Last Updated: 2026-08-23
Effective Date: 2025-12-01
1. Overview and Scope
Welcome to MultiChats Privacy Policy. This document outlines our commitment to protecting your privacy and explains how we handle your personal information. MultiChats is operated by YUKARI LABS, a private limited company (société à responsabilité limitée / besloten vennootschap) registered in Belgium under enterprise number 1033.402.366, with its registered seat at Cantersteen 47, 1000 Bruxelles. YUKARI LABS operates the website accessible at https://www.multichats.ai, mobile applications available on the Apple App Store and Google Play Store, and all associated services (collectively referred to as the "Platform").
By accessing or using our Platform, you acknowledge that you have read and understood this Privacy Policy. If you disagree with any aspect of this policy, we kindly ask you to refrain from using our services.
2. Information Collection Practices
To provide you with our services, we collect various types of information through different channels:
2.1 Direct User Interactions
When engaging with MultiChats, you may provide us with:
- Chat conversations and prompts submitted to our AI services
- Documents, images, and files you choose to upload
- Live microphone audio when you use speech-to-text or real-time voice calls. Audio is streamed to the applicable voice provider for immediate processing and is not stored on MultiChats servers
- Transcripts generated from voice input and voice calls. Voice-call transcripts that are added to a conversation are stored as chat messages
- Existing messages from the active conversation when they are supplied to a voice provider to give the voice assistant conversational context
- Feedback and support requests
- Account registration details
2.2 Technical Data Collection
Our systems automatically gather:
- Device specifications (operating system, browser type, device model, device identifiers)
- Usage patterns and interaction metrics
- IP address (used for rate limiting and abuse prevention) and approximate location (city/country level)
- Performance and error data
- App version information (mobile applications)
- Crash reports and error logs for troubleshooting
- Push notification tokens (when notifications are enabled)
- Voice usage and metering data, such as call identifiers, call duration, usage totals, selected model and voice pipeline, subscription tier, limit-allocation variant, call status, and timestamps
2.3 Tracking Technologies
We employ various technologies to enhance your experience across our Platform:
On our website:
- Cookies and similar technologies to maintain session security
- Local storage to remember your preferences
On our mobile applications:
- Secure local storage for authentication credentials
- Device-based session management
Across all platforms:
- Analytics to understand usage patterns and improve our services
- Performance monitoring to identify and resolve issues
3. Purpose of Data Processing
Your information enables us to:
- Deliver and maintain our core services
- Transcribe voice input, provide real-time AI voice conversations, and preserve voice-call transcripts in your selected conversation
- Measure voice usage, enforce plan limits, reconcile reserved call time, monitor costs, and prevent abuse
- Enhance platform security and prevent abuse
- Analyze and improve performance
- Communicate important updates
- Provide customer support
- Comply with legal obligations
Our Commitment: MultiChats does not use your conversations, prompts, uploaded content, or any other user-generated data to train AI models, improve algorithms, or for any purpose beyond delivering our services to you. We do not sell or share your data with third parties for their own commercial purposes.
