ProChat

Privacy Policy

Effective and Last Updated: September 5, 2026

This Privacy Policy explains how Henry Santoro, an individual who owns and operates ProChat under the name "ProChat" ("ProChat," "we," "us," or "our"), collects, uses, discloses, and retains personal information when you use ProChat's websites, applications, Premium plans, gifting features, and related services (the "Service").

1. Controller and Contact Details

Henry Santoro is the controller of personal information handled for ProChat, except where a provider acts as an independent controller for its own purposes. Privacy questions and requests may be sent to [email protected] or mailed to:


Henry Santoro / ProChat
PO Box 682
Rollinsford, NH 03869
United States

2. Information We Collect

Account and Authentication Information

  • Username, email address, password hash, verification status, account creation date, settings, saved channels, and account status.
  • Policy versions accepted, acceptance timestamps, IP address, and browser user agent used to document acceptance.
  • If you use Google, Twitch, or Kick authentication: provider account identifier, email, display name, profile image, linked date, and login information supplied by that provider.
  • Authentication and security data, including session and refresh tokens, token identifiers, login timestamps, remembered-session choices, password-reset information, rate-limit information, and account-deletion verification data.

Connected Platforms and Chat Information

  • Connected platform account and channel identifiers, usernames, display names, channel URLs, profile images, granted OAuth scopes, access-token metadata, and encrypted refresh tokens where stored.
  • Live chat messages and events, public chatter identifiers, display names, profile images, moderation state, livestream details, and related timestamps received from or sent to YouTube, Twitch, Kick, TikTok, X, Rumble, or other supported services.
  • User-initiated messages and moderation instructions that ProChat transmits to a connected platform on your behalf.

Usage, Device, Support, and Communications

  • IP address, browser and operating-system information, referring page, requested page or API route, request and correlation identifiers, access time, response status, performance data, error information, security events, and abuse-prevention signals.
  • Product interactions, feature usage, connected-platform counts, channel counts, page views, browser diagnostics, and masked session replay when you consent to optional browser analytics.
  • When you use a ProChat-managed promotional link: its short campaign code and associated source, medium, campaign, and content values; aggregate redirect-request counts; and, if you create an account, attributed signup, first-channel, and first-paid-Premium milestones. ProChat does not store your IP address, browser identifier, or user agent with the aggregate redirect request.
  • Messages, screenshots, attachments, receipts, and account details you provide when requesting support, a refund, privacy assistance, or dispute resolution.
  • Transactional email delivery and suppression information and, if you receive marketing email, campaign delivery, engagement, and unsubscribe information.

Payments, Premium, and Gifts

  • Stripe information: ProChat account ID, username, and email; Stripe checkout and transaction identifiers used to process payments, deliver purchases, issue refunds, and manage disputes; subscription status; amount; currency; country; postal code; tax and promotion information; billing timestamps; and limited fraud or risk information returned by Stripe. Stripe collects payment-method, billing-address, tax-identification, and compliance information directly. ProChat does not receive or store your complete card number or card security code.
  • Gift order information: Purchaser and recipient account identifiers, purchaser username, gift type, creator code or direct-recipient username, recipient count, months, amount, currency, delivery and entitlement status, active or banked dates, public leaderboard eligibility, refund status, dispute status and outcome, and deletion or anonymization markers.
  • Gift checkout evidence: Terms, Privacy Policy, and gift-disclosure versions; acceptance time; confirmation of adult payment-method authorization; immediate-delivery request; withdrawal-right acknowledgment; IP address; browser user agent; authenticated session identifier; request identifier; account; and order identifier.
  • Refund, dispute, and fraud evidence: Support messages, Stripe records, delivery records, relevant security logs, and evidence reasonably needed to prevent duplicate delivery, respond to a payment dispute, establish authorization, or investigate suspected abuse.

Gifting Eligibility and Public Information

  • To select random gift recipients, ProChat evaluates whether an account is verified, was active within the preceding 30 days, has opted in to receiving gifts, and lacks active paid, complimentary, or gifted Premium. The purchaser does not receive the underlying activity or subscription-status information used for selection.
  • Creator usernames, stable gift links or codes, gift-acceptance status, and received-gift totals may be public. A user's public gift page remains visible after opting out, but states that the user is not accepting gifts and disables checkout.
  • Purchaser usernames, ranks, delivered gift months, and gift counts may appear on global and recipient-specific public leaderboards. Username visibility is enabled by default and can be disabled in Settings → Premium → Gifting. Aggregate totals may remain public without the purchaser's username.

