This Privacy Policy explains how Andrii Kozak, a Poland-based individual owner and tax resident ("ChatDataMask", "we", "us", the "Data Controller"), handles data in connection with the ChatDataMask Chrome extension and the chatdatamask.com website (together, the "Service"). We designed the Service around data minimization required by the EU General Data Protection Regulation (GDPR) and the EU AI Act. The Service is used by people located in the EU, the United States, and other countries; where a right or obligation described below applies specifically to one region, we say so.
This policy has three distinct parts: (1) the core text-masking feature, which processes your text 100% locally and does not transmit masked content; (2) optional usage statistics, which are only sent if you choose to enable them; and (3) the optional Pro purchase, which necessarily involves limited data sharing with payment and email delivery providers so that we can process your purchase. We describe all three accurately below, rather than making a blanket "we never transmit anything" claim that would not hold true across every feature.
The text-masking functionality of ChatDataMask operates under a strict local-processing model:
All such data is cleared from session memory when you clear the screen, start a new session, or close the browser tab, as described in the extension's interface.
To provide local masking, the extension temporarily handles the following data types strictly in your browser's local memory (RAM) during your active session — none of it is transmitted anywhere by this feature:
ChatDataMask may collect limited usage statistics, but only if you explicitly enable this option in Settings — it is off by default. These statistics simply help us understand which features are used, so we can make the product more reliable and easier to use.
They may include the extension version, the type of action performed (e.g., opening the panel, masking or unmasking text), the interface used, your plan status, general text-length ranges, aggregate counts, fixed category identifiers, fixed error codes, short-lived random session identifiers, and the time of the event. They never include your text, personal data, masked values, mappings, clipboard contents, page URLs, or any content you process.
When enabled, these statistics are sent to a ChatDataMask-operated analytics relay at analytics.chatdatamask.com, which forwards the limited analytics data to Google Analytics 4. You can turn this option on or off at any time in the extension's Settings.
If you purchase the Pro Plan, we necessarily process a limited amount of data — separate from your masked text, which we never see — to deliver your purchase. This data is handled by the following processors on our behalf:
We do not sell, rent, or lease your data to any third party for their own marketing purposes. The processors above act strictly on our instructions to deliver the Service you purchased.
Our processors (Creem, Resend, Cloudflare, and — if you enable optional usage statistics — Google Analytics 4) may store or process data in countries other than your own, including the United States. Where this involves a transfer of EEA/UK residents' data outside the EEA/UK, such transfers are made subject to appropriate safeguards required by GDPR, such as Standard Contractual Clauses or an equivalent adequacy mechanism implemented by each processor. For more details on the specific transfer mechanisms and compliance measures used by our partners, you can review the Creem Data Processing Agreement and the Resend GDPR Compliance Statement.
If you are located in the EEA/UK, you have the right to: access the personal data we hold about you; request correction or erasure of that data; restrict or object to certain processing; request data portability; and withdraw consent where processing is based on consent. Because masked text never reaches us, most of these rights apply to your purchase/billing data held via Creem and Resend, and — if you have enabled it — your usage statistics. To exercise any of these rights, contact us at support@chatdatamask.com. You also have the right to lodge a complaint with your local supervisory authority — in Poland, this is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych – UODO).
If you are a California resident, you may have similar rights under the California Consumer Privacy Act (CCPA), including the right to know what personal data we hold and to request its deletion. If you are located elsewhere outside the EEA/UK, contact us at the same address and we will do our best to honor equivalent requests regardless of where local law makes them mandatory.
The Service is designed to help you exercise data-minimization practices consistent with:
Using the Service supports, but does not by itself guarantee, compliance with these frameworks — see Section 5 of our Terms of Use.
The Service is not directed at children under 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, contact us so we can delete it.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above. We encourage you to review this page periodically.
For any questions regarding this Privacy Policy or the Service's data practices, contact us at support@chatdatamask.com, or via the contact information provided in the Chrome Web Store Developer Dashboard.