Privacy Policy

1. Who we are and what this policy covers

1.1This Privacy Policy explains how the Platform (“we”, “us”) collects, uses, shares and protects personal data in connection with the DeskClerk AI service, our website, the administration console and the embeddable chat widget (together, the “Service”).

1.2This policy applies to our customers and to individuals who interact with the chat widget on a customer's website. Where we process Visitor Data on behalf of a customer, we act as a processor and the customer is the controller; the customer's own privacy notice governs that processing. Our Data Processing Agreement describes those roles in more detail.

1.3This policy does not apply to third-party websites, applications or services that you access through the Service. Those services have their own privacy practices.

2. Definitions

2.1“Personal data” means information relating to an identified or identifiable individual. “Customer” means the business that has an account with us. “Visitor” means an individual who interacts with the chat widget. “Visitor Data” means messages, contact details and technical information relating to a Visitor. “Account Data” means information about the Customer's account and users.

3. Data we collect

3.1Account Data: name, email address, company name, billing details (handled by our payment provider), login records, role and site configuration. We collect this when you create an account, configure the Service or contact support.

3.2Customer Content: documents, pages, product information, policies and other material you upload or connect so that the Service can answer questions. This may contain personal data if you choose to include it.

3.3Visitor Data: the messages a Visitor types, any contact details they choose to provide (such as an email address, telephone number or WhatsApp number), the pages on which the widget was opened, and technical information such as approximate location derived from the IP address, browser type and language.

3.4Usage Data: information about how the Service is used, including conversation volume, response times, feature usage, error logs and administrative actions. Usage Data is used to operate, secure and improve the Service.

3.5Cookies and similar technologies: the website and console use cookies that are necessary for authentication and security, and may use aggregated analytics. The chat widget does not set advertising cookies. You can control cookies through your browser, although disabling necessary cookies may prevent you from signing in.

4. How we use personal data and our legal bases

4.1We use personal data to provide the Service (including generating answers, capturing leads and supporting handoff), to secure and troubleshoot the Service, to communicate with you about your account, to comply with legal obligations, and to improve our products using aggregated and de-identified information.

4.2Where the General Data Protection Regulation or similar legislation applies, we rely on the following legal bases: performance of a contract (providing the Service to you), legitimate interests (securing and improving the Service, provided those interests are not overridden by your rights), consent (where required, for example for optional communications) and legal obligation (for tax, accounting and lawful requests).

4.3We do not sell personal data, and we do not use Customer Content to train models made available to other customers.

5. Visitor data and our role

5.1When a Visitor interacts with a widget on a Customer's website, the Customer determines what content the assistant uses and what questions it asks. We process Visitor Data on the Customer's instructions to provide the Service, and we do not use Visitor Data for our own marketing.

5.2Visitor email addresses are masked in the console by default. Customers are responsible for providing an appropriate privacy notice to their Visitors and for obtaining any consent required for the collection of contact details.

5.3We may process Visitor Data to detect abuse, to maintain the security of the Service, and to comply with law. Where we process Visitor Data for our own security purposes, we do so as a controller and rely on our legitimate interests.

6. Sharing and sub-processors

6.1We share personal data with service providers that help us operate the Service, including infrastructure and hosting providers, storage providers, email delivery providers and payment providers. These providers process data on our instructions and are bound by confidentiality and security obligations.

6.2We may share information with professional advisers, auditors and insurers where necessary, and with authorities where required by law or to protect our rights. We may disclose information in connection with a merger, acquisition or sale of assets, subject to appropriate confidentiality protections.

6.3A current list of sub-processors is available on request. We will give Customers notice of a new sub-processor where required by the Data Processing Agreement.

7. International transfers

7.1We may process personal data in countries other than the country in which it was collected. Where data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, including standard contractual clauses or an adequacy decision, together with supplementary measures where required.

7.2You may contact us for more information about the safeguards applied to a particular transfer. Where a transfer impact assessment is required, we will provide the information reasonably necessary to complete it, subject to confidentiality.

7.3If a transfer mechanism is invalidated or a supervisory authority requires additional measures, we will work with you to implement an appropriate alternative without undue delay.

8. Retention

8.1Account Data is retained while the account is active and for a limited period afterwards to comply with legal, tax and accounting obligations and to resolve disputes.

8.2Customer Content and Visitor Data are retained while the relevant site is active. After termination, Customers may export conversations and leads for thirty days, after which the data is deleted in accordance with our retention practices, except where retention is required by law or where data remains in rolling backups for a limited period.

