Privacy Policy

Last updated: [DATE]

This is a draft, not a published policy. It was written to accurately describe what this application actually does with data, but it has not been reviewed by a solicitor. Before you publish it: fill in every [bracketed] field, and given you're UK-based and this involves processing personal data on behalf of business customers (a data processor relationship under UK GDPR), have it reviewed by a solicitor — particularly the sections on international transfers and data processing terms with your business customers.

Who this policy covers

This policy applies to two different groups, and treats them differently because their relationship to us is different:

Businesses who sign up for an account to build and manage a chatbot ("you", "your account").
Visitors who chat with a bot embedded on one of our business customers' websites or apps ("end users"). For these people, our business customer is the data controller and we act as a data processor — see "If you're chatting with a bot" below.

Data we collect from businesses

Account data: email address, company name, and a hashed password (we never store your password in plain text).
Content you provide: anything you paste or import into a bot's knowledge base, including content fetched from URLs you give us.
Usage data: which plan you're on, how many conversations your bots have handled each month, and basic account activity, used to calculate billing and enforce plan limits.
Technical data: IP address and request metadata, kept briefly for rate-limiting and abuse prevention, and in error logs if something goes wrong.

If you're chatting with a bot (end users)

When you chat with a bot embedded on a business's website or app, your messages are sent to us to generate a reply, and stored so the business can review the conversation. We do this on behalf of the business running the bot, not for our own purposes — they control what the bot does with that data, and you should direct data requests to them in the first instance. We do not knowingly collect more than what you type into the chat window and basic technical metadata (approximate location via IP, timestamp).

Where your data goes

To generate replies, conversation content and relevant knowledge base content is sent to Anthropic (the maker of Claude, the AI model powering every bot) for processing. Anthropic processes this data under its own API terms and does not use it to train models by default. Anthropic is based in the United States, meaning this involves an international transfer of personal data outside the UK/EEA — [describe your transfer safeguard here, e.g. Anthropic's Standard Contractual Clauses / UK IDTA].

We do not sell personal data to anyone, and we do not share it with third parties except: sub-processors needed to run the service (hosting, Anthropic, and — once live — payment processing and telephony providers, each of which will be listed here when enabled), or when required by law.

Cookies

We use a single essential cookie to keep you logged in to your dashboard. It's strictly necessary for the service to function, contains no tracking identifiers, and isn't shared with third parties. We don't currently use analytics or advertising cookies.

How long we keep data

Account and bot data is kept for as long as your account is active. Conversation logs are kept so businesses can review and improve their bots; [state a concrete retention period, e.g. "for 12 months," or describe how businesses can delete conversation history]. If you delete your account, we delete your bots, knowledge base content, and conversation logs [within X days], except where we're required to retain billing records for longer.

Your rights

Under UK GDPR, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at [privacy@yourdomain]. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO).

Children

This service is intended for business use and is not directed at children.

Changes to this policy

We'll update the date at the top of this page when this policy changes, and notify account holders of material changes.

Contact

[Company legal name], [registered address]. Email: [privacy@yourdomain].