Last revised: 14 October 2026

Privacy Policy

1. Introduction

ChatAndBuild Limited and/or our affiliates (“Company”, we”, “us” or “our) provide services branded as “ChatAndBuild”, “ChatChat”, “Abundant Intelligence”, “Living Brain” and such other products and services developed and/or operated by us from time to time on and through chatandbuild.com, chatchat.com and any other websites, applications, platforms and/or means and media (collectively “Platforms”, “Sites”, or “Services” as the context requires).

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Platforms. "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with and to you. It applies to all users of the Services and should be read together with our Terms of Service ("Terms"), which include additional information about how we handle your data and content.

For the avoidance of doubt, this Privacy Policy also applies to Living Brain and any related websites, applications, platforms, features and services operated or made available by us or our affiliates, unless a separate privacy notice expressly applies.

We are committed to protecting your data while enabling you to enjoy and benefit from our Services. Please read this Privacy Policy carefully. By accessing and using our Services, you agree to the collection and processing of your information as described in this Policy.

2. Information Collection

2.1 Sources of Personal Information

Your Personal Information is collected in several ways, including:

  • when you register for our Services, create a profile or account with us;
  • when you access and use our Services including the features and functionality thereof;
  • when you pay for our Services, including when you provide billing details or complete a transaction;
  • when you participate in the activities on our Services;
  • when you connect third-party accounts, authorize integrations, import or sync data, or direct an agent to interact with Connected Services on your behalf;
  • where identity verification is required, to provide the Services or comply with applicable law;
  • when you communicate with us, request support, or respond to surveys or similar communications;
  • We may also receive information from service providers, analytics providers, and from third-party services you choose to connect or authorize.

2.2 Types of Personal Information Collected

Depending on how you interact with the Services, we may collect the following information:

  • Personal identifiers such as your name, username, profile details, postal address, IP address, email address, or other similar information you chose to provide;
  • Content and activity data, such as messages, prompts, files, agent instructions, workflow configurations, outputs, collaboration activity, feature usage information, and related logs or debugging information;
  • Payment and billing information, including subscription status, transaction identifiers, billing email address, billing country, and other information relating to your subscription. Payment card information is processed by our third-party payment processor and is not stored by us;
  • Connected-service data and metadata from integrations you authorize, such as account identifiers, profile information, files, messages, calendar items, repository metadata, documents, or other content necessary to provide requested features and automations;
  • Account preferences and settings, including your general settings, feature configurations, connected applications, notification preferences, and other customization options you choose to manage;
  • Communications between you and us. When you communicate with us, we may collect and save a record of your communication and any Personal Information provided during the communication;
  • Usage data and automatically collected technical information such as traffic data, logs, and other communication data and the resources that you access and use on the Service;
  • Information about your computer and internet connection, including, but not limited to, the type of device you use, the IP address of your device, your operating system, the type of Internet browser you use, unique device identifiers and other diagnostic data;
  • Analytics and tracking data, collected through tools such as Google Analytics, to help us analyze website traffic and usage. For more details, please refer to Google's Privacy & Terms.

2.3 Use of Personal Information

We use the information we collect to:

  • Process your requests for and use of our Services;
  • Provide, maintain, and improve our Services;
  • Respond to your comments, questions, and requests;
  • Support our operations, including customer service, payment processing, and service-related communications;
  • Ensure platform security and stability, including detecting, preventing, and addressing technical issues, abuse, and fraud;
  • Conduct research and analysis for product development and improvements;
  • Send you technical notices, updates, security alerts, and administrative messages;
  • For such other purposes as set out in our Terms of Service.

3. Disclosure of Personal Information

Personal Information may be shared in the following circumstances:

3.1 Companies under common management

We may share your Personal Information with companies under common management with us (where applicable) where such sharing is necessary to provide the Services, comply with legal obligations, support our operations, or for other purposes described in this Privacy Policy.

