Changelog of the legal documents

This page lists, for each legal document of reactive.chat, its versions since the first publication on 1 September 2026, the date from which each applied and what changed. The documents themselves are listed on Legal documents.

1. How versions work

• Each document states its version and effective date at its end. The English version is binding; the German and Polish translations follow it.
• When a Customer registers, we record the exact text of the Terms of Service and of the Data Processing Agreement that the Customer accepted, with a checksum of that text. Which wording a Customer accepted can therefore be established even where the version number alone would not show it (section 9).
• Changes to the Terms of Service and the Data Processing Agreement are announced as described in the Terms of Service.
• From version 2.0 onwards, every change to the text of a document – except the correction of obvious typing errors – receives an entry on this page. Changes made on the same day, before that day's version has been published to Customers, are kept under the same version and noted here (section 9); every change after publication receives a new version number.

2. Versions of 19 October 2026

On 19 October 2026 the Privacy Policy was supplemented with a cookie that the website already set: the security cookie rc_csrf, which protects the forms against cross-site request forgery and is set on every page of the website, also without signing in. Until then the policy mentioned it only in general terms with the cookies of the dashboard. On the same day the documents were adapted to the start of the separate production installation of reactive.chat, and the records of processing activities and the data protection impact assessment were withdrawn from publication: neither has to be published; we make both available to the supervisory authority and, on request, to Customers. The documents listed below apply in their new versions from 19 October 2026. The changes describe the Service as it is; they impose no new obligations on Customers.

Versions per document:

• Terms of Service: 2.5 (previously 2.4) – production installation separate from the development installation (19.2); the rights and obligations of the parties are unchanged.
• Technical and organisational measures: 2.7 (previously 2.6) – separate production installation with its own database user, Redis database and AI worker instances (1, 2.4); transfers only of committed versions, started by hand, with a backup beforehand and restoration of the program files (4.2, 6); records and impact assessment on request (1).
• Privacy Policy: 2.6 (previously 2.5) – security cookie rc_csrf of the website: purpose, legal basis and retention (2.8); references with the cookies of the dashboard (3.9) and in the overview of periods (7.2); separate production installation (1.1, 10); records and impact assessment on request (introduction, 10).
• Data Processing Agreement: 2.5 (previously 2.4) – impact assessment and records on request (7); the obligations of the parties are unchanged.
• Sub-processors: 2.4 (previously 2.3) – records of processing activities on request; the list is unchanged.
• Text block for your privacy policy: 2.4 (previously 2.3) – records and impact assessment on request; the text block itself is unchanged.
• Legal documents: 1.2 (previously 1.1) – records and impact assessment listed as available on request.
• Records of processing activities 1.5 and Data protection impact assessment 1.5: no longer published, content unchanged.
• Unchanged: AI Act information 2.4, Legal notice 1.4, Access and deletion 2.3, Data Act information 2.2, Right of withdrawal 1.1, Acceptable Use and Anti-Abuse Policy 2.2, Complaints 1.2. This changelog: 1.7.

What changed in detail is stated at the end of each document.

3. Versions of 18 October 2026

On 18 October 2026 a statement in the Technical and organisational measures that did not match the Service was corrected: a transfer to the production instance was described as saving the state it replaces and restoring it automatically if a check failed; the deployment script does neither. The Service itself did not change. The document listed below applies in its new version from 18 October 2026. The correction describes the Service as it is; it imposes no new obligations on Customers.

Versions per document:

• Technical and organisational measures: 2.6 (previously 2.5) – transfers to the production instance: ordered in the operator area, carried out by a script under a user account other than the web server's, currently blocked; no automatic saving or restoring of the replaced state (6).
• Unchanged: Terms of Service 2.4, Data Processing Agreement 2.4, Privacy Policy 2.5, Records of processing activities 1.5, Data protection impact assessment 1.5, Text block for your privacy policy 2.3, AI Act information 2.4, Legal notice 1.4, Access and deletion 2.3, Data Act information 2.2, Sub-processors 2.3, Right of withdrawal 1.1, Acceptable Use and Anti-Abuse Policy 2.2, Complaints 1.2, Legal documents 1.1. This changelog: 1.6.

What changed in detail is stated at the end of each document.

4. Versions of 17 October 2026

On 17 October 2026 two changes to the Service were added: since the late evening of 16 October 2026 checkout for a paid plan requires acceptance of the current contract documents, and since 17 October 2026 session identifiers are held in the database only as a hash. The documents listed below apply in their new versions from 17 October 2026. The changes describe the Service as it is; they impose no new obligations on Customers. Changes that recur in several documents:

• Paid plan only with acceptance (late evening of 16 October 2026): if we hold no record that the owner ordering a paid plan has accepted the current versions – for example for an account from before the tick box was introduced, an account created through single sign-on, or after the documents have changed –, the Service requires the same two tick boxes, not pre-ticked, as at registration before checkout (Terms of Service and Data Processing Agreement; declaration as a business with the notice for sole traders); without them no checkout is opened with Stripe. The record is kept with the same data and the occasion before checkout is opened, and it remains if checkout then fails or is abandoned. An owner with a running subscription is not asked again as long as no new checkout takes place (renewal; a change of plan in Stripe's customer portal, if enabled there).
• Session identifiers only as a hash (17 October 2026): the database now holds only a SHA-256 hash of the dashboard session identifier, also in the reference of the "stay signed in" token; the cookie still carries the random value (256 bits). A copy of the database therefore contains no usable sign-in session. Existing sessions were converted without signing anyone out.