4. Lawful Basis for Processing
Under the General Data Protection Regulation (GDPR), we process your personal data based on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|
| Core AI chat service & account management | Performance of contract (Art. 6(1)(b)) |
| Subscription billing & payment processing | Performance of contract (Art. 6(1)(b)) |
| Sharing limited subscription-usage information with Apple or Google when you request a refund from their store | Legitimate interest (Art. 6(1)(f)) — fraud and abuse prevention; consent (Art. 6(1)(a)) where the store requires it |
| Anonymous analytics (PostHog, cookieless mode) | Legitimate interest (Art. 6(1)(f)) — service improvement & cost monitoring |
| Cookie-based analytics tracking (PostHog) | Consent (Art. 6(1)(a)) — via cookie banner |
| Error monitoring & crash reports (Sentry) | Legitimate interest (Art. 6(1)(f)) — service reliability |
| Security & abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| IP address collection for rate limiting and abuse prevention | Legitimate interest (Art. 6(1)(f)) — service security |
| Voice-to-text transcription and real-time AI voice calls | Performance of contract (Art. 6(1)(b)) |
| Voice usage metering, limit enforcement, and cost monitoring | Performance of contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) — service integrity, abuse prevention, and cost control |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
5. Cookies and Tracking Technologies
Our website uses a consent-based approach to cookies and tracking:
5.1 Before Consent (Default)
When you first visit our website, analytics operate in cookieless mode (memory-only persistence). This means:
- No cookies or local storage entries are set for analytics purposes
- For signed-out visitors, anonymous analytics are session-scoped
- If you are signed in, analytics events are linked to your account identifier so that product usage can be understood per account. No cookies or local storage entries are set for this purpose
5.2 After Accepting Cookies
If you accept cookies via our consent banner, we enable cookie-based analytics persistence. This allows:
- Your browser activity is linked across sessions for improved analytics accuracy
- Account details such as your email address are attached to your analytics profile
5.3 After Rejecting Cookies
If you reject cookies, analytics remain in cookieless mode. Only a strictly necessary cookie (cookie_consent) is set to remember your choice. You can change your preference at any time by clearing your cookies and revisiting the site.
5.4 Strictly Necessary Cookies
The following cookies are exempt from consent as they are strictly necessary for the operation of our Platform:
cookie_consent — stores your cookie preference (1 year)- Authentication session cookies — required for logged-in functionality
6. Data Retention
We keep personal data only for as long as necessary for the purposes described in this Policy, and afterwards for as long as Belgian and EU law requires or permits us to keep it (for example to meet accounting obligations, to handle complaints, or to establish, exercise or defend legal claims). The periods below run from the moment the purpose ends, which for most data is when you delete a conversation or your account.
6.1 While your account is active
- Account data (name, email address, profile picture, preferences, memories, folders): for the lifetime of your account.
- Conversations, uploaded files and generated images: for the lifetime of your account, or until you delete the conversation. Deleted conversations are hidden immediately and removed from our systems within 30 days, unless one of the retention cases in 6.3 applies.
- Temporary chats: a safety copy may be kept for up to 7 days to detect and prevent abuse, then deleted.
- Voice-call transcripts: when added to a conversation, kept and deleted on the same basis as other messages. MultiChats does not store raw voice audio; audio is streamed in real time to the applicable voice provider under its own retention terms.
- Voice usage and call-metering records: for the lifetime of your account, to enforce usage limits and reconcile call time.
- Technical data (IP address and device information stored with conversation metadata, request logs, rate-limiting data): request logs for 30 days; rate-limiting data briefly in cache; IP and device information with the conversation it belongs to.
- Analytics data (PostHog): 12 months.
- Error logs and crash reports (Sentry): 90 days.
6.2 After you delete your account
When you delete your account, your conversations, uploaded files, generated images, memories, folders, preferences, login details and voice records are erased from our systems within 30 days, and your name, email address and profile picture are removed from the active service immediately. The following is then kept in a restricted archive that is not used for any product purpose and can only be accessed by our staff for the reasons stated:
- Account archive (your email address and name, the dates your account was created and deleted, your country, your subscription history and any internal notes about the account): 1 year after deletion, to handle complaints and data-subject requests, to prove that we carried out your erasure request, and to detect abusive re-registration. Basis: our legitimate interests (GDPR Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)).
- Payment and subscription records (transaction identifiers, products, amounts, currency, dates, store or payment provider, refunds): 7 years from the end of the financial year concerned, as required by Belgian accounting and tax law (Art. III.86 of the Code of Economic Law and the VAT Code). Basis: legal obligation (Art. 6(1)(c)).
6.3 Longer retention for disputes, abuse and legal obligations
In the cases below we keep more than the account archive, for 5 years after deletion (the Belgian limitation period for extra-contractual claims, Art. 2262bis §1 of the Civil Code), or for as long as a legal proceeding, official report, investigation or regulatory obligation concerning the account remains open if that is longer. The right to erasure does not apply to this data to the extent it is needed to comply with a legal obligation or to establish, exercise or defend legal claims (GDPR Art. 17(3)(b) and (e)); the bases are Art. 6(1)(c) and 6(1)(f).
