Any HubSpot user that has sufficient permission to install applications can install ChatSpot (this is controlled by user role permissioning in HubSpot).
ChatSpot limits users to accessing only the types of data permitted, based on their OAuth access grant. However, OAuth applications do not enforce security for individual objects. So, if a user has the ability to view contacts, they will be able to view all contacts.