Versions per document:

• Terms of Service: 2.4 (previously 2.3) – acceptance before ordering a paid Plan, with the record written before checkout is opened (4.2, 9.2); renewed presentation of changed versions (27).
• Technical and organisational measures: 2.4 (previously 2.3) – session identifiers stored in the database only as SHA-256 hashes (2.2, 3.2).
• Privacy Policy: 2.4 (previously 2.3) – acceptance before ordering a paid plan (3.1); session identifier stored only as a hash (3.9).
• Records of processing activities: 1.4 (previously 1.3) – acceptance before checkout for a paid plan (A.1, A.13); known gap 10 (11); session identifier only as a hash (A.1, 9.1, 9.2).
• Data protection impact assessment: 1.4 (previously 1.3) – session identifiers only as hashes (4.4.12, R10, R21, 7.1, M20); R10 and R21 reassessed, ratings unchanged; consent records before checkout (4.4.13, R7).
• Unchanged: Data Processing Agreement 2.3, Text block for your privacy policy 2.3, AI Act information 2.3, Legal notice 1.3, Access and deletion 2.3, Data Act information 2.2, Sub-processors 2.3, Right of withdrawal 1.1, Acceptable Use and Anti-Abuse Policy 2.2, Complaints 1.2, Legal documents 1.1. This changelog: 1.4.

What changed in detail is stated at the end of each document.

Supplementary versions of 17 October 2026

Later on 17 October 2026 the designation of the AI was made uniform: the documents speak of our own AI, which we run ourselves on our own hardware (self-hosted), and no longer name individual models, inference software or machines. The Service itself did not change; where and how the AI runs is described as before. The earlier entries on this page were worded the same way; their dates and content remain.

• Data Processing Agreement: 2.4 (previously 2.3) – designation of the AI (3).
• Technical and organisational measures: 2.5 (previously 2.4) – designation of the AI (9).
• Privacy Policy: 2.5 (previously 2.4) – designation of the AI (1.1, 4.4).
• Records of processing activities: 1.5 (previously 1.4) – designation of the AI and its machines (3.5, B.10).
• Data protection impact assessment: 1.5 (previously 1.4) – designation of the AI (4.1).
• AI Act information: 2.4 (previously 2.3) – designation of the AI (4.1, 4.2, 5.4).
• Legal notice: 1.4 (previously 1.3) – licence notice without model names (8).
• This changelog: 1.5 – earlier entries without model and machine names (4, 7).
• What changed in detail is stated at the end of each document.

5. Versions of 16 October 2026

On 16 October 2026 the chat model on the AI nodes was changed, two points found in the review of the documents were corrected, new data periods and deletion paths were introduced, and in the evening the registration, the creation and takeover of workspaces, the re-application of deletions after a restore and two-factor authentication were supplemented. The documents listed below apply in their new versions from 16 October 2026. The changes describe the Service as it is; they impose no new obligations on Customers. Changes that recur in several documents:

