Privacy and European hosting

What is currently verified

ChtCr’s production database is hosted on Amazon RDS in AWS’s Ireland region (eu-west-1).

That database location does not prove that every backup, log, support tool, notification service, email or SMS provider, analytics system, or other subprocessor remains in the EU or EEA. ChtCr does not make that broader claim.

The machine-readable hosting claims register keeps publication approval disabled until administrator and legal confirmation are recorded.

Personal account controls

Account settings include privacy preferences, consent records, data export, retention controls, and account erasure. Account erasure removes contact-import batch metadata and pending invitation destinations associated with the account from the active database immediately. Necessary consent, security, abuse-prevention, and audit records may remain under their applicable retention rules. Backup expiry and deletion from restored copies follow operational retention processes and may not be instantaneous.

Contact discovery processes only the contacts selected by the user and does not retain the submitted address-book entries as an address-book copy. An account is matched only after its owner opts in to being found and has verified the matching email address or phone number. A match is not added as a contact until the user confirms that action. Aggregate import-batch metadata is deleted automatically after 30 days, or immediately when contact-discovery consent is withdrawn; the consent withdrawal and security audit record remain. For invitations, the destination email address or phone number is retained while delivery and redemption are pending, then erased 30 days after completion or cancellation, or 30 days after the invitation expires. Non-sensitive delivery status and audit records may be retained separately.

International transfers

Any transfer outside the EEA must be recorded with its purpose and lawful safeguard, such as an adequacy decision or approved contractual safeguards. The complete provider list and safeguards still require administrator and legal confirmation.

Exercising data rights

Users may request access, correction, portability, restriction, objection, or deletion through account data controls and the contact route in the approved privacy notice. Controller contact details and response procedures still require legal approval before this preview becomes the formal notice.

Business and enterprise information

Business customers can request the approved privacy notice, verified subprocessor list, transfer information, retention schedule, and Data Processing Agreement from their ChtCr account representative. Product controls can support customer obligations, but they do not by themselves establish GDPR compliance or any certification.

Enterprise buyers should obtain written confirmation of the hosting regions, subprocessors, international-transfer safeguards, backup locations, support access, and deletion schedule applicable to their service configuration before relying on a residency statement.