Privacy Policy

Effective date: November 2, 2026

At Chalk AI, Inc. (“Chalk,” “we,” “us” or “our”), we take your privacy seriously. This Privacy Policy explains how we collect, use and disclose your Personal Data and describes your choices.

Your use of Chalk’s self-serve products and services is subject to Chalk’s Terms of Use and applicable Order Forms (together, the “Agreement”). This Privacy Policy applies to Individual Customers as described below; it does not replace the Agreement or expand the scope of any Data Processing Addendum (“DPA”).

We may update this Privacy Policy from time to time. We will post the revised policy and update its effective date. We will notify you of material changes through our website, email or another appropriate means, and obtain consent where required. Changes to this notice do not override applicable contractual restrictions on our use of Customer Data.

Privacy Policy Table of Contents

• What this Privacy Policy Covers
• Personal Data
  • Categories of Personal Data We Collect
  • Our Commercial or Business Purposes for Collecting Personal Data
  • Other Permitted Purposes for Processing Personal Data
  • Categories of Sources of Personal Data
• How We Disclose Your Personal Data
• Tracking Tools, Advertising, and Opt-Out
• Data Security
• Data Retention
• Personal Data of Children
• U.S. State Privacy Rights
• Exercising Your Rights under U.S. State Privacy Laws
• European Union and United Kingdom Data Subject Rights
• Contact Information

What this Privacy Policy Covers

This Privacy Policy covers Personal Data we collect and use through chalk.ai, our documentation at docs.chalk.ai, our blog, events, marketing and recruitment. With respect to customers’ use of our self-serve product, including the web console, signup, CLI, Chalk Assistant and related sales and support interactions, this Privacy Policy applies only to customers who agree to the Terms of Use in their individual capacity (“Individual Customers”). It does not apply to customers who agree to the Terms of Use on behalf of a business or other entity (“Business Customers”), or to their users’ use of the product on the Business Customer’s behalf. The capacity in which you enter into the Agreement, rather than whether your intended use is professional or business-related, determines which customer category applies. “Personal Data” means information that identifies or relates to an individual, including personal information and sensitive personal information under applicable privacy laws.

Business Customers’ use of the product and Chalk’s processing of their Customer Data are governed by their Agreement and, where incorporated under the Terms of Use, the DPA at https://chalk.ai/legal/data-processing-addendum. The Terms of Use incorporate the DPA when and to the extent a Business Customer is a controller or processor of Personal Data subject to the data protection laws described in the DPA. The DPA sets out the parties’ processing obligations and applicable international-transfer arrangements; it is not incorporated for Individual Customers merely because they accept the Terms of Use. This Privacy Policy does not authorize uses of Customer Data beyond those permitted by the applicable Agreement or DPA. It also does not govern Personal Data we process solely on another person’s behalf, including information an Individual Customer submits about other individuals for processing on that customer’s behalf. Our separate interactions with individuals as website visitors, marketing recipients, event participants or job applicants remain within this Privacy Policy’s scope; that does not make this policy applicable to a Business Customer’s product account or Customer Data. This Privacy Policy does not cover independent third parties’ practices.

Personal Data

Categories of Personal Data We Collect

The following chart describes the categories of Personal Data we collect, our purposes for collection and the categories of recipients. These categories also describe our collection during the preceding 12 months, to the extent the relevant features were available during that period. The purposes and recipients are described further below.

Our Commercial or Business Purposes for Collecting Personal Data

• Providing, Customizing and Improving the Services
  • Creating and managing your account or other user profiles.
  • Processing orders and transactions and billing.
  • Providing you with the products, services or information you request.
  • Meeting or fulfilling the reason you provided the information to us.
  • Providing support and assistance for the Services.
  • Improving the Services, including testing, research, internal analytics and product development.
  • Personalizing the Services, website content and communications based on your preferences.
  • Doing fraud protection, security and debugging.
  • Processing information for the purposes described in this Privacy Policy and as permitted by applicable U.S. state privacy laws (“U.S. State Privacy Laws”).
• Marketing the Services
  • Marketing and selling the Services.
  • Showing you advertisements, including Targeted Ads (as defined in the Tracking Tools, Advertising, and Opt-Out section below).
• Corresponding with You
  • Responding to your correspondence, contacting you when necessary or requested, and sending you information about Chalk or the Services.
  • Sending emails and other communications according to your preferences.

