Privacy Policy

Jojo Chat is a customer-support service operated at jojochatai.com. For any privacy question, or to exercise any right described below, email [email protected].

To be completed before launch: registered company name, RC number, registered address, and the name of the data protection contact. We have deliberately not invented these.

When you create an account, we collect exactly what the signup form asks for:

• Your name and your business name
• Your email address — used to sign you in, verify your address, and send service notices
• Your phone number and website address
• Your password, which is stored only as a bcrypt hash. We cannot read it, and neither can our staff.

We also record account activity needed to run the service: your wallet balance, payment references, AI usage counts, staff accounts you create, and your knowledge-base entries.

The chat widget only runs for visitors your own website has already signed in. Your site passes us their email address together with a signature proving it is genuine. Through the widget we hold:

• The visitor's email address and display name
• Everything written in the conversation, by them, by your team, and by Jojo AI
• Any image the visitor uploads to the chat
• Timestamps, conversation status, and read receipts

We do not use tracking pixels, advertising cookies, fingerprinting, or any analytics product that follows visitors around the web. See the Cookie Notice.

To write a reply, we send the recent part of the conversation and your knowledge-base entries to our AI provider. Older turns are dropped before sending, so the whole transcript is not transmitted on every message.

If you have configured a customer lookup, Jojo AI can ask your own system for that visitor’s order or payment status. We send your system the visitor’s verified email and a reference, signed with your secret. That request goes to a URL you control, and the data returned is governed by your own policies, not ours.

Payments are handled by Korapay. Their checkout runs in your browser and we pass it your name and email so they can identify the transaction. We never see, receive, or store your card details or bank credentials. We only store the payment reference, the amount, and whether it succeeded.

We do not sell personal data, and we do not share it for advertising. We rely on a small number of service providers who process data on our behalf, strictly on our instructions: an AI provider that generates replies, a payment processor, our hosting and email provider, and a content delivery network. None of them receives your data for their own marketing.

If you need the specific providers named — for example because you are a business acting as your own customers’ data controller — email [email protected] and we will send you the current list.

We will disclose data if we are legally required to, and to protect the rights or safety of users where the law allows it.

A conversation is closed automatically after 24 hours of silence, but closing is not deleting — closed chats stay in your inbox as history so you can look back at what was said.

We keep account and conversation data for as long as your account is open. Ask us to delete it and we will, subject to any records we must keep for tax or accounting purposes. There is currently no self-service delete button, so please email [email protected] and we will action it.

Under the Nigeria Data Protection Act 2023 — and, where it applies to you, the GDPR — you can ask us to:

• Tell you what data we hold about you
• Give you a copy of it
• Correct anything that is wrong
• Delete it
• Stop or limit how we use it

Email us and we will respond within 30 days. If your dealings are with a business that uses Jojo Chat rather than with us directly, contact that business first — we act on their instructions, and we will pass your request to them.

Passwords are hashed with bcrypt. Sessions use signed, HTTP-only cookies that JavaScript cannot read. Visitor identities are verified by HMAC signature, so a visitor cannot read another visitor’s chat by claiming their email. Traffic is served over HTTPS.

No system is perfectly secure. If you believe you have found a vulnerability, please email [email protected] rather than disclosing it publicly, and we will work with you on it.

Jojo Chat is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

Our servers are in Europe, and some of our providers process data in the United States. Where data leaves Nigeria we rely on the transfer safeguards those providers offer under their own data protection terms.

If we change anything that materially affects you, we will update the date at the top of this page and email account holders before the change takes effect.