3. How We Use Information

We use personal information to:

  • Create, authenticate, secure, support, and delete accounts.
  • Connect third-party platforms; display live chat; and perform user-requested messaging and moderation actions.
  • Monitor reliability, diagnose failures, measure product usage, and improve the Service.
  • Measure promotional-link performance from aggregate requests through verified signup, first channel, and paid Premium activation.
  • Provide transactional notices and support and, where permitted, send marketing email that can be unsubscribed from at any time.
  • Process subscriptions and gifts; calculate access; select eligible random recipients; replace unavailable random recipients; issue approved full-order refunds; and manage cancellations, chargebacks, disputes, taxes, and accounting records.
  • Document purchase authorization and policy acceptance; detect duplicate fulfillment, fraud, account compromise, or abuse; enforce the Terms; and protect users and the Service.
  • Operate public gift pages, gift totals, and leaderboards according to user settings.
  • Comply with law, lawful requests, tax obligations, and the establishment, exercise, or defense of legal claims.

We do not use Google user data or YouTube API Data for targeted advertising, sale to data brokers, credit or lending decisions, or training generalized artificial-intelligence models.

4. Legal Bases for EEA and UK Processing

Where EEA or UK data-protection law applies, we rely on:

  • Contract: to create your account, connect requested services, deliver Premium and gifts, provide support, and enforce the Terms.
  • Legitimate interests: to secure and operate ProChat, prevent fraud and abuse, maintain essential server logs, diagnose failures, measure first-party promotional-link performance, protect legal claims, and improve the Service, balanced against your rights.
  • Consent: for optional browser PostHog analytics and session replay and where consent is required for marketing or connected-platform access. You may withdraw consent prospectively.
  • Legal obligation: for tax, accounting, consumer-protection, sanctions, law-enforcement, and other duties.
  • Legal claims: where processing is necessary to establish, exercise, or defend a claim.

5. Google and YouTube API Data

ProChat uses YouTube API Services. Use of those features is subject to the YouTube Terms of Service and the Google Privacy Policy. ProChat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements.

Depending on the connected features you choose, ProChat may request YouTube scopes needed to read connected channel and live-chat information and to carry out user-initiated chat or moderation actions. We use that data only to provide or improve user-facing ProChat functionality, secure the integration, and provide support.

6. When We Disclose Information

We do not sell personal information and do not share it for cross-context behavioral advertising. We disclose information as follows:

  • Connected platforms: Google/YouTube, Twitch, Kick, and other platforms receive authentication or user-requested actions and provide data needed for the features you use.
  • OVHcloud: infrastructure and production hosting in the United States and Canada.
  • PostHog Cloud: optional browser analytics, masked session replay, product measurement, and limited server-side operational events. ProChat's default code endpoints are PostHog's United States endpoints; PostHog's processing and subprocessors remain governed by its services and Privacy Policy.
  • Stripe: payment processing, Checkout, subscriptions, billing portal, tax calculation where configured, refunds, fraud prevention, and dispute management. See Stripe's Privacy Policy.
  • ZeptoMail: transactional, account, security, billing, and service email.
  • Zoho Campaigns: promotional and marketing email, including unsubscribe and suppression handling. Each campaign email includes an unsubscribe link.
  • Public viewers: public gift-page and leaderboard information described above.
  • Professional, legal, and compliance recipients: advisers, insurers, auditors, banks, card networks, payment-dispute participants, or authorities when reasonably necessary to obtain advice, respond to a dispute, investigate fraud, comply with law, or protect rights and safety.
  • Business transfers: a buyer, successor, or participant in a proposed reorganization or transfer of ProChat, subject to confidentiality and applicable law.

Providers may process information as ProChat's processors or, for some functions such as payment compliance, as independent controllers under their own policies.

7. Cookies, Local Storage, and Analytics Choices

ProChat uses essential cookies and similar storage for authentication, security, session continuity, OAuth state, and user preferences. The Service may not function correctly without essential storage.

Optional browser analytics does not start unless you choose "Accept optional analytics." If accepted, PostHog may collect page views, page exits, device and browser information, product interactions, error diagnostics, identifiers tied to a logged-in ProChat account, and session replay. Inputs are configured to be masked, but you should not enter sensitive information unnecessarily. Your choice is stored in browser local storage. You may change it at any time using the "Privacy choices" control; declining stops optional browser capture and reloads the page when necessary.