Other Permitted Purposes for Processing Personal Data

We may collect, use and disclose the categories of Personal Data described above to comply with law, regulation, court orders and other legal process; prevent, detect and investigate security incidents and potentially illegal or prohibited activity; protect your rights, property or safety and those of Chalk or others; enforce agreements; respond to claims concerning third-party rights; and resolve disputes.

We will provide notice before collecting additional categories of Personal Data or using Personal Data for materially different, unrelated or incompatible purposes, and will obtain consent where required.

Categories of Sources of Personal Data

We collect Personal Data about you from the following categories of sources:

• You
  • When you provide such information directly to us.
    • When you create an account or use our web console, CLI, Chalk Assistant or other Services.
    • When you voluntarily provide information in free-form text boxes through the Services or through responses to surveys or questionnaires.
    • When you email us, contact support, participate in sales or onboarding calls, register for events or meetups, attend webinars, apply for a job or provide an address for promotional merchandise. Some calls and webinars are recorded.
  • When you use the Services and such information is collected automatically.
    • Through Cookies (defined in the “Tracking Tools, Advertising and Opt-Out” section below).
• Public Records
  • Publicly available social media posts and professional profile information.
• Third Parties
  • Vendors
    • We may use analytics providers to analyze how you interact and engage with the Services, or third parties may help us provide you with customer support.
    • We may use vendors to obtain information to generate leads and create user profiles.
  • Advertising Partners
    • We receive information about you from some of our vendors who assist us with marketing or promotional services related to how you interact with our websites, applications, products, Services, advertisements or communications.
  • Third-Party Credentials

If you sign in through a third-party service such as Google, we receive information the service provides for that sign-in, such as your name and email address. We also receive professional profile information from enrichment and visitor-identification vendors, such as Unify, RB2B and LiveIntent.

How We Disclose Your Personal Data

We disclose Personal Data to the recipients described below, as applicable to each category in the chart above. Certain advertising and visitor-identification disclosures may constitute a sale or sharing under U.S. State Privacy Laws, as described below. We do not sell Personal Data for money. These disclosures do not extend to Customer Data processed solely on a customer’s behalf, which is subject to the applicable contractual restrictions.

• Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:
  • Hosting, technology and communication providers.
  • Analytics providers for web traffic or usage of our Services.
  • Security and fraud prevention consultants.
  • Support and customer service vendors.
  • Payment processors.
    • Stripe processes payment card information for Individual Customers’ self-serve payments. Chalk receives limited payment information and does not store full payment card numbers.
    • Payment providers’ own privacy notices describe their processing of payment information.

When you enable Chalk-provided AI for Chalk Assistant, information you type into the Assistant or upload may be sent to AI model providers, such as Anthropic or OpenAI, to provide that functionality. We also use CRM, sales, call-recording and email providers. Customer Data remains subject to the Terms of Use’s restrictions. The DPA’s additional AI Assistant commitments apply only where the DPA is incorporated into the applicable Business Customer’s Agreement; they do not apply to Individual Customers merely by virtue of this Privacy Policy. If you use a bring-your-own-key configuration, information is transmitted directly to the AI provider you select and contract with, and that provider’s processing is governed by your agreement with it.

• Advertising Partners. These parties help us market our services and provide you with other offers that may be of interest to you. They include:
  • Ad networks.
  • Data brokers.
  • Marketing providers.
• Parties You Authorize, Access or Authenticate
  • Third parties you access or connect through the Services, and other users you authorize to access your account or information.

Entity Account Transfers

If you sign up as an Individual Customer in a manner indicating an association with an employer or other entity, for example using its email address or credentials, and that entity has or later enters into an agreement with Chalk, Chalk may merge or subsume your account into the entity’s account as described in the Terms of Use (an “Entity Account Transfer”). In connection with that transfer, we may share your account information and Customer Data with the Business Customer. Your individual Agreement then terminates and further product use is governed by the applicable entity agreement, including any DPA incorporated into that agreement. This Privacy Policy no longer applies to use of the transferred product account on the Business Customer’s behalf; the entity may access and use the transferred Customer Data under its agreement. This does not change this policy’s application to Personal Data collected in your separate interactions with us within its scope or our obligations concerning Personal Data previously collected under this policy. Consider using an unaffiliated email address if you do not intend your account to be associated with an employer or other entity.

Legal Obligations

We may disclose any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Other Permitted Purposes for Processing Personal Data” section above.

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).