3.2 Third-party Service Providers

We may disclose Personal Information to third-party service providers who use this information to perform services for us or perform specific processing activities on our behalf, such as hosting providers, AI service providers used to provide requested features, third-party integration providers, payment processors, security vendors, auditors, advisors, consultants, customer service and/or support providers and other similar service providers.

We currently engage third-party payment processors to process payments securely. Payment card information is collected and processed directly by the payment processor in accordance with its own privacy policy and applicable security standards. We receive only the limited payment information necessary to manage subscriptions, verify payments and comply with legal obligations.

3.3 Connected Services and Integrations

If you integrate third-party services or authorize an agent or workflow to use them, we may exchange and process data with those Connected Services as needed to provide the features, automations, and actions you request, subject to your permissions and the provider’s policies.

Depending on the integration, this may include:

  • Account and profile information (e.g., account ID, username, display name, profile metadata);
  • Content and metadata (e.g., media, captions, timestamps, URLs, and engagement data);
  • Interaction data (e.g., comments, replies, moderation status);
  • Analytics and insights (e.g., reach, engagement metrics, and performance data);
  • Authentication data (e.g., access tokens, authorization scopes, and token expiry).

We do not collect or receive your passwords for Connected Services. When you authorize an integration, we may receive and store authentication tokens, authorization metadata, and similar connection credentials necessary to maintain the connection and provide the features you request.

We use data from Connected Services solely to provide, secure, maintain, and support the features, automations, and actions you request, including to :

  • Authenticate and maintain your connection to the third-party service;
  • Display account, content, and analytics information within the Services;
  • Execute actions you request (e.g., publishing content, retrieving data, replying to or moderating comments);
  • Enable agent-based workflows and AI-assisted responses based on your authorized inputs, solely to provide the functionality you request.

We do not use data obtained from Connected Services for advertising targeting, cross-user profiling, or marketing campaigns. For clarity, data obtained from Google Workspace APIs is used only to provide or improve user-facing features that are requested by you within the Services, and not to train or improve generalized AI or ML models.

We process some integration data transiently (for example, when fulfilling a request), and we may store certain data as necessary to provide ongoing functionality.

Stored data may include:

  • Encrypted authentication credentials (e.g., access tokens);
  • Records of actions performed through the integration;
  • Chat history and agent workflow outputs generated from your authorized use.

3.4 Retention principles

We may retain your Personal Information and certain data as required to comply with legal obligations, resolve disputes, or enforce our agreements.

In connection with data from Connected Services and Integration:-

  • Integration credentials are retained while the connection is active;
  • Disconnecting a Connected Service will remove stored credentials associated with that integration;
  • Chat and workflow data are retained until deleted by you or in accordance with account-level deletion policies;
  • Operational logs are retained for a limited period (generally up to 30 days, unless otherwise required for security or legal purposes).

3.5 Advertising and Marketing Partners

We may share Personal Information with third parties that provide advertising, campaign measurement, online and/or mobile analytics, and related services. These third parties may receive or access browsing and/or other data about your use of the Services, in order to help us better reach individuals with relevant ads and/or measure our ad campaigns, and/or to better understand how individuals interact with our Services over time and across devices. Where required by applicable law, we will obtain your consent before sharing your Personal Information with advertising partners for targeting or tracking purposes. You may opt out of such sharing at any time by contacting us at the contact details in Clause 14 below or use the support options made available through the Services. We do not share Personal Information obtained from Connected Services with advertising partners for cross-context behavioral advertising, cross-user profiling, or third-party marketing campaigns.

3.6 Law Enforcement

Under certain circumstances, we may be required to disclose your Personal Information if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

3.7 Legal Requirements

We may disclose your Personal Information in good faith belief that such action is necessary to comply with a legal obligation, to protect and defend our rights and property, prevent or investigate possible wrongdoing in connection with the Service, or to protect against legal liability.

3.8 Business Transfers

We may disclose and/or transfer Personal Information as part of any actual or contemplated merger, sale, transfer of assets, acquisition, financing and/or restructuring of all or part of our business, bankruptcy or similar event, including related to due diligence conducted prior to such event, where permitted by law.

