Privacy policy

DOT is a business chat app for Android, iOS and the web, published by COMNET INTERNATIONAL (L.L.C), Shop No. 13, 14, 15, Mam Building 3, Al Nahdha Street, Al Suq Al Kabeer, Bur Dubai, Dubai 49781, United Arab Emirates (“we”, “us”). For anything in this policy, write to info@chat-dot.com.

Your account. To register you give an email address and a password. We send a verification email, and your account does nothing until you confirm it. You may sign in with Google instead, in which case Google tells us your email address, name and profile picture. We never see your Google password.

Your profile. A display name, an optional profile photo, an optional username, and the privacy choices you make.

Your business, if you register one. Business name, description, category, addresses and map coordinates, opening hours, phone numbers, email addresses, website and social links, branches, listings, staff members and their roles, and any licence or registration documents you upload for verification.

What you send and receive. Messages, photos, videos, documents, voice messages, locations you share, form answers, orders and requests, group and channel content, internal notes, customer labels and notes, and the metadata that makes a conversation work: who sent what, when, delivery and read state. We hold message content sealed and cannot read it; Part 1 says exactly what that covers and what it does not. Searching the archive on our servers works on a scrambled fingerprint of each word, never the word, which is why it matches whole words only and cannot match a phone number. Your own phone searches the conversations it holds in full.

Your status posts. A photo or a few words you put up for six to forty-eight hours, the audience you chose for it, who opened it, and any reactions. Unlike a message, a status is not sealed, and we can read it. The app says so in the composer before your first post.

Calls. Who called whom, when, and for how long. We do not record calls. One-to-one calls connect directly between the two devices where the network allows it. Group calls pass through Cloudflare’s Realtime service, which relays the audio and video and does not store it.

Your contacts, if you allow it. With your permission, DOT finds people you know by the email addresses in your phone’s contacts, and keeps them up to date on its own. You can also import a contacts file. Your device sends us those email addresses, including those of people who do not use DOT. We store only a keyed cryptographic hash (HMAC-SHA256) of each address, never the readable address, and we do not log them. The hashes let us tell you when someone you know joins. They cannot be read back. Each new check or import replaces the old set, and it is deleted when you close your account. Phone numbers are never used to find anyone.

Devices and sessions. Device model, operating system, app version, language, time zone, push notification tokens, and the sign-in history shown to you in Settings. We use Google Play Integrity (Android) and App Attest (iOS) to check that requests come from a genuine installation of DOT.

Usage and crash data, if you allow it. Screen views and feature events through Google Analytics for Firebase, and crash reports through Firebase Crashlytics. You can turn usage sharing off in Settings; when you do, we ask Google to delete what was collected from your installation.

Each of these is asked for when you first use the feature, and refusing it only disables that feature.

DOT runs on Google Firebase. Data is stored in Google Cloud, with server functions in the asia-south1 (Mumbai) region. Everything travels over current TLS and is encrypted at rest with managed, rotated keys. On top of that, your messages are end-to-end encrypted. Part 1 is part of this policy and sets out what that covers, what it does not, and its limits.

• The business you message. A conversation with a business belongs to that business, not to the individual employee, and stays with the business when staff change. Part 1 says which staff can read it.
• Other participants. Members of a group, and people you message, see what you send. Channel followers see what a channel publishes; a channel admin cannot see who viewed an update.
• Google (Firebase: authentication, database, file storage, server functions, push notifications, analytics, crash reporting; Google Maps for maps, and Google Sign-In if you use it), as our processor.
• Cloudflare, which relays group call audio and video without storing it.
• Google Drive or iCloud, only if you turn on backup. The backup goes to your own account, under access limited to the files DOT creates on Drive and to DOT’s own private folder on iCloud, and neither Google nor Apple can open it.
• Authorities, where we are legally obliged to disclose, or to protect someone’s safety.

We do not sell personal data and we do not share it for advertising.

Conversations under a legal hold are kept until the hold is lifted.

• Export your data. Settings › Privacy gives you a machine-readable copy of your own data. The download link lasts 7 days.
• Delete your account. Settings › Account. Deletion is permanent and reaches our databases, file storage, the scrambled search fingerprints, caches, analytics and backups within 30 days. Content you sent into a business conversation may be retained by that business where it has a legal reason to keep it.
• Control what others see. Read receipts, last seen and presence, profile photo visibility and location sharing are each switchable.
• Turn off usage sharing in Settings, at any time.
• Block and report. Any user can be blocked, and any user, message or business reported to us.
• Depending on where you live, you may also have the right to access, correct, restrict or object to our processing of your data, and to complain to your data protection authority. Write to info@chat-dot.com and we will answer within 30 days.

Our legal bases, where the GDPR applies, are: performance of our contract with you (running the service), your consent (contacts, location, usage sharing, backup), our legitimate interests (security, abuse prevention, service improvement), and legal obligation.

DOT is not for children under 13. Where your country sets a higher age for consenting to data processing, that age applies instead. We do not knowingly collect data from them. If you believe a child has an account, write to us and we will remove it.

Your data may be processed in countries other than yours, including by Google and Cloudflare. Where the law requires it, these transfers rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

If we change this policy materially, we will tell you in the app before the change takes effect. The date at the top always shows the current version.

COMNET INTERNATIONAL (L.L.C)
Shop No. 13, 14, 15, Mam Building 3, Al Nahdha Street, Al Suq Al Kabeer, Bur Dubai, Dubai 49781, United Arab Emirates
+971 56 257 7000
info@chat-dot.com

Sections 1 to 10 describe the DOT apps. This section covers our website, chat-dot.com, including the “Get notified” launch list.

What we collect

If you enter your email in a “Get notified” form, we store your email address, which form on the page you used, and the date and time you signed up. Our servers also receive technical information with each request: your IP address, browser type, the page requested, the referring page and the time of the request.

We don’t ask for your name, phone number or payment details on this website. It sets no cookies and uses no analytics tools, advertising pixels or third-party trackers, and our fonts are served from our own servers.

Why, and on what basis

• To email you when DOT launches, and with occasional important updates about the launch. We rely on your consent, which you can withdraw at any time.
• To prevent spam and repeated automated sign-ups, and to keep the website secure and working properly. We rely on our legitimate interests.

How long we keep it

• Launch-list emails: until DOT launches and we have let you know, or until you ask us to remove you, whichever comes first.
• Rate-limit data: your IP address, held in memory for up to ten minutes.
• Server logs: kept for a limited period for security and troubleshooting, then deleted.

Sharing and security

We only share this information with service providers who host and run the website and send our emails, under terms that let them use it solely to provide that service to us, or where the law requires it. The website is served over HTTPS, and access to stored sign-ups is restricted to the people who need it.

To have your email removed or to use your other rights, email info@chat-dot.com from the address you signed up with. For help with DOT itself, contact support@chat-dot.com.