CMS Chat (“we”, “us”, “cmschat.ai”) provides AI-powered website editing tools to agencies and their clients. This policy describes what we collect, how we use it, and your rights.
What we collect
- Account data: name, email, organization name, and role.
- GitHub data: repository names, file contents, and commit history for repos you explicitly connect via the CMS Chat GitHub App.
- Chat content: messages you send to the AI editor and the resulting code changes.
- Usage data: token consumption, change records, and audit logs for billing and abuse prevention.
- Cookies: session cookies for authentication only. We do not use ad-tracking cookies.
How we use it
- To operate the AI editor and create commits / pull requests.
- To bill correctly for token usage.
- To improve product quality (anonymized, aggregated metrics only).
- To respond to support requests.
We do not sell personal data. We do not use your code or chat content to train foundation models. AI requests are routed to OpenAI and Anthropic under their enterprise data-handling terms — your inputs are not used to train their models either.
Sub-processors
- Supabase — auth and database hosting (US/EU)
- OpenAI — AI inference (US)
- Anthropic — AI inference (US)
- Stripe — payment processing
- Vercel — application hosting
Your rights
You can export your data, delete your account, and revoke our GitHub App access at any time from your settings. EU/UK residents have additional GDPR rights — contact us at hello@cmschat.ai to exercise them.
Data retention
We retain account and audit data for as long as your account is active, and up to 90 days after deletion. Chat content is retained for 30 days unless you have opted into longer retention.
Security
All data in transit is encrypted via TLS. Repository access is scoped per-install via GitHub’s App permissions. We rotate credentials on a regular schedule. We are not currently SOC 2 or HIPAA certified — those certifications are on our roadmap.
Contact
Questions about this policy? Email hello@cmschat.ai.