8.3Usage Data and logs are retained for a limited period for security, troubleshooting and product improvement. Aggregated and de-identified information may be retained longer because it no longer identifies an individual.

9. Security

9.1We apply technical and organisational measures designed to protect personal data, including tenant and site isolation, access controls, administrative audit logging, rate limiting, bot protection, encryption in transit and scheduled backups with a documented restore drill.

9.2No system is completely secure. If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and provide information about the nature of the incident, the likely consequences and the measures taken or proposed.

9.3You are responsible for keeping your credentials secure and for configuring access for your users appropriately.

10. Your rights

10.1Depending on where you live, you may have the right to access, correct, delete or restrict the processing of your personal data, to object to processing, to data portability, and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with a supervisory authority.

10.2To exercise your rights, contact us using the contact details published on this platform. We may need to verify your identity before responding. Where we process Visitor Data on behalf of a Customer, requests should be directed to that Customer; we will assist the Customer as required.

10.3We will respond within the period required by applicable law. If we cannot fulfil a request, we will explain why, subject to legal restrictions.

11. Automated processing and AI

11.1The Service uses automated processes to retrieve content and generate answers. Output is probabilistic and may be inaccurate; it is not used to make decisions with legal or similarly significant effects about individuals on our behalf.

11.2Customers are responsible for determining whether the Service is suitable for their use case and for maintaining human oversight where required, particularly in regulated industries such as healthcare, legal services and financial services.

11.3Model providers and infrastructure providers process data only as necessary to operate the Service and are bound by contractual obligations consistent with this policy. We do not permit providers to use Customer Content for their own model training.

11.4If you believe that an automated response has affected you in a way that requires human review, you may contact the business whose website you were using, or contact us and we will direct your request appropriately.

12. Children

12.1The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to the Service, contact us and we will take appropriate steps to delete it and to prevent further collection.

12.2Where local law sets a higher age for valid consent to online services, we apply that age and will not process the data of a person below it without appropriate parental consent.

13. Marketing and communications

13.1We may send you service messages that are necessary for the operation of the Service, such as security alerts, billing notices and material changes to these terms. These messages are not marketing and cannot be opted out of while you maintain an account.

13.2Where permitted by law, we may send you information about features, guides and offers that we believe are relevant to your business. You can opt out at any time using the unsubscribe link in the message or by contacting us. Opting out of marketing does not affect service messages.

13.3We do not share your contact details with third parties for their own marketing. If we run a co-marketing activity, we will ask for your separate consent before sharing anything.

14. Business transfers

14.1If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of that transaction. We will require the recipient to honour this policy and will notify you before your personal data becomes subject to a different policy.

14.2Where a transfer requires consent under applicable law, we will ask for it before the transfer takes effect.

15. Your responsibilities as a customer

15.1When you use the Service on your website, you are responsible for providing your Visitors with a privacy notice that accurately describes the assistant, the information it collects and how that information is used. You must obtain any consent required by the law that applies to your Visitors.

15.2You must configure the Service appropriately for your industry. In regulated sectors, you should limit the content you upload, block topics that require a qualified professional, and route sensitive conversations to a person. You must not upload special-category data unless you have a lawful basis and have agreed additional safeguards with us.

15.3You are responsible for the accuracy of the content you provide and for the answers the Service gives on your behalf. If you become aware of an error, you should correct the content promptly.

16. Cookies in more detail

16.1Necessary cookies keep you signed in, protect forms against cross-site request forgery and remember your security preferences. Without them, the console cannot function. They do not track you across other websites.

16.2Aggregate analytics help us understand which pages are used and where errors occur. They are configured to avoid identifying individual visitors where possible. The chat widget itself does not set advertising cookies and does not share Visitor data with advertising networks.

16.3You can delete or block cookies through your browser settings. Blocking necessary cookies will prevent you from signing in to the console. Where required by law, we ask for consent before setting non-essential cookies.

17. Changes to this policy

17.1We may update this policy to reflect changes in our practices, technology or legal requirements. Material changes will be announced by email or in the console before they take effect. The date at the top of this page shows when the policy was last updated.

18. Contact and complaints

18.1Questions, requests and complaints about privacy can be sent using the contact details published on this platform. We take complaints seriously and will work with you to resolve them. You also have the right to complain to your local data-protection authority.

18.2This policy is a draft for the prototype and must be reviewed by qualified counsel before launch.