Data that is Not Personal Data

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not attempt to reidentify the data and/or disclose such data in a manner that could identify you.

Tracking Tools, Advertising, and Opt-Out

We use cookies, pixels, web beacons, scripts and browser storage (collectively, “Cookies”) to operate and secure the Services, recognize browsers, remember preferences, analyze usage and support marketing and targeted advertising. Cookies and similar tools may collect device identifiers, IP addresses, interactions and approximate location. Third-party advertising and visitor-identification tags on chalk.ai also receive visitor information, which may be combined with information from other sources.

Our websites do not currently apply Do Not Track or Global Privacy Control signals across all tracking tools. Some individual providers may respond to those signals. Please see the opt-out instructions below.

We use the following types of Cookies:

• Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable.
• Functional Cookies. These remember choices and settings, such as the Chalk console’s light/dark display mode and the Pylon support widget’s language.
• Performance/Analytical Cookies. These help us understand visits, page interactions and usage and measure campaign performance. We use analytics tools including Google Analytics, Amplitude and Datadog. Google provides an Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout/.
• Advertising and Visitor-Identification Cookies. We use advertising tags such as Google Ads/DoubleClick, LinkedIn Insight, Reddit, Quora and HubSpot ads, and visitor-identification or identity-resolution tools such as RB2B, LiveIntent and Unify. These tools support targeted advertising, identifying visiting businesses and contacts, and lead generation.

You can decide whether or not to accept Cookies through your internet browser’s settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our website and some of the Services and functionalities may not work.

To request an opt-out of sale, sharing or targeted advertising, email support@chalk.ai with the subject “Privacy Opt-Out.” Browser settings and provider-specific controls may also offer choices, but may not prevent all tracking. We do not currently offer a sitewide Cookie Settings page.

Session Replay Technology

We use Amplitude Session Replay in the Chalk web console, chalk.ai, and docs.chalk.ai, and Hotjar replay scripts on chalk.ai and the console login page. Datadog RUM session replay is not enabled. These tools recreate interactions to help identify and resolve issues, understand usage and improve the Services. Contact support@chalk.ai with questions or privacy requests. This notice is not a request for consent to recording.

Targeted Advertising

We and our advertising partners use information about online activity over time and across unaffiliated websites or services to select advertisements likely to interest you (“Targeted Ads”). Advertising tags may allow partners to collect identifiers and interactions when you visit our sites and recognize your browser on other sites. Visitor-identification and enrichment tools also help us identify business contacts and prioritize outreach. See “Selling, Sharing, or Targeted Advertising” and the opt-out instructions below.

Data Security

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

Data Retention

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

For example:

• We retain your profile information and credentials for as long as you have an account with us.
• We retain your payment data for as long as we need to process your purchase or subscription.
• We retain your device/IP data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently.

We retain marketing and prospect information until you opt out or it is no longer needed, subject to records needed to honor your preferences and other permitted retention. Call recordings are retained according to our recording tools’ retention settings. Assistant conversations are stored in the customer’s environment and deleted with that environment. For Individual Customers, Customer Data retention is also subject to the Terms of Use; Customer Data may be irretrievably deleted if an account is at least 90 days delinquent. Business Customers’ retention and deletion arrangements are governed by their Agreement and any incorporated DPA, not this Privacy Policy.

Personal Data of Children

The Services are intended for business and professional use, not directed to children under 13, and we do not knowingly collect or solicit Personal Data from children under 13. If you believe a child under 13 has provided Personal Data to us, contact support@chalk.ai so we can investigate and delete it as appropriate. We do not knowingly sell or share Personal Data of individuals under 18 or use it for targeted advertising.

U.S. State Privacy Rights

For Personal Data within this Privacy Policy’s scope, depending on your state of residence and the applicability of U.S. State Privacy Laws, you may have the rights described below, subject to applicable conditions and exceptions. See “Exercising Your Rights under U.S. State Privacy Laws’ for instructions. For Personal Data we process solely on a customer’s behalf, contact that customer in the first instance; we assist the customer as applicable. The exclusions from this Privacy Policy do not limit rights or obligations under applicable privacy law.

For questions about these rights, contact support@chalk.ai.