• Chat models: one chat model of our own AI runs on two nodes of the second tier; another runs on one node of the first tier as reserve. Jobs of workspaces on the free plan are processed only on the first tier.
• Smart Answer stores the IP address in its counter only in shortened form (IPv4 without the last block, IPv6 shortened to the first 48 bits), not in full as stated in the versions of 12 October 2026; the entries are still deleted after 7 days.
• Job applications: the block on job applications now also applies to the AI verdict of test runs and to the reply suggestions of the Operator's support assistant; an instruction at the beginning of the system prompt applies on all model paths except translation. The statement in the versions of 12 October 2026 that Smart Answer does not use the detection was incorrect: Smart Answer questions pass through the chat server and were already checked in the same way.
• Data periods and deletion paths: entries of the security log without a workspace (sign-ins, failed sign-ins, IP blocks, attempts at public forms) are deleted after 90 days, other account events remain until the account is deleted; expired sessions and tokens are deleted one day after expiry; support requests without an account are deleted 365 days after receipt or last processing; consent records of visitors are deleted with the project or workspace, the company logo file with the workspace; a workspace is not deleted while a paid subscription is running – the subscription must be cancelled first, and the former offer to end the subscription on deletion and refund the fees pro rata no longer applies.
• Country of visitors (evening of 16 October 2026): the live functions that depend on the country – the live visitor list, campaigns in the widget and the consent requirement for visitors from the GDPR area – derive the country from the visitor's IP address with the local GeoLite2 database on our server (country code only, no region, city or coordinates; the IP address is not stored for this purpose); country information sent by the browser is not used. Where no country can be derived, consent is required, as before. Previously these functions used only a country supplied with the connection by an upstream server; as none was supplied, every visitor was treated as being in the GDPR area.
• Job applications (supplement): the block also keeps applications from the embedding of search questions, from the test questions and suggested test questions of test runs and from knowledge gaps; a file name written only as text is now also recognised in the chat and in Smart Answer.
• Business customers only (evening of 16 October 2026): registration requires a second checkbox, not pre-ticked, by which the person registering declares that they are registering for a business or as a trader and not as a consumer; without it no account is created. The declaration is recorded like the acceptance of the Terms of Service and the Data Processing Agreement (wording including the notice for sole traders shown beneath it, checksum, language, time, IP address, user agent). The notice points sole traders with consumer protection to the right of withdrawal. The form still does not ask for the legal form or the business register entry.
• Deletion journal (evening of 16 October 2026): every deletion on occasion that is carried out – a visitor's erasure request or withdrawal, the deletion of a workspace, project or account – is recorded in a journal outside the database (kind, identifiers, mode, time; no content, no addresses, no IP addresses) and kept for 400 days; after a restore a script carries out these deletions again before the Service returns to operation. Not covered: deletions requested after the backup that were still in their 30-day waiting period, and, if the server itself is lost, the deletions of up to the last 24 hours.
• Two-factor secret encrypted (evening of 16 October 2026): the secret of two-factor authentication is stored encrypted with AES-256-GCM and bound to the account; the key is on the same server.
• Second factor for the operator area (evening of 16 October 2026): the Operator's administration area is accessible only with a second factor that is set up and passed in the same session; for Customers two-factor authentication remains voluntary.
• Creating or taking over a workspace only with acceptance (evening of 16 October 2026): an account for which we hold no record of acceptance of the current versions – for example one created through single sign-on or one dating from before a change of the documents – must tick the same two checkboxes, not pre-ticked, as at registration (Terms of Service and Data Processing Agreement; declaration as a business with the notice for sole traders) before creating a workspace of its own or accepting a transfer; without them no workspace is created and ownership does not change. The record is kept with the same data and the occasion, in the same transaction as the creation or the transfer. Any language version published at that time counts as current. Existing owners without a record of the current version were not asked at checkout; this changed with the versions of 17 October 2026 (section 4).
• Job applications: file names (late evening of 16 October 2026): file names of attachments and file names written only as text are recognised regardless of spaces, underscores, hyphens, dots, upper or lower case, capitals inside the name and accents, wherever the word stands in the name; a name such as "CV Anna.pdf", which was previously not recognised, now is. Short words such as "CV", "resume" or "Zeugnis" count only as a word of their own; in a text, the word with the file extension and up to four words before it count as the file name. The detection can still miss applications whose wording or file names it does not know; the instruction to the model then remains as the second barrier.

Versions per document:

