Personal data (GDPR)
This page lists the personal data Komozu handles when you embed a chat, so you can update your own privacy policy. You (the site owner) are the data controller for your chat; Komozu processes the data on your behalf, under the Data processing agreement.
Data and retention
Section titled “Data and retention”| Data | Where | How long |
|---|---|---|
| Messages (text, images and videos, date, channel) | Database and file storage | Until you delete them (message, member with “Also delete their messages”, channel or project). On the Free plan, messages and their files are deleted automatically after 15 days, on Starter after 180 days; Pro keeps them (the dashboard’s Plan & usage page shows the rule that applies to your project) |
| Member profiles (your user id, display name, avatar URL, created / updated / last active dates, date of the last token revocation) | Database, sent by your backend (members.upsert) or created in the dashboard | Until your backend or the dashboard deletes the member |
| Member bans (member, optional reason, date) | Database | Until unbanned or the member is deleted |
| Reports (reported message, optional reason, date), with nothing about who reported | Database | Until you delete the message (dismissed reports are kept with it) |
| “Already reported” marker (the member’s internal id, per reported message) | Memory only, never in the database | 24 hours |
| IP address for rate limiting (anti-abuse counters) | Memory only | The counting window: 1 minute (10 minutes for sign-in links) |
| Open connections per network (IP address, one entry per open chat, to limit simultaneous connections) | Memory only | While the chat is open, then at most 1 minute |
Visitor’s browser (localStorage of the chat): light / dark choice | The visitor’s device, per project | Until the visitor clears their browser data |
What Komozu does not store: no anonymous author (every message comes from a member your backend or your dashboard created, or from you), no IP address and no browser identifier on messages or in the database, no tracking cookie, no member token (tokens are signed with your secret key and checked on each request; Komozu only keeps the date of the last revocation, if any).
When a member reports a message, the project owner receives the report (message, optional reason, date) without knowing who sent it.
What to add to your privacy policy
Section titled “What to add to your privacy policy”Chat. Our website includes a chat provided by Komozu, open to signed-in users. When you post a message, we process its content, the date, your account identifier, display name and avatar. Messages are kept until they are deleted by us or by you on request. To prevent abuse, your IP address is used for a few minutes to limit the number of requests and of open chats; no IP address is stored with your messages. If you report a message, we receive your report without knowing who you are. Your browser stores your light / dark choice for the chat. Legal basis: the performance of our contract with you (your account) and our legitimate interest in offering a moderated discussion space. To access or delete your messages, contact us at [your contact].
Adapt the bracketed parts, the legal basis and the retention you apply when you delete data yourself.