- Payment disputes and fraud (a refund request, chargeback or similar dispute with us or an app store, or suspected fraud or abuse of our services, including a ban): in addition to the account archive, a usage record of your conversations: message timestamps, the AI model used, token counts and cost, message status, and whether you had deleted the conversation. This record contains no conversation content.
- Illegal content and serious violations of our Terms (for example content involving the sexual abuse of minors, credible threats of violence, terrorism, or other activity we are required or entitled to report): in addition to the above, the conversations and files concerned, together with the related technical data and moderation records, so that they can be provided to the competent authorities or used to defend a claim.
- Legal holds: where we receive a court order, a lawful request from an authority, or a notice of a claim, we keep the data it covers for the duration of the matter.
Data kept under this section is erased automatically when the period ends. Where the law allows, we pseudonymise it as soon as the identity is no longer required.
7. Service Providers and Data Processing
To deliver our services effectively, we collaborate with carefully selected service providers. Each provider processes specific aspects of your data under strict confidentiality and security requirements:
7.1 Infrastructure and Hosting
7.2 AI Technology Providers
- OpenAI: Powers certain AI chat functionalities
Privacy policy: https://openai.com/policies/row-privacy-policy/ - Google Gemini: Provides certain AI chat capabilities and Gemini Live real-time voice conversations. Voice calls may include live audio, generated transcripts, and relevant messages from the active conversation. Gemini Live may also use Google Search when needed to answer a voice request
Privacy policy: https://policies.google.com/privacy - Anthropic: Powers certain AI chat functionalities
Privacy policy: https://www.anthropic.com/legal/privacy - xAI: Powers certain AI chat functionalities
Privacy policy: https://x.ai/legal/privacy-policy - Mistral AI (EU): Powers certain AI chat functionalities. As a direct EU-based provider, requests are processed under its data processing agreement and are not used to train models.
Privacy policy: https://legal.mistral.ai/terms/privacy-policy - OpenRouter: Acts as a routing layer that connects open-weight models (for example Llama, GPT-OSS, DeepSeek, Qwen, Kimi, GLM and MiniMax) to third-party inference providers. These providers process your prompts as processors under a data processing agreement; they may transiently retain requests but do not train on or publish your data. International transfers, where applicable, rely on Standard Contractual Clauses.
Privacy policy: https://openrouter.ai/privacy - Inference providers for open-weight models: Requests for open-weight models are routed through OpenRouter to a fixed, vetted set of hosting providers: DeepInfra, Fireworks AI, Google Cloud Vertex AI, Amazon Bedrock, Groq and Microsoft Azure. Routing is pinned to this list on every request, and requests are additionally restricted to endpoints operating under zero-data-retention terms. A model being developed by a given company does not mean that company receives your data: the organisations listed here are the only ones that host these models for us and the only ones that receive your prompts.
- Deepgram: Powers speech-to-text transcription and a real-time voice-agent pipeline. Depending on the voice configuration, Deepgram may orchestrate speech recognition, the selected AI model, and speech synthesis using relevant conversation context
Privacy policy: https://deepgram.com/privacy - Cartesia: Provides speech synthesis for certain real-time voice calls
Privacy policy: https://www.cartesia.ai/legal/privacy
Google user data and Limited Use: If you sign in with Google, we receive only your name, email address and profile picture. MultiChats' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google is used solely to authenticate you and manage your account. It is never shared with, or transmitted to, any AI model provider or inference host, and it is never used to train, retrain or improve any AI model. The name an assistant uses to address you is the one you enter yourself in profile settings, not the one attached to your Google account.
User Responsibility: When you select a specific AI model provider within MultiChats, your prompts and conversations are processed by that provider according to their own privacy practices. We strongly encourage you to review the privacy policy of each AI provider before using their models. Data handling practices—including whether your data may be used for model training—vary between providers. MultiChats cannot be held responsible for how third-party AI providers process your data in accordance with their respective privacy policies.
