Privacy Policy

Last updated: September 2026

This Privacy Policy explains what data Mango Group, an Estonian company operating under the WelcoChat brand ("WelcoChat", "we", "us"), collects through the WelcoChat widget and the client portal at /portal (together, the "Services"), and how we use it.

Mango Group's company registration in Estonia is in progress. Once complete, this page will be updated with our full registered business details as data controller. In the meantime, privacy questions or requests can be sent to notification@kaptila.com.

1. Data we collect

We collect different data depending on how you interact with WelcoChat:

• Account data — name, email address, phone number, company name and billing address, when you register a WelcoChat account or subscribe.
• Billing data — subscription and invoice history. Card details are collected and stored by our payment processor, Stripe; WelcoChat does not receive or store your full card number.
• Widget content — the public content of your website, which WelcoChat crawls to build its knowledge base, and the messages exchanged between your website visitors and the widget, including any name, email, or message a visitor submits to reach your team.
• Usage and log data — technical data such as IP address, browser type, and pages visited, collected automatically when you use the Services or the public website.

2. How we use it

We use this data to: provide and maintain the Services; process payments and send billing communications; respond to support requests; and send service-related notices (e.g. trial ending, setup status).

3. Legal basis for processing

Where the General Data Protection Regulation (GDPR) applies, we process personal data on the following bases: performance of a contract (providing the Services you subscribed to), legitimate interest (securing and improving the Services, responding to inquiries), and consent (where you have explicitly given it, such as optional marketing communications).

4. Who we share data with

We share data with the following categories of third-party providers, solely to operate the Services:

• Stripe — payment processing and billing.
• Anthropic — the AI provider behind WelcoChat. When WelcoChat answers a visitor, the relevant content is sent to Anthropic's API to generate a response.
• Email delivery and hosting providers — to send account and notification emails and to host the Services.

We do not sell personal data. Some of these providers may process data outside the European Economic Area; where that is the case, they do so under appropriate safeguards such as Standard Contractual Clauses.

5. If you use WelcoChat on your own website

If you embed the WelcoChat widget on your website, you are the data controller for your own website visitors, and WelcoChat acts as a data processor on your behalf for the conversations and leads it collects. You are responsible for ensuring your own visitors are appropriately informed (e.g. in your own privacy policy) that a chat widget is present and how their messages are handled.

6. Data retention

We retain account and billing data for as long as your account is active and as required by applicable tax and accounting law thereafter. Knowledge-base content and conversation/lead data are retained for as long as the related subscription is active, and are deleted or anonymized within a reasonable period after cancellation, unless you request earlier deletion.

7. Your rights

Subject to applicable law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion; object to or restrict certain processing; and request a portable copy of your data. To exercise any of these rights, contact notification@kaptila.com. If you are in the EU/EEA and believe your rights have not been respected, you may also lodge a complaint with your local data protection authority (in Estonia, the Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon).

8. Cookies

The client portal and public website use only strictly necessary storage (such as your login session) to operate — no advertising or tracking cookies.

9. Children's privacy

The Services are intended for business use and are not directed at children. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the client portal before they take effect.

11. Contact

Questions about this Privacy Policy or how your data is handled can be sent to notification@kaptila.com.