Last updated: 19.06.2026
================================================================================
PRIVACY POLICY
Last updated: 19.06.2026
================================================================================
1. WHO WE ARE (DATA CONTROLLER)
SIA "Chatline"
Reg. No.: 40203751493
Registered address: Adažu nov., Aroniju 9, Garupe, Latvia, LV-2163
Contact for privacy matters: privacy@chatline.me
Chatline is a messaging platform designed with privacy at its core.
No email address. No phone number. No real name required.
2. WHAT DATA WE COLLECT
We collect the absolute minimum needed to make the platform work:
┌─────────────────────┬──────────────────────────────────────────────┐
│ Category │ What we collect │
├─────────────────────┼──────────────────────────────────────────────┤
│ Account │ A randomly assigned numerical User ID │
│ │ (e.g. 1001001) and a hashed password. │
│ │ No name, no email, no phone number. │
├─────────────────────┼──────────────────────────────────────────────┤
│ Technical │ IP address, device type, OS version, app │
│ │ version, time zone, language preference. │
├─────────────────────┼──────────────────────────────────────────────┤
│ Communication │ Message content, files, images, voice/video │
│ metadata │ metadata (sender ID, recipient ID, │
│ │ timestamp). │
├─────────────────────┼──────────────────────────────────────────────┤
│ CHATL transactions │ Amount, timestamp, counterparty User ID. │
├─────────────────────┼──────────────────────────────────────────────┤
│ Push tokens │ Device token for push notifications │
│ │ (Android: Firebase; iOS: APNs). │
└─────────────────────┴──────────────────────────────────────────────┘
3. WHAT WE DO ***NOT*** COLLECT
Chatline will never ask for, and does not collect:
× Real name or surname
× Email address
× Phone number
× Address book / contact list from your device
× Geolocation / GPS data
× Biometric data
× Advertising identifiers
4. WHY WE COLLECT IT (PURPOSES & LEGAL BASIS)
┌────────────────────────┬──────────────────────┬─────────────────────┐
│ Purpose │ Data used │ GDPR Legal Basis │
├────────────────────────┼──────────────────────┼─────────────────────┤
│ Providing messaging │ User ID, messages, │ Performance of a │
│ services │ files, metadata, IP │ contract │
│ │ │ (Art. 6(1)(b)) │
├────────────────────────┼──────────────────────┼─────────────────────┤
│ AI assistant │ Message content │ Performance of a │
│ functionality │ (anonymised, via │ contract + │
│ │ API) │ Legitimate interest │
│ │ │ (Art. 6(1)(f)) │
├────────────────────────┼──────────────────────┼─────────────────────┤
│ CHATL peer-to-peer │ Transaction data │ Performance of a │
│ transactions │ │ contract │
├────────────────────────┼──────────────────────┼─────────────────────┤
│ Security & anti-abuse │ IP address, │ Legitimate interest │
│ │ metadata, rate │ (Art. 6(1)(f)) │
│ │ limiting │ │
├────────────────────────┼──────────────────────┼─────────────────────┤
│ Push notifications │ Device push token │ Legitimate interest │
└────────────────────────┴──────────────────────┴─────────────────────┘
5. HOW WE STORE YOUR DATA
Infrastructure:
• All servers are located in the EU/EEA: Hetzner (Germany/Finland)
and DigitalOcean (EU datacenters).
Message storage:
• Messages and files are stored on our servers to enable multi-device
sync and message history.
• We implement encryption in transit (TLS 1.3) and encryption at
rest.
Retention:
• Account data: retained while your account exists.
• Messages: retained while your account exists OR until you delete
them.
• IP addresses in logs: 30 days (security logs).
• Upon account deletion: all personal data is irreversibly erased
within 30 days (technical backup rotation cycle).
6. AI PROCESSING (DeepSeek & Mistral)
Chatline features an AI assistant. When you interact with the AI:
• Your messages are transmitted to a third-party AI API provider.
• Primary provider: DeepSeek.
• Fallback provider: Mistral AI (EU — France).
• We send ONLY the message content and conversation context —
NO IP address, NO User ID, NO identifying metadata.
• DeepSeek processes data without a Data Processing Agreement under
Art. 28 GDPR. Only anonymised text is transmitted, minimising
privacy risks.
• Mistral AI, as an EU-based provider, offers GDPR-compliant
processing as a fallback option.
• You can disable AI functionality in Settings at any time.
7. WHO WE SHARE DATA WITH (DATA PROCESSORS)
┌────────────────────┬──────────────────────────────┬─────────────────┐
│ Processor │ Purpose │ Location │
├────────────────────┼──────────────────────────────┼─────────────────┤
│ Hetzner │ Server hosting │ EU/EEA │
├────────────────────┼──────────────────────────────┼─────────────────┤
│ DigitalOcean │ Server hosting │ EU/EEA │
├────────────────────┼──────────────────────────────┼─────────────────┤
│ DeepSeek │ AI message processing │ Subject to │
│ │ (anonymised text only) │ contractual │
│ │ │ safeguards │
├────────────────────┼──────────────────────────────┼─────────────────┤
│ Mistral AI │ AI message processing │ EU/EEA (France) │
│ (fallback) │ (anonymised text only) │ │
├────────────────────┼──────────────────────────────┼─────────────────┤
│ Firebase (Google) │ Push notifications (Android) │ EU/EEA │
├────────────────────┼──────────────────────────────┼─────────────────┤
│ Apple APNs │ Push notifications (iOS) │ EU/EEA │
└────────────────────┴──────────────────────────────┴─────────────────┘
We do NOT sell, rent, or trade your data. We do NOT share data with
advertising networks or data brokers.
No international transfers outside the EU/EEA occur, except for
anonymised text sent to DeepSeek for AI processing — without any
identifiers that could link the text to a specific user.
8. YOUR RIGHTS (GDPR ARTICLES 15–22)
You have the right to:
✓ Access — request a copy of your data
✓ Rectification — correct inaccurate data
✓ Erasure — delete your account and all associated data ("right
to be forgotten")
✓ Restriction — limit how we process your data
✓ Portability — receive your data in a structured, machine-readable
format
✓ Objection — object to processing based on legitimate interest
✓ Withdraw consent — where processing is based on consent
To exercise any right, contact: privacy@chatline.me
We respond within 30 days (GDPR standard).
You also have the right to lodge a complaint with the Latvian Data
State Inspectorate (Datu valsts inspekcija): www.dvi.gov.lv
9. COOKIES AND TRACKERS
Chatline uses only strictly necessary cookies/session storage:
• Session identifiers — to keep you logged in. Essential for the
service to function.
• No third-party cookies.
• No analytics trackers (no Google Analytics, no Facebook Pixel).
• No advertising cookies.
Under ePrivacy Directive (Art. 5(3)), strictly necessary cookies do
not require prior consent. No cookie banner, because there is nothing
to consent to.
10. CHILDREN'S PRIVACY
Chatline is not directed at children under the age of 16. We do not
knowingly collect data from children under 16. If you are a parent
and believe your child has provided us with personal data, contact
privacy@chatline.me.
11. CHANGES TO THIS POLICY
We will notify you of material changes through the Chatline app
(in-app notification) at least 14 days before changes take effect.
Continued use after changes constitutes acceptance.
12. CONTACT
Data Controller: SIA "Chatline", Reg. No. 40203751493
Email: privacy@chatline.me
Latvian Data State Inspectorate (DVI): www.dvi.gov.lv
================================================================================
END OF PRIVACY POLICY
================================================================================