7.3 Analytics and Monitoring
- Sentry: Provides crash reporting and error monitoring for our mobile applications
Privacy policy: https://sentry.io/privacy/ - PostHog: Analytics platform used to understand usage patterns, including voice-feature events such as call duration, turn and interruption counts, transcript character counts, selected model and pipeline, limit events, and remaining or billed usage. These analytics events do not contain raw voice audio
Privacy policy: https://posthog.com/privacy
7.4 Payments and Subscription Management
- RevenueCat: Manages in-app subscriptions purchased through the Apple App Store and Google Play Store, including purchase validation, subscription status, and refund-request handling
Privacy policy: https://www.revenuecat.com/privacy - Polar: Processes subscription payments made on our website as merchant of record
Privacy policy: https://polar.sh/legal/privacy - Apple and Google: When you purchase through the App Store or Google Play, payment is processed by Apple or Google under their own terms and privacy policies. They act as independent controllers for that payment data; we never receive your full payment details.
Refund requests made to Apple or Google: When you request a refund for an App Store or Google Play purchase, the store may ask us whether the purchase was used before deciding on your request. In that case we may share, via RevenueCat, limited information about your account and subscription with Apple or Google: for example whether and for how long the subscription was used, your account tenure, the platform of purchase, and prior refund history. This information never includes your conversations, prompts, or any content you created on the Platform. We share it to help the store make a fair decision and to prevent fraud and abuse; the refund decision itself is always made by Apple or Google, not by us.
8. Mobile Device Permissions
Our mobile applications may request access to certain device features to provide full functionality:
- Camera access: Used to take photos that can be submitted for AI analysis. This permission is only requested when you choose to use this feature.
- Photo library access: Used to select existing images from your device for AI analysis. This permission is only requested when you choose to upload images.
- Microphone access: Used for voice messages (speech-to-text) and real-time voice calls with AI assistants (mobile). Audio is streamed in real time to our transcription and voice providers and is not stored on our servers. We do not use voice audio to create voiceprints or for biometric identification. This permission is only requested when you activate voice messages or start a voice call.
These permissions are optional and can be revoked at any time through your device settings. The app will continue to function with limited features if permissions are not granted.
9. Push Notifications
Our mobile applications may offer push notifications to keep you informed about:
- Important service updates and announcements
- Chat and conversation notifications
- Account-related alerts
To deliver push notifications, we collect and store device tokens provided by Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM). You can opt out of push notifications at any time through your device settings or within the app.
10. Your Privacy Rights
Under the GDPR and applicable Belgian data protection laws, you have the right to:
- Access your personal data
- Correct inaccurate information
- Request data deletion (right to erasure)
- Object to certain processing activities
- Export your data in a portable format (data portability)
- Withdraw consent for optional processing (e.g., cookie-based tracking)
- Restrict processing of your personal data
How to exercise your rights: You can delete your account and all associated data directly from your account settings. You can also export your data from the Import / Export section in Settings. Alternatively, email contact@multichats.ai and we will respond within 30 days.
Right to lodge a complaint: If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA):
Autorité de protection des données (APD) / Gegevensbeschermingsautoriteit (GBA)
Rue de la Presse 35, 1000 Brussels, Belgium
Phone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Website: https://www.dataprotectionauthority.be
11. Data Security Measures
We implement industry-standard security measures to protect your information, including:
- Encryption of data in transit and at rest
- Regular security assessments
- Access controls and authentication
- Monitoring for suspicious activities
12. International Data Transfers
While MultiChats is based in Belgium and operates under Belgian law, our service providers may process data in various locations globally. We ensure appropriate safeguards are in place for these international transfers, complying with European data protection requirements.
13. Age Restrictions
Our services are not designed for or directed at individuals under 18 years of age. We do not knowingly collect or maintain information from children. If we become aware that we have inadvertently collected such information, we will take steps to delete it.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes through our Platform or via email.
15. Contact Information
For privacy-related inquiries or to exercise your rights, please contact us at:
YUKARI LABS
Cantersteen 47, 1000 Bruxelles, Belgium
Enterprise number: 1033.402.366
Email: contact@multichats.ai