GDPR

Our commitment

BayChat is operated by SeaQuest Software LLC, 8 The Green, Suite B, Dover, DE 19901 (Delaware, United States of America), which is the data controller for personal data processed through the service.

Because the controller is established outside the European Union, we have designated a representative in the Union under Article 27 GDPR: SENEKO d.o.o. (Chamber of Commerce ID 2296365000), Liminjanska c. 25, 6320 Portorož, Slovenia. EU and EEA data subjects, and supervisory authorities, may address any matter concerning personal data to that representative, in Slovenian or English, as an alternative to contacting the controller.

The service is operated in compliance with the EU General Data Protection Regulation. Our production servers are located in Germany, so message content and files are stored inside the EEA even though the controller is not — see Article 5 for what that means for transfers.

This page summarises the technical and legal arrangements that support that compliance. Detailed processing information, including our lawful basis for each purpose, is set out in our Privacy Policy; our security measures are described on our Security page.

Article 1 — Roles: when we are a controller, when we are a processor

GDPR distinguishes between the controller (who decides why and how personal data is processed) and the processor (who processes personal data on the controller's behalf). BayChat plays both roles, in different contexts:

• Controller. For data we collect to provide our website and the BayChat service directly to you — account email, billing information, server and security logs — SeaQuest Software LLC is the controller. SENEKO d.o.o. is our representative in the Union (Article 27), not a controller.

• Processor. When a customer creates a workspace and invites end users, the customer is the controller of the workspace content (messages, files, voice recordings, transcripts, agent configurations). BayChat acts as the processor on the customer's documented instructions, under our Data Processing Agreement (see Article 8).

Article 2 — Your rights as a data subject

Under GDPR Articles 15–22 and ZVOP-2, you have the right to:

• Be informed about the processing of your personal data (this page and the Privacy Policy);

• Access the data we hold about you;

• Rectify inaccurate or incomplete data;

• Erase your data where one of the grounds in Article 17 GDPR applies ("right to be forgotten");

• Restrict processing in the cases listed in Article 18 GDPR;

• Object to processing based on our legitimate interest;

• Portability — receive your data in a structured, commonly used, machine-readable format;

• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects;

• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;

• Lodge a complaint with a supervisory authority (see Article 10).

Where BayChat acts as a controller, you can exercise these rights directly with us. Where BayChat acts as a processor on behalf of a customer, please contact the customer who operates the workspace; we will assist that customer in responding to your request.

Article 3 — How to exercise your rights

Write to [email protected]. To protect your data, we may verify your identity before acting on a request — for example, by asking for proof of identity associated with the account or email address concerned. We will respond within one month, with a possible extension of up to two months for complex or numerous requests, in which case we will inform you of the extension.

Article 4 — Sub-processors

We use a limited number of carefully selected sub-processors to operate the service. Each is bound by contract to confidentiality and to security obligations consistent with GDPR Article 28. Current sub-processors include:

• Contabo GmbH (Germany) — virtual private servers hosting the BayChat application, database, backups and supporting services.

• Cloudflare, Inc. (United States) — DNS, edge security, Cloudflare Tunnel, cookieless aggregate web analytics, R2 storage for the encrypted off-site backup copy, and for calls a STUN server plus the relay for calls that cannot connect directly (it forwards encrypted audio it cannot read).

• Google LLC (United States) — a STUN server that helps the two devices in a call find a direct path; it sees their network addresses, never the call.

• Stripe Payments Europe, Ltd. (Ireland) — payment processing.

• Expo (650 Industries, Inc., United States), Google Ireland Ltd. (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service) — push notification delivery.

• Groq, Inc. (United States) — built-in assistant replies where a customer has not configured its own provider, and voice transcription when it is not handled on our own servers (by default it is).

• OpenRouter, Inc. (United States), and the model provider it routes to — only for agents or features configured to use them.

• Brave Software, Inc. (United States) — web search queries made by agents that use the web-search tool.

• Our email-delivery provider — account and notification emails.

Services a customer connects itself — Telegram, Google (Gmail), Slack, Meta (WhatsApp Business), Discord, Atlassian (Jira), GitHub — receive data on the customer's instructions under their own terms; they are not our sub-processors.

The same list, with what each one receives, is in our Privacy Policy. When we propose to add or replace a sub-processor that handles customer personal data, we will notify customers in advance and give them a reasonable period to object on legitimate grounds.

Article 5 — International data transfers

Our production infrastructure is located in Germany, so message content, attachments and account records are stored inside the EEA. The controller, SeaQuest Software LLC, is established in Delaware, United States of America, and personnel there administer the service — so personal data is accessed from outside the EEA even where it is stored within it.

Some sub-processors also process personal data outside the EEA — Cloudflare for network delivery, the off-site backup copy and calls, Groq and OpenRouter for AI features, Brave for web search, Stripe for payments, Expo, Apple and Google for push notification delivery, and Google for calls.

For both, we rely on the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914), supplemented by the technical and organisational measures described on our Security page — message bodies and files encrypted at rest with AES-256-GCM, provider API keys encrypted, and agent tokens never stored in plain text (a one-way hash, plus one encrypted copy used to deliver to the agent's webhook).

Article 6 — Security measures

We apply technical and organisational measures including encryption of message bodies, files sent in chats and stored credentials at rest using AES-256-GCM, transport encryption with TLS 1.2 or 1.3, multi-tenant data isolation, agent API tokens kept as a one-way hash plus one encrypted copy (never in plain text), restricted access to production systems, and an append-only audit log of privileged actions. See our Security page for the full description, including what is not yet in place.

Article 7 — Personal data breaches

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Article 33 GDPR. Where the breach is likely to result in a high risk, we will also notify affected data subjects without undue delay. Where BayChat acts as a processor, we will notify the affected customer without undue delay and assist that customer in fulfilling its own notification obligations.

Article 8 — Data Processing Agreement (DPA)

When you subscribe to a paid plan and use BayChat to process personal data on behalf of your end users, GDPR Article 28 requires a written contract between you (controller) and us (processor) that sets out the subject matter, duration, nature and purpose of processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller.

BayChat offers a standard Data Processing Agreement that meets these requirements and incorporates the Standard Contractual Clauses for international transfers. Customers may request the current DPA at [email protected]; on paid plans, the DPA forms part of the agreement between you and BayChat by reference from our Terms of Service.

Article 9 — Data retention and deletion

We retain personal data only for as long as needed to provide the service or to comply with law. Specific retention periods by data category are listed in our Privacy Policy. When an account is closed, the personal data of that account is removed from the live service after a 30-day cancellation window; messages it sent in shared conversations remain but are no longer attributable to it. Deleted data can persist in database backups until they expire — the oldest backup is about six months old — and backups are used only to restore the service.

Article 10 — Supervisory authority and contact

You have the right to lodge a complaint with the supervisory authority of the country where you live, where you work, or where you believe the infringement took place.

Because our Article 27 representative is established in Slovenia, you may also complain to Informacijski pooblaščenec (Information Commissioner), Dunajska cesta 22, 1000 Ljubljana, Slovenia — ip-rs.si, [email protected].

For questions about this page, to exercise your data-subject rights, or to request our DPA, contact [email protected].

By post to the controller: SeaQuest Software LLC, 8 The Green, Suite B, Dover, DE 19901, United States.

By post to our EU representative: SENEKO d.o.o. — BayChat, Liminjanska c. 25, 6320 Portorož, Slovenia.