On this page
1.Who we are
DaloChat is run by Dalo Desk, an independent product studio based in Phnom Penh 120000, Cambodia (“DaloChat”, “we”, “us”). We decide how account holders' details are used, as section 2 explains.
DaloChat runs at chat.dalodesk.com. It connects a business's own Telegram bot to its team's Telegram group, with a dashboard and AI features. Dalo (dalodesk.com), which makes the KHQR codes you pay with, is also made by Dalo Desk.
This policy covers our website, the dashboard, the bots we run for businesses, and the “Try it” demo. Our Terms of Service explain the rules for using DaloChat.
2.Whose information it is
DaloChat holds information about two kinds of people:
- Account holders: business owners and their teammates who sign in to DaloChat. For your account details, DaloChat decides how they're used, as this policy describes.
- A business's customers: people who write to a bot that a business runs on DaloChat. The business decides why it collects their information and how it uses it. DaloChat keeps and processes that information on the business's behalf, following its instructions and our Terms of Service.
Are you a customer of a business that uses DaloChat? Please contact that business first about your information. If you write to us, we'll pass your request to the business and help it answer.
3.What we keep
Your account
- Your email address (or, for a staff login, its username) and name, and the name you're shown by in each project.
- Sign-in codes: we keep only a scrambled (hashed) form, never the code itself. A code works once, and stops working after 10 minutes or 5 wrong tries.
- Sign-in sessions: a record that you're signed in. It ends when you sign out, or after 30 days without use if you ticked “Keep me signed in” (12 hours if you didn't).
- Staff logins: for staff without email, a username and a salted password hash. A project's owner or admin makes the login and sets its password.
- Other passwords: older accounts that signed up with a password keep a salted password hash too, and so does an account whose password our team set when its owner was locked out. Setting a new password signs that login out everywhere.
- When you last signed in, the projects you belong to, and your role in each.
- Invite links a project creates, which expire after 7 days.
- A log of important actions in a project, such as who invited a teammate, connected a bot, made a payment or looked something up in a connected system, so the owner and our support can see what happened.
Your project
- The project's name and settings: welcome messages, AI instructions and business details, quick topics, one-tap replies, labels, and what to track about people.
- Your bot's username and token, and the Telegram ids of your team groups. The bot token is stored encrypted.
- Integrations you connect: their names, addresses and keys. Keys are stored hashed and encrypted.
- Your teammates' Telegram first names, where they appear on messages sent from the team group.
Your customers (people who write to your bot)
- Their Telegram id, first and last name and username, as Telegram shares them with the bot.
- When they first and last wrote, and the language their chat is translated into, if it is.
- Their messages and the replies from your team and the bot, including edits. For photos, voice notes, videos, files, stickers, locations and contacts, DaloChat keeps a short marker and Telegram's id for the file. The file itself stays on Telegram, and the dashboard fetches it from Telegram when your team opens it.
- Voice notes written down as text, and translations of messages.
- A note on each person, written by AI from their chats: who they are, their role and team, what's still open, their mood, anything urgent and a short history. Email addresses and phone numbers are left out of these notes. Your team can add its own note, which takes priority.
- Labels your team gives them, and their answers to the questions your project chooses to track.
- How each chat is going: how many messages, when they were sent, how quickly your team replied, which teammate the chat is assigned to, and the outcome your team marks (for example bought or too expensive).
- The product or item a person asked about, when they open your bot from a link that names one.
- Messages to many people: the text and photo, who each one was for, and whether it was delivered, failed or was stopped.
- If your business connects its own system: what that system says about the person (an account id, name, email, business name, plan and status). The AI is never given the email address.
Copies of these chats also exist in Telegram: in the person's chat with the bot, and in your team group.
Documents and what DaloChat learns
- Documents your team adds (price lists, FAQs, schedules): we keep their text, split into sections, and search entries built from it. PDFs added on the dashboard are read in your browser, so only their text reaches us. A PDF, text file or photo sent to the bot in your team group with a question is read by AI to answer it.
