Privacy Policy

01Who we are

ChatFox Ltd. is a company incorporated in England and Wales (Company Number 16875330).

Privacy contact: accounts@chatfox.ai

02Important: our role (Controller vs Processor)

Where we act as processor, the client's privacy information should explain how end users' data is used, and our processing is governed by our Data Processing Addendum (DPA).

03Personal data we collect (when ChatFox is the Controller)

We may collect and use:

• Account and contact details: name, email address, phone number, job title, company name and login details for the client portal.
• Billing details: invoices, payment status and related finance and administration records. Payment processing may be handled by our payment providers - we do not normally store full card or bank details beyond what is necessary for billing and reconciliation.
• Support communications: messages you send to us, support tickets and related notes.
• Technical and usage data: device information, logs, approximate location (derived from your IP address) and analytics data needed to operate, secure and improve our services.
• Cookies and local storage: session and preference data (see Cookies below).

04Personal data we process for clients (when ChatFox is the Processor)

When delivering AI chatbot services, ChatFox may process personal data on the client's behalf, including:

• Message content and metadata: messages sent to and from the client's chatbot channels (such as WhatsApp), timestamps and routing or automation context.
• Identifiers: phone numbers or user IDs used by the messaging platform, together with conversation or session identifiers.
• Client-provided data: information the client connects through integrations (such as CRM systems) depending on the client's configuration and instructions.

If you are an end user communicating with a business that uses ChatFox, please refer to that business's privacy notice. ChatFox processes end-user data solely on the business's instructions.

05How we use personal data (Controller activities)

We use personal data to:

• provide and administer access to our client portal;
• provide customer support and manage enquiries;
• manage billing, payments and account administration;
• operate, secure, monitor and improve our services and website;
• send service-related communications, including important updates, security notices and changes to our terms or policies;
• comply with legal obligations and protect our rights.

06Lawful bases (UK GDPR)

We process personal data under the following lawful bases:

• Contract: to provide the services you request and manage our relationship with you.
• Legitimate interests: to operate, secure and improve our services, prevent fraud or abuse and manage our business, balanced against your rights and freedoms.
• Legal obligation: where we are required to comply with applicable laws, including tax and accounting obligations.
• Consent: where we use optional cookies or where you choose to receive particular communications. You may withdraw your consent at any time.

07Sharing personal data

We may share personal data with:

• Service providers (processors): including hosting, infrastructure, monitoring, analytics, email, support and security providers, under appropriate contractual safeguards.
• Messaging and AI providers: where a client's chatbot uses third-party messaging platforms (such as WhatsApp/Meta) or AI model providers, message content and related data may be transmitted to those providers to deliver the service, subject to the client's configuration and instructions.
• Legal and regulatory authorities: where necessary to comply with applicable law, enforce our terms or protect rights, property or safety.
• Business transfers: where ChatFox is involved in a merger, acquisition, investment or sale of assets. Where appropriate, we will take steps to protect your information and provide notice.

08International transfers

Some of our service providers, and providers used within client chatbot configurations, may process data outside the United Kingdom.

Where required, we use appropriate safeguards, including UK-approved international data transfer mechanisms and contractual protections, to ensure personal data remains protected.

09Retention

Controller data: We retain account, billing and support records only for as long as necessary to fulfil the purposes described above and to meet legal and accounting obligations.

Client-processed message data: Retention depends on the client's configuration, the technical requirements of delivering the service (such as temporary processing and logging), and any retention periods agreed in writing, including within our Data Processing Addendum (DPA). We aim to minimise data retention and securely delete information when it is no longer required.

10Your rights

Where ChatFox is the controller of your personal data, you may have the right to:

• access your personal data;
• correct inaccurate personal data;
• request deletion where applicable;
• object to or restrict certain processing;
• receive your data in a portable format where applicable; and
• withdraw consent where processing is based on consent.

To exercise your rights, please contact accounts@chatfox.ai.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

If ChatFox is processing your personal data on behalf of one of our clients (for example, you have interacted with a business using a ChatFox AI assistant), you should direct your request to that business, as they are the data controller. We will assist the controller where required under our DPA.

11Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences and help operate and secure our services.

Where required by law, we will ask for your consent before placing non-essential cookies. You can also control cookies through your browser settings.

12Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration.

While no system can be guaranteed to be completely secure, we continually work to reduce security risks and protect the information entrusted to us.

13Children

Our services are intended for business use and are not directed at children.

If you believe a child has provided personal data to one of our clients through a ChatFox AI assistant, please contact the relevant business (the data controller) or contact us and we will help direct your request appropriately.

14Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The latest version will always be available on our website and will include the effective date shown at the top of this page. Where changes are significant, we may provide additional notice, such as by email or through our client portal.

15Contact