4. Cookies

We use cookies or similar technologies on our Services, including Living Brain where applicable for a variety of purposes, including to ensure that the Service functions work, as well as for analytics and advertising. Cookies can be used to recognize you when you visit our Sites, remember your preferences, and give you a personalized experience that's in line with your settings. Cookies also make your interactions with our Services faster and more secure. Please visit our Cookie Policy to understand why we use cookies, how it applies to you and how you can control the cookies you accept.

5. Your Rights

Subject to applicable law, you have the right to access your personal data, request the correction or deletion of your data, export your data, opt out of certain types of data processing, disconnect connected integrations (which will remove stored authentication credentials and stop further data collection from those services), and withdraw your consent at any time, where applicable. To exercise any of these rights, please contact us at the contact details in Clause 14 below or use the support options made available through the Services.

If you are located in the European Economic Area or United Kingdom, you additionally have the right to: (i) be informed of the specific lawful basis on which we process your personal data; (ii) object to processing carried out on the basis of our legitimate interests; (iii) restrict processing in certain circumstances; and (iv) lodge a complaint with your local data protection supervisory authority. The lawful bases on which we process personal data include: performance of a contract (to provide the Services to you), compliance with legal obligations, legitimate interests (including platform security, fraud prevention, and service improvement), and consent (where expressly obtained).

5.1 Data Deletion Requests and Connected Services

You may request deletion of your account or Personal Information by emailing us at the contact details in Clause 14 below or use the support options made available through the Services, with the subject line "Data Deletion Request" from the email associated with your account. Please state whether you want us to delete your entire account or only data obtained through a specific connected service, and include enough information for us to identify the relevant account or integration. Upon a verified request, we will delete or permanently de-identify, to the extent technically and legally feasible: (i) your account and profile information; (ii) data received from connected third-party services; (iii) prompts, generated content, and project files; (iv) usage history and interaction data attributable to your account; and (v) any other personal data we hold that is linked to you. We will respond to deletion requests within the time required by applicable law or, if no specific period applies, within a commercially reasonable period after identity verification. Where full deletion is not technically possible, we will explain the reason and confirm the steps taken.

If you connected a third-party account, you may also disconnect the integration within the relevant Services or Site and revoke the relevant Services or Site’s access from the third-party service directly. Revoking access stops future syncing, but does not by itself delete data already stored by us. To delete previously stored connected-service data, please submit a deletion request as described above. After we verify your request, we will delete or anonymize the requested data within a commercially reasonable period, except where we must retain certain information for legal compliance, security, fraud prevention, billing, backup, or dispute-resolution purposes. Data that has been fully anonymized and can no longer be associated with you is not subject to this deletion obligation.

Note on third-party platforms: We are responsible for deleting third-party data from our own systems only. The originating platform independently controls its own data. To request deletion from those platforms directly, please refer to their respective privacy settings or help centers. For users who have connected a Meta platform account (including Instagram or Facebook) to the Services, Meta may transmit automated data deletion requests to us via Meta’s Data Deletion Callback mechanism. We honour all such automated requests. To verify the status of a deletion request submitted through Meta’s platform, please contact us at the contact details in Clause 14 below or use the support options made available through the Services.with your registered email address or any reference code provided by Meta.

6. Security Measures

We implement industry-standard security measures to protect your Personal Information from unauthorized access, use, or disclosure. These measures include, but are not limited to, encrypted data transmission, secure data storage, access controls, regular security assessments and employee training.

7. Liability Protections

While we do our best to protect your Personal Information, we cannot guarantee the security of information you provide to us over the internet or similar connection as the internet is not a 100% secure medium, and communications over the internet may be subject to third-party interception. We also cannot guarantee that such information may not be accessed, disclosed, altered, or destroyed by breach of any of our technical or organisational safeguards and measures.

