Chaos

Privacy Policy

Last updated: 22 July 2026

Chaos (“we”, “us”) helps organisations run work check-ins and chase through WhatsApp and a manager web app. This policy explains what we collect, why, and your choices. It applies to the Chaos product and related websites (including this site). The WhatsApp agent may appear as Chaos.

1. Who this covers

Workspace owners and managers who create an organisation, and people (ICs) whose phone numbers are added so they can message Chaos on WhatsApp.

2. Data we process

  • Account data: name, phone, email (if provided), role, organisation name, plan.
  • WhatsApp content: inbound/outbound messages needed for check-ins, work updates, blockers, and templates you configure.
  • Work data: work items, blockers, check-ins, events, and related metadata (e.g. timestamps, message ids for idempotency).
  • Technical logs: server logs, IP and device hints as needed for security and debugging.
  • Billing ops: plan, seats, invoice contact details (no card checkout in product today).

3. Why we process it

  • Provide the service (routing messages, Chaos, Board, silent chase templates).
  • Secure accounts and prevent abuse.
  • Improve reliability (e.g. understanding failed deliveries) — not for advertising profiles.
  • Meet legal obligations when required.

4. WhatsApp and Meta

Messaging uses Meta WhatsApp Cloud API (platform Chaos agent and/or your connected business number). Meta’s processing is governed by Meta’s terms and policies. We receive webhooks and send messages using tokens you or we configure. Do not put sensitive secrets in check-in text that you would not share with your manager.

5. Sharing

We do not sell personal data. We share data with processors who help us run the product (e.g. hosting, email SMTP, LLM providers if you enable natural-language parsing). Those processors may only use data to provide their service to us. We may disclose information if required by law or to protect rights and safety.

6. Retention

We keep organisation data while the workspace is active and for a reasonable period after closure or inactivity for backups, disputes, and legal needs, then delete or anonymise where practicable.

7. Security

We use access controls, encrypted transport (HTTPS), and least-privilege tokens where applicable. No method is perfectly secure; report issues to the contact below.

8. Your rights and choices

  • Managers can update or remove people and work data in the product.
  • You may request access, correction, or deletion of personal data we hold, subject to legal exceptions.
  • ICs can ask their organisation admin to correct phone or profile details.
  • Optional LLM features are off by default; enabling them sends relevant message text to the configured model provider.

9. Children

Chaos is for workplace use. It is not directed at children under 16.

10. International transfers

Infrastructure and processors may be outside Uganda. Where we transfer data, we take steps appropriate to the risk and applicable law.

11. Changes

We may update this policy. We will revise the date above and, for material changes, notify workspace admins when practicable.

12. Contact

Questions about this policy: chaos@yugiautomate.com