse material to the authorities: as long as the authorities require.

Where no period is named, we keep data only as long as the purpose for which we collected it requires. Data needed to establish or defend legal claims, or that an authority has ordered us to preserve, is kept as long as that requires.

When you delete your account, messages you have already sent to other people stay in their conversations, the same way a letter stays with the person who received it.

Your rights

You have the right to access your data and receive a copy (Article 15 GDPR), to have it corrected (Article 16), to have it erased (Article 17), to restrict its processing (Article 18), to receive it in a portable format (Article 20), to object to processing based on our legitimate interests (Article 21, see the next section), to withdraw consent (Article 7(3)) and not to be subject to a decision based solely on automated processing (Article 22).

You can delete your Chakloon Chat account in the app: side menu, Delete account. You can delete your Chakloon Passport account in all services at once, and download a copy of its data, in your account at pass.chakloon.com where this is available, or by writing to privacy@chakloon.com from the e-mail address of your account. In Zori you can download and delete your Zori data yourself under My data. We answer requests within one month. More is in Your data: access, export, deletion.

Your right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on our legitimate interests (Article 6(1)(f) GDPR), for example in the search index of Chakloon Net, in audience measurement or in the use of Chacki conversations to improve Chacki. We then stop the processing, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish or defend legal claims (Article 21(1) GDPR). In this way a person mentioned on a web page can also ask us to remove a result from Chakloon Net. Write to privacy@chakloon.com and give the link concerned.

Supervisory authority

If you think we process your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, https://www.aki.ee, or to the data protection authority of the country where you live or work. We would be glad if you wrote to us first.

Security and data breaches

We protect personal data with technical and organisational measures that fit the risk, for example encrypted connections, passwords stored only as hashes and access limited to the people who need it for their work. If a personal data breach occurs, we notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people (Article 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we also tell you without undue delay what happened and what you can do (Article 34 GDPR).

Data protection officer

We have not appointed a data protection officer. The law requires one where the core activities of a company consist of regular and systematic monitoring of people on a large scale or of large-scale processing of special categories of data (Article 37(1) GDPR). Our services do not monitor people in this way, and special categories of data are processed only in Zori, with explicit consent and not on a large scale. The management board of Haydamax OÜ is responsible for data protection; write to privacy@chakloon.com.

What we do not do

• We do not sell personal data.
• We do not build advertising profiles. Ads in Chakloon Ads are targeted only by the languages set in the visitor's browser, without tracking. The ad widget stores nothing on your device and sends no identifier of you.
• We do not use tracking cookies or third-party analytics.

Automated decisions

We do not take decisions with legal or similarly significant effect about you by automated means only. Automated tools help us find spam and abuse and sort reports, and decisions to restrict content or accounts are taken by a person. The exception is the automatic check of Chak links: a link to a known dangerous address may be refused, opened only through a warning page or blocked without a review by a person. You can appeal such a decision, and a person then reviews it, see Chak Acceptable Use Policy.

Children

The services are for people aged 16 or over, and Chakloon Chat for people aged 18 or over. We ask for the date of birth at registration, we do not knowingly process data of people below these ages, and we close their accounts when we find them. See Minimum age and Child Safety Standards.

Changes

If this policy changes in a way that matters, we tell you in the services or by e-mail before the change takes effect. The version and date at the top of this page show the current text.

Contact

Data protection: privacy@chakloon.com. Other matters: see Contact.