• Terms of Service: 2.3 (previously 2.2) – Free Plan processed only on the first tier of AI nodes (13.1); Smart Answer counters with a shortened IP address (13.8); recognition of job applications before every model job except translation (13.10); no deletion of a Workspace while a paid subscription is running, refund on deletion no longer offered (10.6); what remains after a deletion (24.6). Supplemented in the evening: declaration of business customers at registration (1.3, 4.2); deletions still in their waiting period when a backup is restored (24.5); acceptance before creating or taking over a Workspace (4.1, 4.2, 5.7).
• Data Processing Agreement: 2.3 (previously 2.2) – chat models of our own AI, with a reserve model that also serves the free plan (3); Smart Answer counter with a shortened IP address (A.2); no workspace deletion while a paid subscription is running, consent records and logo file removed by the deletion run (11); periods of audit entries without a workspace and of consent records (A.6).
• Technical and organisational measures: 2.3 (previously 2.2) – Smart Answer counter with a shortened IP address, question length (300 characters) and maximum time in transit (180 seconds) (3.1, 3.4); chat models of our own AI with a reserve model (9); block on job applications on all model paths except translation (9); expired sessions deleted (2.2); audit entries without a workspace deleted after 90 days (4.2). Supplemented in the evening: second factor mandatory for the operator area and encrypted two-factor secret (2.2, 3.2); deletion journal (6); file names in the block on job applications (9).
• Privacy Policy: 2.3 (previously 2.2) – language models of our own AI and inference nodes: one chat model on two nodes, another as reserve, free plan only on the reserve node (4.4); the Smart Answer counter stores the IP address in shortened form, not in full (4.14, 7.2); support requests without an account (2.4), workspace deletion and what remains (3.7), expired sessions (3.9), audit entries without a workspace (3.11), consent records with the project or workspace (4.11, 7.2). Supplemented in the evening: declaration of business customers (3.1, 7.2); encrypted two-factor secret (3.9, 10); deletion journal and re-applying deletions after a restore (3.7, 7.1, 7.2); acceptance before creating or taking over a workspace (3.1).
• Text block for your privacy policy: 2.3 (previously 2.2) – language models in the block on the AI assistant; shortened IP address in the Smart Answer counter; retention period counted from the last activity; the automatically inserted privacy text (Smart Tag, now version 2.3) says the same as the text block (takeover by the team, access log of the current day and 14 further days, daily run).
• Records of processing activities: 1.3 (previously 1.2) – three AI nodes of our own AI with a reserve model, register and tiers (3.5); Smart Answer counter with a shortened IP address (B.11); job applications in Smart Answer, the AI verdict of test runs and the support assistant (B.8); periods and deletion paths: audit rows without a workspace, expired sessions and tokens, support requests without an account, consent records, company logo, workspace deletion under a running subscription; known gaps 4, 5, 6 and 14 closed (A.1, A.2, A.4, A.6, B.6, 7, 11). Supplemented in the evening: declaration of business customers (A.1, A.13); sealed TOTP secret and second factor for the operator area (A.1, A.6, 9); deletion journal (3.4, A.17, 7); acceptance before creating a workspace of one's own or accepting a transfer (A.1, A.13); known gaps 10 and 14 (11); file names in job applications (B.8).
• Data protection impact assessment: 1.3 (previously 1.2) – chat models of our own AI, one of them on a reserve node, which alone serves the free plan, three inference nodes (4.1, 4.2); Smart Answer counter with a shortened IP address (4.4.7, R7); job applications: Smart Answer already covered, AI verdict of test runs and support assistant now blocked (3.5); periods and deletion paths (4.4.4, 4.4.12, 4.4.14, 5.4, 7.1); R6, R7 and R18 reassessed, ratings unchanged; status of M2 and M10. Supplemented in the evening: second factor for operator access and encrypted two-factor secrets (0, 4.4.12, R9, R10, R21, 7.1, 7.2); deletion journal (4.4.17, R8, R18, 7.1); R8, R9, R10 and R21 reassessed, ratings unchanged; status of M7, M10 and M20; consent records when creating or taking over a workspace (R7); file names in job applications (3.5).
• AI Act information: 2.3 (previously 2.2) – chat models of our own AI on the second tier and as reserve on the first tier, Free plans only on the first tier (1, 4.1); the statement that the Operator is not a provider of a general-purpose AI model extended to the new chat model, which is used unchanged (5.4); Smart Answer counter with a shortened IP address (4.2); job applications: detection and second barrier also in Smart Answer (as before, previously described incorrectly), in the AI verdict of test runs and in the support assistant, file names written as text (6.5). Supplemented in the evening: file names recognised regardless of separators, spelling and accents (6.5).
• Legal notice: 1.3 (previously 1.2) – licence notice for the new chat model of our own AI (8).
• Access and deletion: 2.3 (previously 2.2) – consent records of visitors deleted with the project and the workspace, company logo with the workspace (2.3, 2.4, 2.7); no workspace deletion while a paid subscription is running (2.4); support requests without an account after 365 days (2.7); sign-in history and failed sign-ins without an account after 90 days (3). Supplemented in the evening: deletion journal (2.7) and re-applying deletions after a restore, with its limits (4).
• Data Act information: 2.2 (previously 2.1) – deletion refused while a paid subscription is running (9). Supplemented in the evening: re-applying deletions after a restore through the deletion journal (9).
• Sub-processors: 2.3 (previously 2.2) – country for the live functions derived from the IP address with the local database (4.1).
• Right of withdrawal: 1.1 (previously 1.0) – the registration form points to this right beneath the checkbox for business customers (1).
• Unchanged: Acceptable Use and Anti-Abuse Policy 2.2, Complaints 1.2, Legal documents 1.1. This changelog: 1.3.

