The privacy policy needs to be cristal clear what they do and what they don't with the chat data. How long is it kept, what is it being used for, who has access to it, etc.

Ideally there are no chat logs being kept at all and chat logs are only enabled temporarily for an individual user when debugging issues.

The way this works you can safely assume this is the case

Of course!

How would you even build a business in this day and age wiuthout collecting EVERYTHING you can (legally or not) obtain from your users...