ChatUp

ChatUp is a messaging app made by IA SYSTEMS, Rue de Russie, Tangier, Morocco ("we"). It lets a company's customers and staff write to each other, send files and follow orders. This page explains what the app and its server do with your data.

What ChatUp uses, and why

The app sends the following to our server, over an encrypted connection (HTTPS):

• Your account. Your phone number, or the username and password you were given; your name; a profile picture if you add one. Passwords are stored only as a one-way hash. If you sign in with a one-time code, the code is stored only in a form that cannot be read back.
• What you send. Your messages; the photos, videos, voice notes and documents you choose to send; your orders and your requests to our teams. Photos are resized on your phone before they are sent. Videos, voice notes and documents are sent as they are.
• Message status. When a message reached your phone and how far you have read a conversation, so the other person sees the ticks.
• Your phones. A name for each phone you sign in on (its name or model) and a notification token, so we can tell you about new messages.
• Security and error records. Each sign-in attempt (the account, whether it worked, the IP address); the main actions on your account, with the IP address; error reports from the app (the error, the screen you were on, the app version and your phone's system), linked to your account when you are signed in.

We use this to provide the service (deliver your messages, handle your orders and requests, show delivery and read ticks), to notify you of new messages and of decisions on your orders, and to keep the service secure (limit sign-in attempts, investigate misuse, fix errors).

The app asks for the camera, the microphone and your photos only when you choose to take or send a photo, a video or a voice note, and for notifications only when you turn them on.

The app does not read your location or your contacts. It contains no advertising and no analytics tools. We do not sell your data.

Who receives it

• The people you write to. In a direct conversation: the other person. In a request to a team (Sales, Customer service and so on): every member of that team can read the whole conversation, also after it is closed. The member who takes your request answers you.
• The staff who handle orders see your orders and their history.
• The service's administrators can see the list of accounts (name, username, phone number, email) and the security records. IA SYSTEMS staff who run the server can technically access the data stored on it.
• Notification services. Notifications travel through Google Firebase Cloud Messaging, and on iPhone and iPad also through Apple's notification service, under their own privacy terms. A notification contains the conversation's name and the start of the message (up to 160 characters, or the name of the file sent), so this text passes through Google's or Apple's servers.
• Our hosting provider, OVH, in France.
• Nobody else, unless the law requires it.

How long we keep it

• Messages, files, orders and requests are kept as long as the service runs, also after your account is closed (see below).
• A message you delete for everyone disappears from every screen, but the server keeps its content as part of the company's record.
• Copies of new events waiting for your phones: 30 days.
• Sign-in attempts, the activity log and error reports: 180 days, then deleted automatically.
• Notifications listed in the app: until an administrator clears them.

On your phone, the app keeps messages waiting to be sent, your sign-in keys (in the phone's secure storage), and copies of the pictures and files you opened. On Android, the app's data may be included in your phone's own backup. Signing out removes your sign-in keys and any messages still waiting to be sent. Copies of the pictures and files you opened stay in the app's private storage until the phone clears them or you remove the app.

Your choices and rights

• You can close your account at any time in the app: Settings → Delete my account. See how to delete your ChatUp account.
  • Removed at once: your name, username, phone number, email, profile picture and password; your sign-in on every phone; your notification tokens. Orders not yet decided are withdrawn, and your open requests are closed.
  • Kept: the messages and files you sent stay in the conversations, shown as from a closed account, because they are also the other person's and the company's record. Decided orders and their numbers are kept. Security records are kept up to 180 days.
• You can turn notifications, the camera, the microphone and photo access off in your phone's settings. Sending photos, videos and voice notes needs them.
• You can ask to access, correct or delete data about you by writing to us at [email protected].
• You can also contact Morocco's data protection authority, the CNDP (www.cndp.ma), or your local data protection authority.

Security

Data travels encrypted between your phone and the server. Passwords are stored as one-way hashes, and sign-in keys are kept in your phone's secure storage. Sign-in attempts are limited and recorded.

Children

ChatUp is a business app and is not meant for children.

Changes

We'll update this page when the app's use of data changes, and change the date at the top.

Contact

IA SYSTEMS, Rue de Russie, Tangier, Morocco. Email: [email protected]. Website: https://iasys.dev