Privacy Policy

Last updated: 24 October 2026.

About AmbiChat

AmbiChat provides a website chat widget and a private inbox for businesses. This notice describes information used by the AmbiChat website, account sign-in, inbox and chat widget.

Operator: Schellhammer Brokerage, S.L., trading as AmbiChat. NIF/CIF: B93210375. Registered address: Centro Comercial San Roque Club, local 3D, 11360 San Roque, Cádiz, Spain. Privacy contact: [email protected].

When you chat with a business using AmbiChat, that business receives your messages and decides how to handle your enquiry. For visitor conversations, the business generally determines the purposes of processing and AmbiChat provides the chat service on its behalf. AmbiChat is responsible for its own account administration, platform operation and security processing. Please also read the business’s privacy notice.

Account and business information

When you choose Continue with Google, AmbiChat receives a Google account identifier, your verified email address and basic profile details such as your name and, where provided, profile picture. We use these details to create or identify your AmbiChat account and display its profile information. This sign-in process does not request access to your Gmail messages, Google Drive files or Google Calendar. AmbiChat does not receive your Google password or store Google access or refresh tokens for this sign-in.

Some existing accounts may use an alternative sign-in method provided by the application hosting platform. When Google is linked to an existing account, the account holder must authenticate first; accounts are not automatically combined just because their email addresses match.

We also store the business names, website addresses, permitted website origins, chat appearance, greetings, saved answers and other settings you enter. Private inbox information includes conversations, replies, internal notes, status and read-state information.

Chat messages and page information

Visitors can send messages and optionally provide a name and email address. The business receives this information in its inbox. Email addresses supplied in chat are contact information; current replies are delivered in the chat rather than by email.

After a visitor starts or resumes a chat, the widget can share the current page address and title with that business. Only the latest page report is kept; a later report replaces the previous one. Query strings and URL fragments are removed. The page-reporting feature does not collect webpage form contents, referrers or precise location, and it does not create a browsing history. A business can disable page reporting for an installation.

Message timestamps, website origin and conversation identifiers are stored so the correct business and visitor can continue the conversation.

Language preferences

The widget selects its initial interface language from a saved choice, the website’s language setting or supported browser language preferences, with English as the fallback. If you choose another language, it remembers that choice in browser storage for that website’s chat until you change it or clear that storage. Once a conversation exists, its current interface language is also stored with the conversation and shown to the business. Chat messages remain in their original language; this feature does not send them to a translation service. Businesses can save their own translated welcome messages.

Cookies and browser storage

Google-based AmbiChat sessions use a secure, HTTP-only session cookie with a maximum duration of thirty days. A separate short-lived cookie supports the sign-in challenge. Signing out revokes the current AmbiChat session. Google and the hosting authentication provider may process their own authentication information under their respective privacy notices.

The chat widget stores an opaque visitor session token in the visitor’s browser so the chat can resume for up to thirty days. This token is scoped to the chat service and website installation. Clearing that browser storage or allowing the session to expire starts a new chat session; it does not by itself delete stored messages.

The inbox stores limited interface selections, such as the selected business, in browser storage. Conversation records and internal notes are held on the server. The service worker used for notifications does not cache private inbox pages or conversations.

Optional website analytics

With your consent, we use Google Analytics on www.ambichat.com and app.ambichat.com to measure visits, traffic sources and completed account signups. Analytics stays off until you choose Allow analytics. We do not send chat messages, internal notes, account names, email addresses, authentication credentials or conversation identifiers to Google Analytics. Advertising personalization and Google signals are disabled.

Your analytics choice is remembered across our website and app for up to six months. Google Analytics uses first-party cookies, including _ga cookies, to distinguish visits and sessions. You can change your choice or withdraw consent at any time using Cookie preferences. A short-lived browser marker lets us record a successful new signup once after sign-in; it expires after thirty minutes and contains no account identifier. Google processes analytics information under its own terms and privacy notice and may process it outside the EEA. See how Google uses information from sites and apps. Our legal basis for optional analytics is your consent (GDPR Article 6(1)(a)).

Optional phone and browser notifications

If an account owner explicitly enables notifications, AmbiChat stores the browser subscription endpoint and encryption information needed to deliver them. Alerts use a generic AmbiChat message and conversation identifiers; notification payloads do not contain visitor names, email addresses, message text or internal notes. Notification delivery also involves the device’s browser push provider. You can disable notifications from AmbiChat settings or your browser/device settings.

Security and service operation

We process requests and technical information to operate chat, authenticate accounts, keep customer inboxes separate and limit abuse. The application hashes IP-based rate-limit identifiers with a private secret. Hosting, website and authentication providers may also process connection and security logs under their own arrangements. Session secrets are stored as hashes on the AmbiChat server.

The public marketing website runs WordPress and is hosted by Sys4net. The chat application and its stored records use the Sites hosting platform and Cloudflare Workers and D1. Google provides the optional Google sign-in service, and browser push providers deliver notifications when enabled. These providers process information as necessary for website delivery, account access, chat storage, security and requested notifications.

These providers may process information in countries outside the European Economic Area (EEA). International transfers of personal data require a lawful mechanism, such as an applicable EU adequacy decision or safeguards including the European Commission’s Standard Contractual Clauses. For details about provider-specific processing locations and the transfer arrangements applicable to your data, contact [email protected]. We do not represent that all data is stored only in Spain or the EEA.

How information is used and retained

We process account and business settings to provide the AmbiChat service you request (GDPR Article 6(1)(b), performance of a contract or steps requested before entering one). We process necessary security and diagnostic information to protect accounts, prevent misuse and keep the service reliable (Article 6(1)(f), our legitimate interests in operating a secure service). We process information where necessary to meet legal obligations (Article 6(1)(c)). Device notifications are optional and require the user to enable them. Businesses using the widget determine and explain the legal basis for handling their visitors’ enquiries; AmbiChat processes their conversation data to deliver the requested service.

Conversation records and business settings are kept while the relevant AmbiChat account is active and the information is needed to provide customer support and the service. Marking a conversation resolved or signing out does not delete it. The current service does not automatically delete older conversations or provide a self-service account deletion or export control.

Account holders can request closure of their AmbiChat account and deletion of associated conversation records by emailing [email protected]. We review and handle verified requests manually, coordinating visitor requests with the business responsible for the conversation. We may need to retain limited records to comply with legal obligations or to establish, exercise or defend legal claims.

Copies of deleted information may remain in provider-managed backups until those backups expire under the provider’s backup lifecycle. The 30-day login and visitor-session expiry periods described above are not deadlines for deleting conversation history. Please contact us for information about a particular deletion request or backup retention.

What you need to provide

A Google account and basic business details are needed to register and operate an AmbiChat business account. Website visitors choose whether to start a chat; a name and email address are optional unless the business clearly states otherwise. The current AmbiChat service does not use the information described in this notice to make decisions that have legal or similarly significant effects solely by automated means.

Questions and requests

You can contact [email protected] or write to Schellhammer Brokerage, S.L. at the registered address above to ask about your personal information or exercise your rights. Subject to the conditions in data protection law, these include access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. We may ask for information needed to verify your identity and locate the relevant records.

For a conversation with another business using AmbiChat, contact that business first, because it is responsible for handling your enquiry and its use of your information. You can also contact AmbiChat about how our service handles your information.

You have the right to complain to the Spanish Data Protection Agency (AEPD) or another competent data protection authority.

Updates

We may update this notice as the service and our data handling change. Material changes will be reflected here with a new last-updated date.