• Access: You may have the right to request confirmation of or access to the Personal Data that we process about you. You can also request access to a portable copy of your Personal Data. If you are a Minnesota or Oregon resident, you also have the right to request a list of specific third parties, other than natural persons, to whom we have disclosed your Personal Data (subject to exceptions in accordance with applicable law).
• Deletion: You may have the right to request that we delete the Personal Data that we have collected about you.
• Correction: You may have the right to request that we correct any inaccurate Personal Data we have collected about you.
• Portability: You may have the right to request a copy of your Personal Data in a machine-readable format, to the extent technically feasible.

“Selling,” “Sharing,” or “Targeted Advertising”

Depending on your state of residence, you may have the right to opt out from the “sale,” “share,” or disclosure of your Personal Data for the purposes of targeted advertising. These or similar terms may be defined differently depending the applicable U.S. State Privacy Law.

Where applicable, you may opt out of sale, sharing or processing for targeted advertising using the instructions below. We will respect your choice and any applicable restrictions on seeking renewed authorization.

We do not sell Personal Data for money. However, disclosures through advertising, visitor-identification and identity-resolution tools may constitute a “sale,” “sharing” or processing for targeted advertising under U.S. State Privacy Laws. These disclosures support advertising, analytics, enrichment and business lead generation.

We sell or share your Personal Data to the following categories of third parties:

• Advertising networks, marketing providers, data brokers and visitor-identification or identity-resolution providers.

The categories disclosed for these purposes during the preceding 12 months, to the extent collected during that period, include:

• Profile or Contact Data; Commercial Data, including business prospect and lead profiles; Device/IP Data; Web Analytics; and Approximate Geolocation Data.

We do not knowingly sell or share Personal Data of individuals under 18 or process it for targeted advertising.

Processing of Sensitive Personal Data

We do not intentionally collect sensitive categories of Personal Data as part of our own-purpose collection, such as health information, biometric identifiers or precise geolocation, and do not use sensitive information to infer characteristics about you. Please do not submit sensitive information unless necessary for your use of the Services and permitted by your agreement. Account authentication and Customer Data are subject to the distinctions explained above.

Automated Decision Making and Profiling

We do not use Personal Data for automated decisions producing legal or similarly significant effects. We do score and prioritize business prospects using website visits, email engagement and enrichment information for sales and marketing; this is distinct from such consequential decision-making.

Anti-Discrimination

We will not discriminate against you for exercising rights under applicable privacy laws.

Other State-Specific Privacy Rights

California residents may contact support@chalk.ai regarding disclosure of Personal Data for third parties’ direct marketing purposes.

Nevada residents may email support@chalk.ai with the subject “Nevada Do Not Sell Request” and their name and account email to request an opt-out of sales covered by Nevada law.

Exercising Your Rights under U.S. State Privacy Laws

For access, deletion, correction and portability requests, please describe your request and provide information reasonably necessary for us to verify your identity, such as your account email. We use verification information only to verify and respond to your request. You do not need an account to submit a request. Sale, sharing and targeted advertising opt-outs do not require identity verification, although we may request information needed to apply the opt-out.

We will work to respond to your Valid Request within the time period required by applicable privacy laws. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

Request to Opt-Out of Sale, Share, and/or Targeted Advertising

Email support@chalk.ai with the subject “Privacy Opt-Out” to opt out of sale, sharing or targeted advertising, including disclosures to advertising and visitor-identification partners. Please identify the email or account to which the request relates, if applicable. We do not currently apply GPC signals across all website tags, so do not rely on a browser signal alone to communicate your request to Chalk.

Request to Access, Delete, Correct

As applicable, you may submit a Valid Request for your right to access, delete, correct, or obtain a copy of your Personal Data described in this Privacy Policy by using the following methods:

• Email support@chalk.ai.
• Write to Chalk AI, Inc., Attn: Privacy, 55 Stockton Street, Unit 400, San Francisco, CA 94108.

Where applicable law permits, you may authorize an agent to submit a request on your behalf. We may request evidence of the agent’s authority and, where permitted, verify your identity directly.

Appealing a Denial

Where applicable law provides an appeal right, you may appeal our refusal to act on a privacy request. Identify your original request and explain the basis of your appeal. We will respond within the period required by applicable law and explain any further complaint route. You may submit an appeal using either method below:

• Email support@chalk.ai with “[STATE OF RESIDENCE] Appeal” in the subject line.
• Write to Chalk AI, Inc., Attn: Privacy Appeal, 55 Stockton Street, Unit 400, San Francisco, CA 94108.

If we deny your appeal, you have the right to contact the Attorney General of your State, including by the following links: Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, and Virginia.

