C Chat Privacy Policy

This policy explains how personal data is handled in C Chat by CGuard Pro ("C Chat" or "the app"), the encrypted messenger for businesses and teams available on iOS and Android. It complements the CGuardPro general Privacy Policy; for anything specific to C Chat, this policy prevails.

1. Who is responsible for your data

C Chat is provided by CGuard Pro LLC, 289 Centuryplant Rd, Leander, TX 78641, United States, email privacy@cguardpro.com. Roles depend on where you use C Chat:

• Independent accounts and teams. If you download C Chat, sign up and create or join a team that does not belong to a security company using CGuard Pro, CGuard Pro LLC is the data controller for your account data. Each team's owner and admins administer that team's content (groups, members, messages and files).
• Spaces of a security company that uses CGuard Pro. When you take part in the groups of a site served by a security company that is a CGuard Pro customer (the site's owner or management, guards, the security company's office and guests such as cleaning, maintenance or contractors), that security company is the data controller. CGuard Pro acts as data processor, processing data on the company's behalf and under its instructions. To exercise your rights over those chats you can contact the security company or us, and we will help it respond.

2. What data we process

• Sign-up and login data: email address and/or phone number (to send you a 6-digit one-time code by email, SMS or WhatsApp to log in), name and, if you choose, a username and a short bio. Your email and phone are not shown to other users; they find you by your exact @username or, if you allow it, by your number.
• Phone number sign-up and contact matching: if you sign up with your phone you can choose whether people can find you by it (in Settings, "Let people find me by phone"). If you tap "Find my contacts" and grant permission, the app reads your address book numbers on your phone, normalizes them and computes a SHA-256 fingerprint of each one; it sends only those fingerprints, never names or plain numbers. The server matches them against active accounts registered by phone that allow being found, returns the matches and does not store or log the fingerprints it receives.
• Profile photo, only if you upload one.
• Messages and attachments: text, photos, video, files and voice notes you send, plus reactions, read receipts and alerts.
• Location, only when you choose to share it in a message. The app does not track your location in the background.
• Group membership and invitations: which teams and groups you belong to, your role, who invited you, through which channel (email, WhatsApp, link or QR) and when you joined or left. In CGuard Pro spaces, if you are a guard, your joining and leaving groups with your shift.
• Device data: push notification token, device model and operating system, app version and language.
• Technical and security data: IP address, access times and the technical logs needed to run the service, prevent abuse and diagnose errors.
• Reports and blocks: if you report or block someone, or someone reports you, the record of that report and the reported content.

What we do not collect: your contacts/address book (no names or numbers: only the fingerprints described above are processed on the fly), advertising identifiers (IDFA/AAID) or any data to track you across other apps or websites. We do not sell personal data or use it for advertising.

3. Why we use it and on what legal basis

• Creating your account, verifying your email or phone and letting you log in — performance of a contract (the C Chat terms of use).
• Delivering messages, attachments, alerts and notifications to your group members — performance of a contract.
• Managing invitations and team/group membership, including guards automatically joining and leaving with their shift in CGuard Pro spaces — performance of a contract and, in those spaces, the legitimate interest and instructions of the security company acting as controller.
• Security and abuse prevention (rate limits, fraud detection, handling reports and blocks) — legitimate interest in protecting users and the service.
• Audit and operational record-keeping of groups and security-related direct chats (with a guard or the office) in a security company's spaces — that company's legitimate interest and obligations as controller.
• Finding your contacts who already use C Chat — your consent, given when you tap "Find my contacts" and grant the contacts permission, revocable in your phone's permissions.
• Sharing your location — your consent, given each time you choose to share it and revocable in your phone's permissions.
• Complying with legal obligations and lawful requests from authorities — legal obligation.