What changed in detail is stated at the end of each document.

6. Corrected versions of 12 October 2026

All legal documents were checked once more against the code and the operation of the Service as it actually runs. Where a document described something incorrectly or incompletely, it was corrected. The documents listed below apply in their corrected versions from 12 October 2026. The corrections describe the Service as it is; they impose no new obligations on Customers, except where an entry below expressly says so. Corrections that recur in several documents:

• There is not yet a separate production environment; the Service runs in its development installation.
• Smart Answer runs on Answely, a service of the same legal entity as the Operator, with a 24-hour answer cache; its counter stores the full IP address for 7 days.
• Masking before storage is described with its actual scope, and for IPv6 a block covers the whole /64 network.
• Google Drive is accessed with a read-only scope over the whole Drive; only the selected files are read. From 20 August 2026 the system backup was transferred to Google Drive and from 4 September 2026 to Google Cloud Storage.
• Data without automatic deletion (for example audit entries without an account, the system journal, background-process logs, failed sign-ins without an account, IP blocks) is named as such.

Versions per document:

• Terms of Service: 2.2 (previously 2.1) – corrected roles for restricting permissions and requesting deletion (5.3, 24.3), Google Drive access (read-only scope over the whole Drive; only the selection is read) and embedding on the Customer's own AI node (6.5, 13.9), monthly conversation limit not enforced (8.3), Data Act references (10.3: Art. 25(2)(d); 21.1: Art. 13(4)(a)), Smart Answer counters (full IP, 7 days) and answer cache via the Answely service (13.8), patterns replaced before storage (14.2), current hosting without a separate production environment (19.2), log periods (21.6, 24.6).
• Data Processing Agreement: 2.2 (previously 2.1) – push services receive identifiers and, unencrypted, a conversation identifier; Answely named as a service of the same legal entity; /ban covers the /64 network for IPv6; system journal and routing labels as tags in Annex A.2; data without automatic deletion stated (audit entries without account, system journal, background-process logs) and stored e-mails 30 days; Smart Answer answer cache and confidential AI-tool jobs in A.6.
• Technical and organisational measures: 2.2 (previously 2.1) – no separate production environment yet, the Service runs in its development installation; SSH password sign-in and ineffective fail2ban SSH filter stated; reCAPTCHA limits; scrubbing limits (phone numbers only with + or 0, no NIP/PESEL) and system journal with IP addresses; OCR also for job-application detection; Smart Answer via Answely with 24-hour answer cache; push hosts on a fixed list; audit entries without account not deleted; /ban per /64 for IPv6, fail2ban one hour; confidential jobs of the agent AI tools.
• Sub-processors: 2.2 (previously 2.1) – backup transferred to Google since 20 August 2026 (Google Drive until 4 September, then Google Cloud Storage); push notification content and metadata; Answely; Google Drive scope drive.readonly; migration sources corrected (no Answely, Zendesk file only).
• Privacy Policy: 2.2 (previously 2.1) – no separate production environment; notice bars of the website; loading of reCAPTCHA; click-to-call number, data download, dashboard browser storage, push content, failed sign-ins without an account; widget browser storage (rc_id, mp_ keys, rc_sig, rc_vtok, entries moved on consent); places where the IP address is stored; deletion of AI jobs, live visitor list, channel identities, consent records; re-encoding of photos; Smart Answer via Answely with a 24-hour answer cache; translations on anonymisation; campaign repetition lock; local database copy; overview of periods.
• Text block for your privacy policy: 2.2 (previously 2.1) – browser storage and storage table, page text in the short version, places where the IP address is stored, campaign periods, Smart Answer answer cache; the automatically inserted privacy text (Smart Tag) brought from version 1.4 to 2.2 (statement that no third-party cloud is used removed, backups, no fixed deletion period where none is set, storage keys, page text, right to lodge a complaint).
• Records of processing activities: 1.2 (previously 1.1) – measurement basis and no separate production environment; Google Drive backup 20 Aug to 4 Sep 2026; SSH/fail2ban; the Operator deletes support requests; IP blocks in the security log; conversation ID visible to push services; scope of masking; actual deletion paths for customer context, consent records, channels, portal cases, bot jobs and import files; channel queues; consent duty for Visitors from the EU/EEA/UK/CH; browser storage keys; job-application block; routing labels as tags and knowledge-gap questions kept 180 days; kb_freigaben and Drive read-only; Smart Answer via Answely with 24-hour cache; campaign segments from order data; IPv6 /64 blocks; tasks of the retention run.
• Data protection impact assessment: 1.2 (previously 1.1) – no separate production environment, SSH password sign-in and ineffective fail2ban SSH filter, network access to the database and Redis, how changes take effect; order data only for secured identities (M26); R5, R14 and R16 reassessed (R16 now Low); AutoQA, job-application block (and where its detection does not run), routing classification, confidential agent and translation jobs; Smart Answer via Answely; browser storage; customer portal, support cases and customer context (4.4.10a); failed sign-ins without an account, logs, push topic, Drive read-only scope, Google Drive backups 20 Aug to 4 Sep 2026; redaction gaps; SSRF scope.
• AI Act information: 2.2 (previously 2.1) – routing labels are stored as conversation tags and the operating log records labels and mood without text (4.2); Smart Answer runs on the Operator's Answely service, counter with full IP (7 days), answer cache 24 hours (4.2, 10); copilot and translation jobs confidential (4.2, 10); Google Drive read-only (4.2); section 7.4 "AI tools for agents" (no separate marking towards Visitors, drafts checked for numbers and links); job-application block: technical enforcement limited to the chat, scope of the system-prompt instruction, not in Smart Answer, the AI verdict of test runs and the support assistant (6.5); scope of masking before storage (11).
• Acceptable Use and Anti-Abuse Policy: 2.2 (previously 2.1) – scope of masking before storage (3.2); for IPv6 a block covers the whole /64 network (5.2).
• Access and deletion: 2.2 (previously 2.1) – browser entries removed and kept by a deletion (1.5); read-log period on the Agency plan (2.1); server logs: web server at most 15 days, system journal limited by size, background-process logs without a period (2.7); failed sign-ins without an account and IP blocks kept with full IP, not deleted automatically (3).
• Data Act information: 2.1 (previously 2.0) – local copy of the system backup on a disk at the server for about 8 days (9, 11).
• Complaints: 1.2 (previously 1.1) – both routes reach the Operator; a complaint sent through the form is confirmed on screen, not by e-mail (2).
• Legal notice: 1.2 (previously 1.1) – scope of masking before storage (6.2).
• Unchanged: Right of withdrawal 1.0, Legal documents 1.1. This changelog: 1.2.

What changed in detail is stated at the end of each document.

7. New versions of 11 October 2026

All documents were revised on the same day, effective 11 October 2026. The common aim: every statement about how the Service works was checked against the Service as it actually runs, and the documents were brought to the depth customers and authorities need. Common changes:

• Backups are described as they are: an encrypted daily system backup stored with Google Cloud Storage in Warsaw (daily copies 7 days, one weekly copy 364 days), a local copy on a disk at the server (about 8 days) and a database backup of reactive.chat on the server (30 days). Deleted data remains in backups for at most 364 days. Earlier versions stated 30 days and denied the use of a cloud provider.
• The end of a contract or subscription deletes nothing. A workspace returns to the free plan; data is erased only on request (workspace or account deletion with a 30-day grace period). Earlier versions promised deletion within 30 days after the end of the contract.
• Retention of conversations has no default period; the Customer, as controller, sets it per project (1 to 3650 days). Earlier statements of a retention by plan were removed.
• Roles are named as in the product: owner, admin, member (agent) and viewer.
• Sole traders with consumer protection under Polish law (Articles 385^5, 556^4, 576^5 Civil Code; Articles 7aa and 38a Consumer Rights Act) are covered; a page on the right of withdrawal was added.
• The EU online dispute resolution platform is no longer referred to; it ceased operation on 20 July 2025.

