Privacy Policy

Last updated: 31 July 2026

This Privacy Policy explains how ChatNest ("we", "us") collects, uses and protects personal data when you use our platform and when your website visitors interact with chatbots built on it. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

We are ChatNest, United Kingdom. We are the data controller for the personal data described below, except where this policy says otherwise. Contact: use the Contact page.

2. Data we collect

Account data (businesses using the platform)

• Name, work email address and password (stored as a secure hash).
• Your chosen plan, order history and account status.

Platform content (businesses using the platform)

• Chatbot configurations (name, branding, welcome message, instructions).
• Knowledge base content you upload: business information, FAQs, behaviour rules, and content crawled from websites you provide.
• Conversation records between your chatbot and its visitors, including any human replies you send through the inbox.

Visitor data (people who chat with your embedded chatbot)

• Messages sent to the chatbot and the AI responses received.
• A pseudonymous session identifier stored in the visitor's browser (localStorage) so the conversation can be continued. We do not collect the visitor's name, email or IP address through the widget.

Technical data

• Server logs (IP address, browser type, pages visited) used for security and performance.
• Session cookies required to keep you logged in to the platform.

3. How we use your data

• To provide and operate the Service: creating chatbots, generating AI responses, storing conversations, and delivering the embed widget.
• To manage accounts, orders and plan changes.
• To keep the Service secure: detecting abuse, unauthorised access and fraud.
• To communicate with you about your account, service changes and, with your consent, product updates.
• To comply with legal obligations.

4. Legal bases (UK GDPR)

• Performance of a contract — providing the Service you signed up for (account data, knowledge base, conversations).
• Legitimate interests — securing the Service, preventing abuse, and improving our product.
• Consent — where we ask for it (for example, optional marketing communications).
• Legal obligation — where we must retain data for tax or regulatory purposes.

5. AI processing

When a visitor sends a message to your chatbot, the message and relevant knowledge base content are transmitted to our third-party AI provider (DeepSeek, or the model provider configured for the platform) to generate a response. This processing is necessary to provide the Service. We do not use your content or visitor conversations to train our own models, and we do not sell this data.

Because you control your knowledge base and your chatbot's behaviour, you are responsible for ensuring you have the right to process any personal data you upload, and for disclosing to your visitors that they are chatting with an AI assistant.

6. Sharing your data

We share personal data only with:

• Service providers — hosting, database and AI model providers, bound by contract to process data only on our instructions (data processors).
• Authorities — where required by law, regulation or valid legal request.

We never sell personal data. We never share visitor conversations with third parties for their own purposes.

7. International transfers

Some service providers (including AI model providers) may process data outside the UK. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK Addendum to the European Commission's Standard Contractual Clauses or adequacy decisions, to ensure your data is protected to UK standards.

8. Retention

• Account data and knowledge base content: kept while your account is active and deleted when you delete your account.
• Conversation records: kept for the life of the account; you can delete individual conversations from the inbox.
• Backups: retained for up to 30 days after deletion.
• Server logs: retained for up to 12 months.

9. Security

We use HTTPS encryption in transit, hashed passwords, prepared-statement database access, CSRF protection, and restrict internal access to personal data to authorised personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to processing in certain circumstances;
• data portability;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, use the Contact page. We will respond within one month. Most data can be controlled directly from your account dashboard.

11. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes will be announced on the platform and by email where appropriate. The date at the top of this page shows the current version.

13. Contact

Privacy questions or requests: use the Contact page.