Skip to content
aichat.mdaichat.mdBack to home page

Last updated: 28 September 2026

Informative translation. The Romanian version of this document prevails.

PRIVACY POLICY

1. Data controller

The aichat.md platform is operated by MEGA PROMOTING S.R.L., a company registered in the Republic of Moldova, IDNO 1019600021765, headquartered in Dănceni village, Ialoveni district, MD-6814, Republic of Moldova. Our data protection contact is dpo@megapromoting.com.

2. Legal framework

We process personal data in accordance with Law No. 195/2024 on the protection of personal data of the Republic of Moldova (in force since 23 August 2026, replacing Law 133/2011) and, for individuals located in the European Union, with Regulation (EU) 2016/679 (GDPR).

3. Data we collect

  • Identification and contact data: name, email address, phone number, company name.
  • Account data: credentials, settings, subscription plan.
  • Usage and technical data: IP address, cookie identifiers, access logs, device and browser type.
  • Conversation content: messages you send to our agents or through contact forms.
  • Payment data: processed solely by third-party providers (e.g. Stripe); we do not store full card data on our servers.

3.1. Data and permissions for Facebook, Instagram and WhatsApp

For connected Meta channels, the platform processes account and recipient identifiers, messages and comments, access tokens and sending statuses. Content and agent instructions are used for AI responses through the configured provider. Requested permissions depend on the integration and enabled features:

  • Facebook: pages_show_list, pages_messaging, pages_manage_metadata, business_management, pages_manage_engagement, pages_read_engagement, pages_read_user_content.
  • Instagram Login: instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_content_publish, instagram_business_manage_insights.
  • WhatsApp: whatsapp_business_management, whatsapp_business_messaging.

4. Purposes and legal basis (art. 5–6)

  • Providing and operating the service (account creation, agent operation) — basis: performance of a contract.
  • Marketing communications, analytics and marketing cookies — basis: your consent (withdrawable at any time).
  • Platform security, fraud and abuse prevention — basis: legitimate interest.
  • Compliance with tax, accounting and legal obligations — basis: legal obligation.

5. Cookies and similar technologies

We use strictly necessary cookies without consent and, only with your explicit consent given through the cookie banner, analytics and marketing cookies. Full details and preference controls are in our Cookie Policy and via the "Cookie settings" button in the site footer.

6. Recipients and processors (subprocessors)

To operate the platform we use third-party providers that process data on our behalf under data processing agreements (DPAs):

  • Meta (Meta Pixel dataset 773901447497151) — conversion attribution and advertising with consent only. Google Analytics and Google Ads are planned but currently disabled; Meta Pixel is limited to public marketing pages and does not receive private-dashboard or authentication data (USA).
  • OpenAI, Anthropic — AI models generating agent responses (USA).
  • Microsoft (Azure, Microsoft 365) — hosting of the platform and database (Poland, EU), backups (Sweden, EU), AI models via Azure OpenAI, and email delivery (EU/USA).
  • OVH — storage of uploaded files such as images and documents (Warsaw, Poland, EU).
  • Stripe — payment processing.
  • InfoBip — SMS delivery and, as a fallback, email delivery.

7. International data transfers

Some subprocessors (Google, OpenAI, Anthropic) are located in the United States. Such transfers rely on adequate safeguards — Standard Contractual Clauses (SCC) and/or EU-US Data Privacy Framework certification. Transfers within the EU/EEA require no additional authorization.

8. Artificial intelligence, profiling and automated decisions

aichat.md is an AI-based product: when you interact with an agent you are communicating with an AI system, not a human (transparency under art. 50 of the EU AI Act). Agents may analyze message content to formulate responses, but we do not make decisions producing legal or similarly significant effects on you solely by automated means without the possibility of human intervention.

9. Retention period (storage limitation, art. 5)

We keep data only as long as necessary for the purpose it was collected for:

  • Account data: for the duration of the contractual relationship + legal limitation periods.
  • Billing documents: per Moldovan accounting and tax legislation.
  • Contact-form messages: until the request is resolved, then up to 12 months.
  • Consent proofs: for the duration of processing plus the applicable limitation period.
  • Cookies: per each cookie’s lifetime (analytics/marketing — up to 24 months).
  • Technical logs: used only for security and troubleshooting. Web server logs are deleted automatically after 14 days and application logs after 30 days; for other technical logs the maximum period is still being set.

10. Your rights (Law 195/2024)

You have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing (including marketing); withdraw consent at any time (without affecting prior processing); and not to be subject to a decision based solely on automated processing. We respond within one month (extendable by up to 2 months for complex requests, with notice). Exercising your rights is free. Contact dpo@megapromoting.com.

11. Right to lodge a complaint

If you believe the processing of your data infringes the law, you have the right to lodge a complaint with the supervisory authority: the National Center for Personal Data Protection (CNPDCP), www.datepersonale.md, email centru@datepersonale.md, tel. +373 22 820-801, Chișinău, Republic of Moldova.

12. Data security

We apply appropriate technical and organizational measures to protect data (encryption in transit, access control, logging). In the event of a security breach posing a risk to individuals’ rights, we notify the CNPDCP within 72 hours and, where the risk is high, the affected individuals.

13. Changes to this policy

We may update this policy. The current version, with its update date, is always published on this page. Significant changes will be announced on the platform.

14. Contact

Data protection: dpo@megapromoting.com. General support: support@aichat.md. Controller: MEGA PROMOTING S.R.L., Dănceni village, Ialoveni district, MD-6814, Republic of Moldova.