European Union and United Kingdom Data Subject Rights

European Union and United Kingdom Residents

If you are in the European Economic Area (“EEA,” including the EU, Liechtenstein, Norway and Iceland) or the United Kingdom (“UK”), you may have rights under the EU or UK General Data Protection Regulation (“GDPR”), as described below.

In this section, “Personal Data” and “processing” have the meanings given in the GDPR. Chalk AI, Inc. is the controller of Personal Data processed for our own purposes within this Privacy Policy’s scope, including covered Individual Customer account information. Where we process Personal Data solely on another person’s behalf, that processing is governed by the applicable Agreement and instructions, rather than this policy’s description of our controller processing. Business Customers’ product-related processing arrangements are addressed in their Agreement and any incorporated DPA, not by this Privacy Policy.

If you have questions or wish to exercise rights concerning Personal Data we control, contact support@chalk.ai. For Personal Data we process solely on a customer’s behalf, contact that customer in the first instance.

Personal Data We Collect

The “Categories of Personal Data We Collect” section above details the Personal Data that we collect from you.

Personal Data Use and Processing Grounds

The “Our Commercial or Business Purposes for Collecting Personal Data” section above explains how we use your Personal Data.

We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others, as further described below.

• Contractual Necessity: We process information necessary to create and administer your Individual Customer account, provide requested Services and support, process payments and communicate about your subscription under the Terms of Use. Failure to provide necessary information may prevent us from providing the relevant Services.
  • Profile or Contact Data, Payment Data, Commercial Data, relevant Device/IP Data and information you provide in support requests or other service communications, to the extent necessary to perform our contract with you.
• Legitimate Interest: We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties:
  • Profile or Contact Data, Commercial Data, Device/IP Data, Web Analytics, Social Network Data, Professional or Employment-Related Data, Approximate Geolocation Data, Recordings and Transcripts, Inferences and information you voluntarily provide, where necessary for the interests below and not overridden by your rights. Where consent is required, we rely on consent instead.
  • We may also de-identify or anonymize Personal Data to further our legitimate interests.

Examples of these legitimate interests include (as described in more detail above):

• Providing, customizing and improving the Services.
• Marketing the Services.
• Corresponding with you.
• Meeting legal requirements and enforcing legal terms.
• Completing corporate transactions.
• Consent: In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.
• Legal Obligations: We process relevant information as necessary to comply with legal obligations, including tax, accounting and lawful requests.

Disclosing Personal Data

The “How We Disclose Your Personal Data” section above details how we disclose your Personal Data with third parties.

EEA and UK Data Subject Rights

Subject to applicable conditions and exceptions, you may exercise the rights below by emailing support@chalk.ai. We may request information reasonably necessary to verify your identity and will explain any refusal or limitation in accordance with applicable law.

• Access: You may request confirmation of processing, information about that processing and a copy of your Personal Data.
• Rectification: You may request correction of inaccurate or incomplete Personal Data.
• Erasure: You can request that we erase some or all of your Personal Data from our systems.
• Withdrawal of Consent: You may withdraw consent at any time, without affecting processing lawfully performed before withdrawal. Withdrawal may affect features that depend on that consent.
• Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
• Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
• Restriction of Processing: You can ask us to restrict further processing of your Personal Data.
• Right to Complain: You may lodge a complaint with your competent supervisory authority, including in your country of residence, workplace or where an alleged infringement occurred. EU authority information is available at https://edpb.europa.eu/about-edpb/board/members_en. UK residents may contact the Information Commissioner’s Office.
• Automated Decisions: We do not make solely automated decisions producing legal or similarly significant effects concerning you. Our business-contact lead scoring is described above.

Transfers of Personal Data

Chalk is based in the United States, and Personal Data within this Privacy Policy’s scope may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws from those in your jurisdiction. Where required, we use appropriate safeguards for international transfers. The DPA incorporated into qualifying Business Customers’ Agreements provides separate transfer arrangements, including the EU Standard Contractual Clauses (Module 2) and UK Addendum where applicable. Those contractual arrangements do not apply to Individual Customers merely because they accept the Terms of Use or this Privacy Policy, and do not by themselves establish safeguards for all Personal Data covered by this policy. Contact support@chalk.ai for information about safeguards applicable to your Personal Data. Chalk is not certified under the Data Privacy Framework.

Contact Information:

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:

• support@chalk.ai
• Chalk AI, Inc., 55 Stockton Street, Unit 400, San Francisco, CA 94108