Privacy

This describes what Chasa's software actually does with your data today. It hasn't been reviewed by a lawyer — treat it as an accurate technical description, not a legal guarantee.

What we collect

Free use without an account stores nothing on our servers about your invoices — drafts are generated in the request and not retained. If you sign in, we store your email address to manage your account and billing status.

If you request the free templates PDF pack, we store the email you submit so we can send the download link and related product tips. You can unsubscribe from those emails anytime via the link in the message. Individual template pages on the site stay available without an email.

Invoice content

Client names, amounts, and due dates you submit to generate a draft are sent to our AI provider (Cloudflare Workers AI) for that request only. We don't keep a history of your invoices or draft emails on our side.

Cookies & traffic analytics

A small number of strictly necessary cookies keep you signed in and remember your cookie choice — these don't need consent under ePrivacy rules and can't be declined without breaking sign-in. With your separate consent (the banner on first visit), we also use first-party page analytics and Microsoft Clarity (heatmaps and session recordings) to understand how people use Chasa. Decline, and we skip both — you can change your mind anytime by clearing the chasa_cookie_consent value in your browser. Our host (Cloudflare) may still log standard request metadata (IP, user agent) for security and abuse prevention regardless of consent, as that's an unavoidable part of serving the request. We don't use advertising trackers or share data with ad networks.

Data controller

Chasa is a product of RELACON GmbH, Vienna, Austria — the data controller for personal data described on this page. Contact details are under "Contact" below.

Legal basis for processing

Account data (email, plan, billing status) is processed to perform the contract with you (GDPR Art. 6(1)(b)) — we can't provide an account or paid plan without it. Analytics and Clarity run only on your consent (Art. 6(1)(a)) and stop the moment you decline or withdraw it. Security-relevant request logs kept by Cloudflare rest on our legitimate interest in keeping the service running and abuse-free (Art. 6(1)(f)).

How long we keep it

Account records persist for as long as your account exists, plus a limited period afterward to satisfy billing and tax record-keeping obligations, then are deleted. Invoice details you paste to generate a draft are never written to our database in the first place — they exist only for the duration of that one request. Template-pack email addresses are kept until you unsubscribe.

Subprocessors

The services above that touch your data, and why:

• Cloudflare (USA/EU, Workers & Pages hosting, D1 database, Workers AI) — runs the app, stores account data, drafts invoice follow-ups.
• Resend (USA) — delivers sign-in links and transactional email.
• Stripe (USA/Ireland) — processes payments; we never see or store full card numbers.
• Microsoft Clarity (USA) — session analytics, only after cookie consent.

International data transfers

Some subprocessors above process data outside the EU/EEA (notably the US). Where that happens, we rely on the provider's Standard Contractual Clauses or equivalent safeguards — see each provider's own privacy documentation (Cloudflare, Resend, Stripe, Microsoft) for the specifics of their transfer mechanism.

Your rights (GDPR)

If you're in the EU/EEA/UK, you can ask us to access, correct, delete, or export (portability) the personal data we hold on you, and you can object to or restrict processing, or withdraw consent for analytics at any time — none of this affects the lawfulness of processing before the withdrawal. Email [email protected] and we'll respond within a reasonable time. You also have the right to lodge a complaint with your local data protection authority — in Austria, the Datenschutzbehörde (DSB).

Children

Chasa is a business tool and isn't directed at, or knowingly used by, children under 16.

Changes to this policy

If what we collect or why changes materially, we'll update this page and, for signed-in accounts, note it in-app.

Contact

Questions about your data, or want to exercise any of the rights above? Reach out at [email protected].