4. Who can read messages

Always the participants of each conversation. In addition, depending on the type of conversation:

Conversation	Who else can review it?
Group of a site served by a security company (CGuard Pro)	The security company (its office), as its operational record: it can audit and export it.
Chat with the security company's office	The security company (it is its support inbox).
Direct chat that includes at least one guard or office staff member	The security company, as auditor, without being able to write. The app says so at the top of the chat: "This chat may be reviewed by the security company".
Group of an independent team	The team's owner and admins: they can review and export it.
Direct chat with no guards or office (for example, between a site's owner or management and a guest such as cleaning or maintenance, or between two guests)	No one else: it is private. The security company cannot see, search or export it. The app labels it "Private".
Any direct chat between independent accounts	No one else: it is private. Team owners and admins cannot see it; a team's exports only include its groups.

C Chat platform access (CGuard Pro LLC). Our staff do not read conversations. Only the C Chat platform administration team can access content, and only in two cases: (1) moderation of a message someone has reported, seeing that message and a few surrounding messages for context; and (2) a legal requirement or lawful request from an authority, for one specific conversation and with a written reason. Every access is logged (who, when, which conversation and why), and there is no way to browse private chats in bulk. Reports from a private chat are not sent to the security company: the C Chat platform reviews them.

5. Who we share data with

Besides your group members, only with providers that run the service, acting as processors who may not use the data for their own purposes:

• Hosting and infrastructure for servers and storage.
• Email delivery (login codes and invitations).
• SMS and WhatsApp delivery (codes and invitations): Twilio and Meta (WhatsApp Business).
• Push notifications: Google Firebase Cloud Messaging and Apple Push Notification service. Notification content is limited to what is needed to alert you.

We may also disclose data where required by law or a lawful order. Where the law allows, we will notify the affected controller.

6. International transfers

CGuard Pro LLC is based in the United States and some providers process data outside your country. When that happens we apply appropriate safeguards — standard contractual clauses or other mechanisms recognized by applicable law — together with the security measures in this policy.

7. How long we keep data

• Account data (name, email, phone, username and photo): while your account is active.
• Messages and attachments in CGuard Pro spaces: kept for as long as the security company determines under its contract and legal obligations. Groups and security-related direct chats are its operational record and it can audit and export them; private direct chats are not.
• Messages and attachments in independent teams: while the team exists or until its admins delete them.
• When you delete your account we delete your identity: name, email, phone, username and profile photo, plus your notification tokens and sessions. Messages you sent in groups remain for the other members but no longer show your data: they are attributed to "Deleted guest" ("Invitado eliminado"). See how to delete your account.
• Technical and security logs: for as long as needed for service security and abuse prevention, then deleted.
• Backups: deleted data disappears from backups as they rotate in their normal cycle, within 90 days at most.

8. How we protect data

• Encryption in transit (TLS) for all communication between the app and our servers.
• Encryption at rest (AES-256) for stored messages, with a dedicated key per company.
• Access control: every request checks that the requester belongs to the relevant team and group; teams and companies are isolated from each other.
• One-time code login, with no reusable passwords.
• Anti-abuse measures: rate limits on messages and code requests, user and content reporting, and user blocking.
• Auditable activity logging and staff confidentiality obligations.

9. Your rights

You can request access, rectification, erasure, portability, objection and restriction of processing, and withdraw consent where it is the legal basis. If you are in Ecuador, you have the rights under the Organic Law on Personal Data Protection (LOPDP) and may complain to the Superintendency of Personal Data Protection. If you are in the European Union or European Economic Area, you have the rights under the General Data Protection Regulation (GDPR), including the right to complain to your local supervisory authority. Users elsewhere have the rights granted by their local law.

To exercise them, email privacy@cguardpro.com from the email address, or stating the phone number, you use with C Chat. We reply within 30 days. In a security company's spaces you can also contact that company.

10. Children

C Chat is not directed to children under 16 and they must not use it. If we learn that an account belongs to someone under that age, we will delete it.

11. Changes to this policy

If we make material changes we will notify you in the app or by email before they take effect. The date above shows the latest update.

12. Contact

• Privacy: privacy@cguardpro.com
• Support: support@cguardpro.com · C Chat help center
• Address: CGuard Pro LLC, 289 Centuryplant Rd, Leander, TX 78641, United States