If you configure or deploy an AI Agent that makes decisions affecting other individuals (for example, your customers or end users), you, not the Company, act as the controller responsible for ensuring appropriate human oversight and honoring any automated-decision-making rights those individuals may have under applicable law, consistent with Clause 10.1 of our Terms of Service.

We cannot be held liable for any consequences resulting from users intentionally bypassing platform restrictions or protections to access private content. Users are solely responsible for maintaining the confidentiality of their account credentials and for all activities conducted under their account, whether authorized or not. We disclaim all liability for any loss, damage, or harm, whether direct or indirect arising from unauthorized access to user content. All warranty disclaimers and limitations of liability outlined in our Terms of Service apply to every aspect of our platform, including the privacy and security of user data.

8. Service Improvements and AI Training

We may use service usage data and data that has been aggregated or de-identified to maintain, analyze, and improve the Services and related AI features. We do not use Personal Information obtained from connected third-party services for advertising. Except where data is subject to specific legal, contractual, or policy restrictions, you may opt out of having your personal data used for AI model training at any time by contacting us at the contact details in Clause 14 below or use the support options made available through the Services. For comprehensive details regarding the types of data used for training, applicable exceptions for Enterprise customers, our data handling practices, and your rights related to data usage, please refer to our full Terms of Service.

Google Workspace API Data. Notwithstanding anything else in this Privacy Policy, we do not use any raw user data obtained through Google Workspace APIs, or any data derived from such data, including aggregated, anonymized, de-identified, transformed, or other derived data, to develop, improve, train, retrain, fine-tune, evaluate, or otherwise enhance generalized artificial intelligence or machine learning models. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Where you use Connected Services in conjunction with AI-powered features, data retrieved through those integrations may be processed by AI service providers to generate responses or perform requested tasks. This processing is performed solely to provide the functionality you request.

9. User Content Visibility

By default, the content you create or upload on the Services, including Living Brain where applicable, including messages, prompts, project files, agent instructions, workflow configurations and outputs, is private and accessible only to you, the collaborators you authorize, and authorized ChatAndBuild employees, contractors, or partners who require access to provide support, troubleshoot, or maintain platform functionality.

If we introduce community, publishing, or similar features that make content visible to others, we will provide controls that allow you to choose what you share. Unless you intentionally share or publish content through those features, private content will not be made visible to other users.

Private content will remain fully confidential and inaccessible to other users. Other users will not be able to view, access, or remix your private projects unless you choose to share them through collaboration, publishing, or other sharing features offered by the Services. You retain control over your project's visibility and can update your privacy settings at any time to ensure your work is shared only as you choose.

10. Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services. Please be advised to review the Privacy Policy of such third-party sites.

11. Children's Privacy

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us at the contact details in Clause 14 below or use the support options made available through the Services.

12. International Data Transfer

We may transfer your data internationally within our network of service providers. All such transfers are conducted in compliance with applicable data protection laws and are subject to appropriate contractual, technical and organisational safeguards, or other lawful transfer mechanisms required by applicable data protection laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to comply with applicable laws, or to reflect changes to the Services and users' feedback. When we do, we will post the updated version on the Site. We encourage you to periodically review this Privacy Policy to be informed about how we protect your Personal Information. This Privacy Policy forms part of, and is subject to, our Terms of Service. In the event of any conflict between this Privacy Policy and the Terms, the Terms shall prevail.

14. Contacting us

We have designated a Data Protection Officer or Privacy Officer (as required by applicable law) to oversee our privacy compliance programme. If you have any questions about this Privacy Policy, please contact us at:

  • support@chatandbuild.com (for ChatAndBuild);
  • support@chatchat.com for (ChatChat);
  • support@livingbrain.com; or
  • use the support options made available through the Services. For urgent matters related to data protection or security incidents, please include "URGENT - Privacy Concern" in the subject line of your email. To ensure a timely and accurate response, we recommend using the appropriate contact email for your inquiry and including any relevant account information in your message.