ProChat-managed promotional links use a short campaign code in the URL and do not set a marketing cookie. ProChat records an aggregate redirect request and, if you create an account through that link, stores the validated campaign metadata and attributed account milestones as part of the account record. This first-party attribution occurs regardless of the optional PostHog browser-analytics choice. PostHog receives the resolved campaign properties only when optional browser analytics is accepted.

Regardless of the optional browser choice, ProChat processes limited server-side logs, metrics, and error events needed for security, fraud prevention, request handling, and reliability. These operational records do not include browser session replay. Some limited operational events may be sent to PostHog under ProChat's legitimate interests.

8. Your Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or an appeal of a denied request. You may also have a right to complain to a privacy or data-protection authority. These rights are subject to identity verification and lawful exceptions, including records needed for transactions, fraud prevention, security, tax, disputes, and legal claims.

Send a request to [email protected]. Describe the request and identify the relevant account. We may ask for information reasonably necessary to verify that you control the account. Authorized agents must provide proof of authority where required. We will not discriminate against you for exercising a privacy right.

To stop marketing email, use the unsubscribe link in a Zoho Campaigns message. To withdraw optional browser analytics consent, use the persistent "Privacy choices" control in ProChat.

9. Retention

We retain information only as long as reasonably necessary for the purposes described above. Our standard schedule is:

  • Active account, configuration, and connected-platform data: while the account or connection remains active, then deleted or anonymized subject to the exceptions in this section.
  • Live chat messages stored by ProChat: thirty days.
  • Security and access logs: twelve months, unless linked to an investigation, fraud matter, payment dispute, security incident, or legal claim requiring longer retention.
  • Support communications: three years after the support matter is closed, unless a longer period is needed for an active dispute, legal requirement, or claim.
  • Gift, payment, gift-acceptance, refund, and dispute records: seven years after the transaction or, if later, final dispute resolution.
  • Deleted data in backups: up to ninety days before deletion or overwrite through the backup cycle, unless isolated for security recovery or legal preservation.
  • Marketing suppression records: minimal information for as long as needed to remember and honor the unsubscribe.
  • Promotional-link attribution: account-level campaign attribution while the account remains active; aggregate or de-identified redirect totals may be retained longer for historical campaign measurement.

Retention can be extended when law requires it, when reasonably necessary for an active dispute, fraud or security investigation, or legal claim, or when deletion is technically delayed. Third-party providers maintain their own copies under their retention schedules and legal obligations. Aggregated or de-identified information may be retained longer when it can no longer reasonably identify a person.

10. Account Deletion and Platform Disconnection

You may request and confirm account deletion in Settings → Account. You may disconnect a linked platform in Settings → Connections and may revoke Google access at Google's connections page.

After confirmed deletion, ProChat removes the active user record, credentials, connected-platform tokens, account settings, and associated API data and revokes tokens where practicable. Deletion also cancels recurring billing where supported. A recipient loses remaining gifted Premium tied to the deleted account. Public leaderboard attribution is removed or anonymized, while aggregate completed-gift totals may remain.

Deletion is not instantaneous or absolute across every system. Limited transaction, tax, policy-acceptance, refund, dispute, security, fraud-prevention, suppression, and legal records may remain for the retention periods above. Stripe and other providers may retain records under their own obligations. Backup copies expire through the normal backup cycle.

11. International Transfers

ProChat is operated from the United States, is available worldwide, and uses infrastructure in the United States and Canada. Providers may process information in other countries. Those countries may have different privacy laws. Where required, we rely on an adequacy decision, contractual safeguards such as standard contractual clauses, provider transfer mechanisms, consent, or another lawful transfer basis. Contact us to ask about safeguards relevant to your information.

12. Security and Incident Notice

ProChat uses measures intended to protect information, including TLS in transit, password hashing, encrypted OAuth refresh tokens where stored, access controls, secure cookies, rate limits, webhook signature verification, monitoring, and restricted operational access. No system is completely secure. If an incident creates a legally reportable risk, we will notify affected people and authorities as required by applicable law.

13. Children

ProChat is not intended for children under 13, and we do not knowingly collect personal information from a child under 13. Users under the age of legal majority must have parent or guardian permission to use the Service. Purchases must be made by an adult payment-method holder or with that adult's authorization. If you believe a child under 13 provided information, contact us.

14. Third-Party Services and Links

Third-party websites, streaming platforms, payment services, and authentication providers have their own privacy practices. This Privacy Policy does not control their independent processing. Review their policies before using those services.

15. Changes to This Policy

We may update this Privacy Policy as the Service, providers, law, or data practices change. We will post the effective date and provide additional notice where a change is material or law requires it. ProChat may require existing users to review and accept material policy updates before continuing to use the Service.