- Answers suggested from your team's replies, with the customer's question and the team reply they came from, for your team to approve or dismiss.
- Reminders drafted from a schedule, and changes proposed by Ask DaloChat, while they wait for your OK.
- Insights: short notes of what your team or bot told customers on topics such as prices, dates and availability, with the line each one came from.
Payments
You pay by KHQR from your own banking app (our payment provider Dalo makes the code) or by bank transfer. Either way, the money goes to our account at ABA Bank. We keep the invoice number, plan, number of months, amount, currency, status and dates, Dalo's id for the payment, and the payment link. DaloChat doesn't store card numbers or bank account details. Like any bank transfer, our bank's records show us who paid, such as the payer's name and account.
Usage and costs
For each project we count, per month, new chats, messages, AI answers and seconds of voice notes. We keep an hourly tally of activity: messages in, replies from the team and the bot, new people, how fast replies came, and simple counts about how the team writes, such as message length and how many replies were voice notes. We also record what the AI cost, by feature and model, and our own database use per day. These counts drive your plan's limits, your Home page and Insights, and help us keep costs in check.
The “Try it” demo
When you try the demo at /try, we create a random code that lasts 24 hours and note which sample business you picked. To stop abuse, we keep a scrambled (hashed) form of your network address, never the address itself. When you open the demo bot with your code, your chat with it is stored like any other chat, in our own demo project: your Telegram id, name, username and messages. The demo page shows only the chat that carries your code.
Asking for a demo account
When you ask for a demo account on our request form, we keep your name, your business's name, your email, your Telegram username or phone number (or both), the note you add, if any, and when you sent it. We use these to set up your demo account and to contact you about it. The request is saved in our database, where our team marks it as handled, and our email provider Resend sends a copy to our support inbox (see section 6). To stop abuse, we count requests under a scrambled form of your network address, never the address itself, and clear those counts after about 15 minutes. If the same email asks again within a day, nothing new is kept. If we set up a demo account for you, what you do in it is kept like any other account and project, as this policy describes.
Visiting the website, signing in and writing to us
When you use the website or dashboard, our hosting provider Cloudflare handles your network address and browser details to deliver the pages and protect the service. To limit abuse of sign-in codes, we count requests under a scrambled form of your network address and email, and clear those counts every 15 minutes. Email to [email protected] is received by Cloudflare and passed on to the mailbox our team reads, where your message and our reply are kept so we can help you.
4.How we use it
- To run DaloChat: pass messages between your bot and your team group, show your dashboard, send the messages you schedule, and post updates in your team group.
- To run the AI features your plan includes.
- To sign you in and keep accounts and projects secure.
- To take payments, apply your plan, and remind you before it ends.
- To count use against your plan's limits and show you your numbers.
- To give support, fix problems and improve DaloChat.
- To meet our legal obligations and protect DaloChat, the businesses that use it and the public.
We don't sell personal information, we don't show ads, and we don't use your chats to train AI models of our own.
5.AI and your information
- On every paid plan, AI writes the note on each person and builds Insights from the chats, in the background.
- With the AI add-on, AI also answers customers from your documents, translates chats, writes voice notes down as text, drafts reminders, runs Ask DaloChat, and suggests answers learned from your team's replies.
- For each task, DaloChat sends an AI provider the text the task needs: for example the customer's message, recent messages in the chat, the note on that person, and the relevant parts of your documents and instructions, and, when your business connects its own system, what that system says about the person (name, business name, plan and status, never the email) and the records it returns, such as payments or orders. Voice notes are sent as audio to be written down, and PDFs, text files and photos sent to the bot in your team group are sent to be read.
- AI providers process this to produce an answer and send it back. They handle it under their own terms and privacy policies.
- A project's owner can switch off AI replies, notes on each person, learning from team replies, translation, and voice notes written as text in Settings.
- Insights reads chats on every paid plan and has no switch in Settings. If you need it off, write to us.
6.Who processes it for us
We use these providers to run DaloChat. Each receives only what its part of the work needs.