Versions per document:

• Terms of Service: 2.0 (previously 1.0) – completely revised: conclusion and acceptance record, roles, plans and billing, subscription end and contract end distinguished, switching, sole traders with consumer protection.
• Data Processing Agreement: 2.0 (previously 1.4) – backups, hosting, the Customer's own AI node, deletion on request and retention aligned with operation.
• Technical and organisational measures: 2.0 (previously 1.4) – backups, hosting and measures described as operated.
• Sub-processors: 2.0 (previously 1.1) – backup storage with Google Cloud Storage, DNS and e-mail with Namecheap, payment, reCAPTCHA, browser push services; services the Customer connects itself are listed separately.
• Acceptable Use and Anti-Abuse Policy: 2.0 (previously 1.1) – revised.
• AI Act information: 2.0 (previously 1.1) – models and AI nodes as operated; no training with Customer data; internal comparison of model versions.
• Data Act information: 2.0 (previously 1.1) – export contents and formats as they are, including what is only available on request; switching notice of at most two months also for annual plans; no deletion at contract end; backups up to 364 days; location of the infrastructure and of the backup.
• Privacy Policy: 2.0 (previously 1.9) – all processing operations, storage places of full IP addresses, browser storage, retention periods and backups as operated.
• Access and deletion: 2.0 (previously 1.6) – scope of a visitor's deletion with and without visitor proof; deleted or anonymised; what remains; no deletion of single conversations or projects in the dashboard (on request instead); contract end; export contents; backups up to 364 days.
• Text block for your privacy policy: 2.0 (previously 1.4) – browser storage and processing aligned with the widget.
• Legal notice: 1.1 (previously 1.0) – legal form and CEIDG entry, NIP, point of contact under the Digital Services Act, third-party licences.
• Complaints: 1.1 (previously 1.0) – review step, refunds, sole traders with consumer protection, out-of-court routes; ODR reference removed.
• Legal documents: 1.1 – lists the new documents.
• New: Records of processing activities 1.0, Data protection impact assessment 1.0, Right of withdrawal 1.0, and this changelog 1.0.

Supplementary versions of 11 October 2026

On the same day the following documents were supplemented so that they describe the functions built in October 2026 – web push, routing with labels and mood, bot actions, test runs and versions, the live visitor list and the API, AutoQA, MCP, knowledge-base files and Google Drive, the channels, campaigns, single sign-on, the audit log and pseudonyms, call-backs, calls and co-browsing, the flow editor – and two safeguards built on that day: the AI functions do not accept or assess job applications, and Visitors from the GDPR area see campaigns and appear in full in the visitor list only with their consent. The AI verdict of quality assurance is given only for conversations without human participation and is never attributed to a Team Member.

• Terms of Service, Data Processing Agreement, Technical and organisational measures, Sub-processors, AI Act information, Privacy Policy, Access and deletion, Acceptable Use and Anti-Abuse Policy, Text block: 2.1 each.
• Records of processing activities, Data protection impact assessment and this changelog: 1.1 each.
• No sub-processor was added or replaced. The entry for Namecheap now names the Visitor data contained in replies of the e-mail channel that are sent without the Customer's own mail server.
• What changed in detail is stated at the end of each document.

8. Versions by document

Terms of Service

• 1.0 (1 Sep 2026): first publication.
• 2.0 (11 Oct 2026): see section 7. Between 1.0 and 2.0 the text of the Terms was not changed.
• 2.1 (11 Oct 2026): see section 7.
• 2.2 (12 Oct 2026): corrections, see section 6.
• 2.3 (16 Oct 2026): Free Plan only on the first tier of AI nodes; Smart Answer counters with a shortened IP address; no deletion of a Workspace while a paid subscription is running, what remains after a deletion; in the evening the declaration of business customers at registration and deletions still in their waiting period at a restore, and acceptance before creating or taking over a Workspace; see section 5.
• 2.4 (17 Oct 2026): acceptance before ordering a paid Plan; renewed presentation of changed versions; see section 4.
• 2.5 (19 Oct 2026): separate production installation (19.2); see section 2.

Data Processing Agreement

• 1.0 (1 Sep 2026): first publication.
• 1.1 (27 Sep 2026): file attachments in the chat, their retention and their export.
• 1.2 (5 Oct 2026): customer data from shops (orders) shown in the chat.
• 1.3 (5 Oct 2026): Smart Answer (website search with AI answers).
• 1.4 (7 Oct 2026): reply suggestions for agents, translation in the dashboard, read log; anonymisation also removes translations.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): chat models of our own AI; Smart Answer counter with a shortened IP address; data periods and deletion paths; see section 5.
• 2.4 (17 Oct 2026): designation of the AI made uniform; see section 4.
• 2.5 (19 Oct 2026): impact assessment and records on request instead of published; see section 2.

