Terms of Service

1. What ChitChat is

ChitChat lets you build chatbots ("bots") from documents you provide — and, optionally, from external systems you connect — and deploy them via an embeddable widget, a hosted share page, and a REST API. Answers are generated by a large-language-model provider of your choice, using API keys you supply ("BYOK" — bring your own key).

2. Your LLM keys and LLM costs

You are responsible for the provider API keys you add and for all charges those providers bill you. Every LLM call your bots make — answering visitors, ingesting documents, running evaluations — is billed by your provider to your key. ChitChat adds no per-message markup. We store keys encrypted (AES-256-GCM), use them only to operate your bots, and never display them again after entry. Configurable rate limits and daily caps exist to protect your spend, but you remain responsible for monitoring it.

Free trial. A trial bot runs on ChitChat's built-in engine ("ChitChat Free") at no charge to you, within the limits shown in the dashboard: one bot, up to 3 sources and 50 pages in total — one of which may be a website, of which up to 25 pages are indexed — and a daily message cap. Trial bots are for trying ChitChat in the playground and cannot be deployed. We may pause the trial when it is at capacity, and may change its limits; adding your own key is the way to keep going without them.

3. Your content

Documents you upload or connect (PDFs, Confluence pages, web pages and websites) remain yours. You grant us the limited right to store and process them solely to operate your bots (parsing, chunking, embedding, retrieval, and — where you configure a vision model — sending page images to your chosen provider). You must have the right to use the content you add. We may remove content that is illegal or abusive.

When you add a link or a website, you are instructing us to fetch those pages on your behalf, and you confirm you are entitled to have that site indexed. We fetch only pages reachable without signing in, identify ourselves as ChitChatBot, obey the site's robots.txt and noindex markers, request one page at a time with a pause between requests, and stop at the page limit shown to you before the crawl starts. Re-checks run daily unless you turn them off for that source; on the free trial there are no daily re-checks, only the ones you start.

4. End-user conversations

Conversations that visitors have with your bots are stored so that you can review them, power analytics, and provide conversational continuity. You control this data: you can delete individual conversations or all conversation data for a bot at any time. You are responsible for your own disclosures to your end-users (e.g. your privacy policy on the site where you embed the widget).

5. Connected systems and bot actions

You may connect external systems (via MCP servers) so your bots can look up live data and — where you attach such tools — perform actions in those systems. You are responsible for the systems you connect, the credentials you supply (stored encrypted, like provider keys), and the choice of which tools each bot may use. That choice now includes declaring what each tool does: when you attach a tool you state whether it only looks information up or changes data, and that declaration — not the connected system's own description of itself — is what decides whether a use of it stops for the visitor's confirmation. The system's claim is shown to you as a suggestion because it cannot be verified from here; a tool you have not marked read-only is treated as changing data. Where you connect a system by signing in to it (OAuth), you authorize ChitChat to access that system with the permissions you approve, under your own account there and subject to that system's terms; you can revoke that access at any time, from their side or by removing the connection here. Data-changing tools never run automatically: ChitChat requires an explicit, per-action confirmation from the person chatting before executing one, executes a confirmed action at most once, and logs every proposed, confirmed, declined, and executed action. However, the effect of an action inside the connected system — and the accuracy of that system's descriptions of its own tools — is between you and that system: ChitChat passes the confirmed request through and reports the result it receives, and where a system does not answer, ChitChat reports the outcome as unverified rather than assumed. You are responsible toward your end-users for the actions your bots make available to them.

Where you configure ChitChat to identify signed-in visitors, you are responsible for the correctness of the identity your website or identity provider asserts: ChitChat verifies the signature and the claims, and then acts faithfully on the subject it names. Keeping the signing key confidential is yours to do — a key pair, where you keep the private half, is offered precisely so that ChitChat cannot create a token in one of your users' names. Whether the connected system actually restricts its answer to the person ChitChat names is likewise between you and that system: ChitChat sends the verified identity and reports what comes back.

One consequence to be aware of when you attach tools. A tool you mark only for the signed-in visitor can never run for anyone who is not — the call is stopped on ChitChat's servers before anything reaches your system, and the visitor is shown a sign-in step instead. Its name and description, however, are visible to the assistant in every state, so an anonymous visitor who asks what the bot can do may be told that the capability exists. Its parameters are not exposed before sign-in. Choose the names and descriptions of the tools you attach accordingly.

Where you instead let visitors sign in from the chat, they authenticate at your own login and ChitChat holds the access token it issues for the length of that conversation — encrypted, scoped to the one connected system it was issued for, and destroyed on sign-out or when the conversation ends. What that token is allowed to reach is decided by your authorization server, not by ChitChat: the scopes it grants and the consent screen it shows your customer are yours to configure. Revoking it in your own system takes effect here at the next request.

6. Acceptable use

Don't use ChitChat to break the law, infringe others' rights, distribute malware, send spam, or build bots that deceive users into believing they are talking to a human in contexts where that matters. Don't attempt to breach or probe the service's security or other tenants' data.

7. Answers are generated by an LLM

Bot answers are machine-generated from your documents and may be wrong, incomplete, or outdated despite retrieval safeguards. You are responsible for how answers are used and for any decisions made based on them. Do not rely on bots for medical, legal, or financial advice.

The citation quotes shown under an answer are verbatim passages from your own documents, and the "Verified against sources" badge means a second automated check — run on your own model — found every checked claim supported by its sources: the cited passages, and, on answers built from connected live systems, the results those systems actually returned. That check is itself machine-made and best-effort: it reduces, but cannot eliminate, the possibility of an inaccurate answer, and its absence is not a warning label. Answers that fail the check are surfaced to you for review rather than shown to visitors with a warning.

8. Service, warranty, liability

The service is provided "as is", without warranty of any kind. We aim for high availability but do not guarantee it. To the maximum extent permitted by law, our total liability for any claim is limited to the amount you paid us for the service in the twelve months before the claim (currently: zero — the service is free during launch).

9. Termination

You can delete your bots, your data, or your account at any time. We may suspend or terminate accounts that violate these terms. On account deletion, your documents, keys, and conversation data are permanently removed.

10. Changes

We may update these terms as the product evolves; material changes will be announced in the dashboard or by email before they take effect.