If your business connects its own system, DaloChat sends that system a person's Telegram id (and the code from its own sign-in link, if there is one) to ask who they are, and asks it for their records when needed. That system is run by your business, not by us.
We may also share information when the law requires it, to protect someone's safety or our rights, or with a company that takes over DaloChat, in which case we'll tell you first.
7.Where it is kept
Our providers run their services in many countries. Cloudflare stores and processes data on its worldwide network, and most AI providers are based in the United States. Your information may therefore be processed outside Cambodia. We choose established providers and send each one only what its part of the work needs.
8.How long we keep it, and deleting
What your team can delete or switch off
- Delete a document: its text and search entries are removed.
- Take back a message your team sent: it's deleted from the person's Telegram chat (Telegram allows this for 48 hours after sending) and from your team group, and DaloChat drops its text, file and translation.
- Remove an approved team answer, a one-tap reply, an integration, a teammate or an unused invite, remove a label from a person, and cancel a scheduled message.
- Switch off AI features (see section 5), or disconnect your bot so new messages no longer reach DaloChat. Disconnecting keeps the bot's token, stored encrypted, until the project is deleted. To make the token useless at once, revoke it in Telegram's BotFather.
- Download your chats from the dashboard at any time.
To delete a person's history, a whole project or your account, write to [email protected] from the account's email address. We'll check that the request comes from the project's owner before we delete anything.
Deleted information can remain in our hosting provider's automatic database backups for a limited time, up to 30 days, before it's gone. Deleting something in DaloChat doesn't remove copies in Telegram, apart from messages your team takes back.
9.Security
- Every connection to DaloChat uses HTTPS.
- Bot tokens, Telegram connection secrets and integration keys are encrypted (AES-256) before they're stored.
- Sign-in codes are stored only as hashes, and passwords (staff logins and older accounts) only as salted hashes. Network addresses used to stop abuse are stored only in scrambled form.
- Each project's information is kept apart, and every request is checked against the signed-in person's projects and role.
- Messages from Telegram are checked with a secret, so nobody else can pretend to be Telegram.
- Our team looks at a project's information only to help you, fix a problem or keep the service safe. When we open a project from our admin tools, the access is short-lived and logged. Our admin tools also show us account owners' email addresses, demo-account requests and what each project's AI costs.
No system is perfectly secure. If we learn of a breach that affects your information, we'll tell the affected account owners without undue delay.
10.Cookies and browser storage
- DaloChat doesn't use advertising or tracking cookies, and our pages don't use analytics tools.
- Your sign-in is kept in your browser's storage. With “Keep me signed in” ticked, it stays after you close the browser, and the session renews while you use it, up to 30 days without use. Unticked, it's kept for that browser tab only and is gone when you close it; the server also ends it after 12 hours.
- The dashboard also remembers which project you last opened, and, for the current tab only, your Ask DaloChat conversation and an invite link while you sign in. The demo page remembers your demo code for the current tab.
- Our website checks whether you're signed in, so it can show a button to your dashboard.
- Signing out removes your sign-in from the browser. You can clear the rest in your browser's settings.
11.Your choices and rights
Depending on where you live, you may have the right to ask for a copy of your information, to correct it, to have it deleted, or to object to how it's used. To ask, write to [email protected]. We'll answer within 30 days, and we may ask you to confirm who you are first.
- Account holders can see and change their name in each project, their project's settings and content in the dashboard, and download their project's chats.
- Customers of a business should contact that business first (see section 2). You can stop messages from a bot at any time by blocking it in Telegram.
12.Children
DaloChat is a tool for businesses and isn't directed at children under 13. We don't knowingly collect information from children under 13 for our own purposes. A business that serves young people is responsible for following the law that applies to it, including getting a parent's consent where that's needed. If you think a child's information is in DaloChat and shouldn't be, write to us and we'll help remove it.
13.Changes to this policy
We'll update this policy when DaloChat changes. We'll post the new version on this page with a new date and, for significant changes, tell account owners by email or in their team group before the changes take effect.
14.Contact us
Questions about this policy or your information: write to [email protected].