Technical and organisational measures

• 1.0 (1 Sep 2026): first publication.
• 1.1 (2 Sep 2026): backups corrected (a promised daily backup did not yet exist and was set up that day); access logs kept for at most 15 days instead of 14; reCAPTCHA on four forms; deployment reports.
• 1.2 (27 Sep 2026): file attachments.
• 1.3 (5 Oct 2026): Smart Answer.
• 1.4 (7 Oct 2026): reply suggestions, translation, read log.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): Smart Answer counter with a shortened IP address, question length and maximum time in transit; chat models; data periods; in the evening the second factor for the operator area, the encrypted two-factor secret, the deletion journal and the recognition of file names in job applications; see section 5.
• 2.4 (17 Oct 2026): session identifiers only as hashes; see section 4.
• 2.5 (17 Oct 2026): designation of the AI made uniform; see section 4.
• 2.6 (18 Oct 2026): transfers to the production instance described as they take place, without automatic saving or restoring; see section 3.
• 2.7 (19 Oct 2026): separate production installation; transfers only of committed versions, with a backup beforehand; records and impact assessment on request; see section 2.

Sub-processors

• 1.0 (1 Sep 2026): first publication; on 2 Sep 2026 the e-mail provider Namecheap was entered in place of a placeholder, without a new version number.
• 1.1 (2 Sep 2026): reCAPTCHA on the login, registration, password-reset and support forms.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): country for the live functions derived from the IP address; see section 5.
• 2.4 (19 Oct 2026): records of processing activities on request instead of linked; see section 2.

Acceptable Use and Anti-Abuse Policy

• 1.0 (1 Sep 2026): first publication.
• 1.1 (2 Sep 2026): reCAPTCHA on four forms.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.

AI Act information

• 1.0 (1 Sep 2026): first publication.
• 1.1 (7 Oct 2026): reply suggestions for agents and translation in the dashboard.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): chat models and tiers, Free plans only on the first tier, the new chat model in the statement on general-purpose AI models; Smart Answer counter with a shortened IP address; in the evening the recognition of file names in job applications; see section 5.
• 2.4 (17 Oct 2026): designation of the AI made uniform; see section 4.

Data Act information

• 1.0 (1 Sep 2026): first publication.
• 1.1 (2 Sep 2026): self-service export of conversations, messages, traits and canned responses; access logs at most 15 days.
• 2.1 (12 Oct 2026): corrections, see section 6; version 2.0 of 11 October 2026: see section 7.
• 2.2 (16 Oct 2026): deletion refused while a paid subscription is running; in the evening re-applying deletions after a restore; see section 5.

Privacy Policy

• 1.0 (1 Sep 2026): first publication; on 2 Sep 2026 the e-mail provider Namecheap was entered, without a new version number.
• 1.1 (2 Sep 2026): reCAPTCHA on four forms; access logs at most 15 days.
• 1.3 (9 Sep 2026): consent, withdrawal and deletion in the chat window, configurable per project. Version 1.2 was not issued.
• 1.4 (27 Sep 2026): file attachments.
• 1.5 (2 Oct 2026): AI support for the support team (translation, reply suggestion).
• 1.6 (4 Oct 2026): the assistant makes statements about a file only on the basis of its text.
• 1.7 (5 Oct 2026): customer data from shops.
• 1.8 (5 Oct 2026): Smart Answer.
• 1.9 (7 Oct 2026): reply suggestions, translation in the dashboard, read log.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): language models and nodes; shortened IP address in the Smart Answer counter; data periods and deletion paths; in the evening the declaration of business customers, acceptance before creating or taking over a workspace, the encrypted two-factor secret and the deletion journal; see section 5.
• 2.4 (17 Oct 2026): acceptance before ordering a paid plan; session identifier only as a hash; see section 4.
• 2.5 (17 Oct 2026): designation of the AI made uniform; see section 4.
• 2.6 (19 Oct 2026): security cookie rc_csrf of the website; separate production installation; records and impact assessment on request; see section 2.

Access and deletion

• 1.0 (1 Sep 2026): first publication.
• 1.1 (2 Sep 2026): self-service export; grace period for workspace deletion.
• 1.3 (9 Sep 2026): deletion and withdrawal of consent in the chat window; written deletion requests. Version 1.2 was not issued.
• 1.4 (27 Sep 2026): automatic deletion and export of attachments.
• 1.5 (4 Oct 2026): account deletion in the dashboard.
• 1.6 (7 Oct 2026): translations and read log.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): consent records of visitors deleted with the project or workspace, company logo with the workspace, no workspace deletion while a paid subscription is running, periods for support requests without an account and for sign-ins without a workspace; in the evening the deletion journal and re-applying deletions after a restore; see section 5.

Text block for your privacy policy

• 1.0 (1 Sep 2026): first publication.
• 1.2 (9 Sep 2026): consent, withdrawal and deletion in the chat window. Version 1.1 was not issued.
• 1.3 (5 Oct 2026): Smart Answer.
• 1.4 (7 Oct 2026): reply suggestions, translation, read log.
• 2.2 (12 Oct 2026): corrections, see section 6; versions 2.0 and 2.1 of 11 October 2026: see section 7.
• 2.3 (16 Oct 2026): language models, shortened IP address in the Smart Answer counter, retention period counted from the last activity; Smart Tag brought to version 2.3 and aligned with the text block; see section 5.
• 2.4 (19 Oct 2026): records and impact assessment on request instead of linked; see section 2.

Legal notice, Complaints

• 1.0 (1 Sep 2026): first publication of each.
• 1.2 (12 Oct 2026): corrections of each, see section 6; versions 1.1 of 11 October 2026: see section 7.
• 1.3 (16 Oct 2026): Legal notice only: licence notice for the new chat model of our own AI, see section 5. Complaints remain at version 1.2.
• 1.4 (17 Oct 2026): Legal notice only: licence notice without model names, see section 4. Complaints remain at version 1.2.

Records of processing activities, Data protection impact assessment

• 1.0 and 1.1 (11 Oct 2026): first publication and supplement, see section 7.
• 1.2 (12 Oct 2026): corrections, see section 6.
• 1.3 (16 Oct 2026): chat models and AI nodes; Smart Answer counter with a shortened IP address; data periods and deletion paths; in the evening the second factor for the operator area, the encrypted two-factor secret and the deletion journal, in the records also the declaration of business customers; in both the records kept when creating or taking over a workspace and the recognition of file names in job applications; each, see section 5.
• 1.4 (17 Oct 2026): in both, session identifiers only as hashes and acceptance before ordering a paid plan, in the impact assessment R10 and R21 reassessed; each, see section 4.
• 1.5 (17 Oct 2026): in both, designation of the AI made uniform; each, see section 4.
• 19 Oct 2026: no longer published; available to the supervisory authority and, on request, to Customers; version numbers unchanged; see section 2.

Right of withdrawal

• 1.0 (11 Oct 2026): first publication, see section 7.
• 1.1 (16 Oct 2026): the registration form points to this right; see section 5.

Legal documents

• 1.0 (1 Sep 2026): first publication. On 2 Sep 2026 the common version line was replaced by the sentence that each document states its own version.
• 1.2 (19 Oct 2026): records and impact assessment listed as available on request; see section 2.

9. Changes made without a new version number

We list these openly. The wording a Customer accepted on registration is recorded in full (section 1), so none of these changes is hidden from a Customer's own record.

• 2 Sep 2026: Privacy Policy and Sub-processors (both 1.0): the e-mail provider Namecheap entered in place of a placeholder. Version 1.1 followed the same day.
• 5 Sep 2026: twelve documents (all except the Terms of Service): each English version states that it is the binding one, and the translations say so at their top.
• 27 and 28 Sep 2026: Privacy Policy 1.4, section on attachments: previews of HEIC images, the assistant sees attached images on our own AI nodes, text recognition in images, recognised text used for word search.
• 7 Oct 2026: Text block 1.3: the privacy text element for websites (Smart Tag).
• 7 Oct 2026: Privacy Policy 1.9 and Text block 1.4: translation in the dashboard only on paid plans and only with the Visitor's consent.
• 16 Oct 2026: Privacy Policy, Technical and organisational measures, Records of processing activities, Data protection impact assessment and AI Act information (versions of 16 October 2026): supplemented on the same day with the country of visitors and the job-application paths, see section 5; each document says so in its closing paragraph. In the evening of the same day, before publication, the Terms of Service, the Privacy Policy, the Technical and organisational measures, Access and deletion, the Data Act information, the Records of processing activities and the Data protection impact assessment (versions of 16 October 2026) were supplemented with the declaration of business customers, the deletion journal and two-factor authentication, and the Terms of Service, the Privacy Policy, the Records of processing activities and the Data protection impact assessment also with acceptance before creating or taking over a workspace, see section 5; the Right of withdrawal received version 1.1. Later that evening, also before publication, the AI Act information, the Technical and organisational measures, the Records of processing activities and the Data protection impact assessment were supplemented with the recognition of file names in job applications, see section 5.

Skipped numbers: Privacy Policy 1.2, Access and deletion 1.2 and Text block 1.1 were never issued.

This document is drawn up in English. Translations into German (/de/p/aenderungsprotokoll-vertraege) and Polish (/pl/p/rejestr-zmian-dokumentow) are provided for convenience; the English version prevails.

Version 1.2 replaces version 1.1 of 11 October 2026. Added: section 2 on the corrected versions of 12 October 2026; the following sections renumbered; the list by document shows the current versions.

Version 1.3 replaces version 1.2 of 12 October 2026. Added: section 2 on the versions of 16 October 2026; the following sections renumbered; the list by document shows the current versions. Supplemented on 16 October 2026: country of visitors, job applications and Sub-processors 2.3 (sections 2, 5 and 6). Further supplemented on 16 October 2026: rule for changes made on the same day before publication (1); declaration of business customers, deletion journal, encrypted two-factor secret, second factor for the operator area and Right of withdrawal 1.1 (sections 2, 5 and 6); creating or taking over a workspace only with acceptance (sections 2, 5 and 6).

Version 1.4 replaces version 1.3 of 16 October 2026. Added: section 2 on the versions of 17 October 2026; the following sections renumbered; the list by document shows the current versions.

Version 1.5 replaces version 1.4 of 17 October 2026. Added: supplementary versions of 17 October 2026 (sections 2 and 6); the AI designated uniformly as our own, self-hosted AI, also in the earlier entries, whose dates and content remain (3, 6).

Version 1.6 replaces version 1.5 of 17 October 2026. Added: section 2 on the versions of 18 October 2026; the following sections renumbered; the list by document shows the current versions.

Version 1.7 replaces version 1.6 of 18 October 2026. Added: section 2 on the versions of 19 October 2026; the following sections renumbered; the list by document shows the current versions. Also added on the same day: the separate production installation and the withdrawal of the records of processing activities and the data protection impact assessment from publication (section 2); links to both removed.

Version 1.7 – effective 19 October 2026.