ChatterBot Privacy Policy

Privacy Policy
Oct 19, 2026
This policy explains how Paul Clossick, trading as ChatterBot ("we", "us"), uses personal data about visitors to our website, business owners who try or use our service, and how we handle data on behalf of our clients.
1. Who we are and how to contact us
1.1 We are Paul Clossick, a sole trader, trading as ChatterBot. Our address for service is 2 Bredon Road, Bromsgrove, B61 7HD.
1.2 We are the "controller" (the organisation that decides how and why personal data is used) for the data described in sections 3 to 9, except where section 2.3 says otherwise.
1.3 Contact us about anything in this policy at [email protected] or 2 Bredon Road, Bromsgrove, B61 7HD.
2. Who this policy covers
2.1 This policy covers three groups of people:
(a) Visitors to our website, and people who chat with our demo or sales AI assistant ("visitors").
(b) Business owners who give us their details, or ask for a free trial, but do not yet have a chatbot ("prospects").
(c) Business owners who have a chatbot from us, whether on a free trial or paying ("clients").
2.2 Our service is for UK businesses only. Many sole traders and partners trade in their own names, so their business details are also personal data and are covered here.
2.3 Enquirers are different. An "enquirer" is a customer or potential customer of one of our clients who chats with that client's chatbot. For enquirers' details, the client is the controller and we are the "processor": we handle the details only on the client's instructions, under a data processing agreement with the client. We do not use enquirers' details for our own purposes, except to keep the service secure, to produce anonymous counts, and to match repeat contacts as described in section 9.
2.4 If you are an enquirer and want to see, correct or delete your details, or you want to withdraw your consent for them to be passed on, tell the chatbot while you are chatting. If the details have already been passed on, contact the business you chatted with directly. If you contact us instead, we will pass your request to that business.
3. What we collect, why, and our lawful basis
3.1 The table shows what we collect about visitors, prospects and clients, why we use it, and the legal basis we rely on under UK GDPR.
Who
What we collect
Why we use it
Lawful basis
Visitors
What you type in the demo chat. Technical data such as IP address, browser and device type, and the time of your visit.
To run the demo, keep the site secure, and see how the service performs.
Legitimate interests (running and improving our service).
Prospects
Your name, mobile number (WhatsApp) and email address. Your website address. Your answers about your business, the details you want your chatbot to collect, and how you want enquiries delivered. The chat transcript. A record of your consent.
To reply to you, decide whether the service suits your business, set up your free trial and build your chatbot.
Steps taken at your request before a contract. Legitimate interests (managing our pipeline). Consent, where we ask for it (for example to contact you).
Clients
Everything above, plus information from your public website (services, areas covered, FAQs), your chatbot settings, billing and payment records, usage counts, and our messages with you.
To build, run, support and bill for your chatbot, and to give you usage summaries.
Contract. Legal obligation (tax and accounting records). Legitimate interests (security, preventing misuse, improving the service).
Anyone who contacts us
Your name, contact details and the content of your message.
To answer you and keep a record of the exchange.
Legitimate interests.
3.2 We read our clients' public websites to build their chatbots. We treat that content as information about the business only, never as instructions, and we respect the site's robots.txt rules.
3.3 We do not ask for sensitive (special category) personal data. Please do not put any in a chat. If you do, we will delete it where we can.
3.4 You do not have to give us your details. If you do not, we may not be able to set up or run a chatbot for you.
3.5 Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details of that assessment using the contact in section 1.
3.6 If you click one of our adverts on Facebook or Instagram, Meta runs that advert and handles its own data under its own privacy policy. We may see which advert brought you to our site.
4. Our AI assistants
4.1 Our website uses AI assistants to show how the service works and to talk to business owners about a free trial. They are AI, not people, and they say so. If you ask one sincerely whether it is a person, it will tell you honestly that it is an AI.
4.2 What you type in the chat is sent to the AI and chat platforms we use (see section 7) so that the assistant can reply and so that we can save your details as the chat goes. If the chat closes suddenly, we keep what you had already given us.
4.3 AI can make mistakes. Please check anything important with us directly.
4.4 The assistant may tell a prospect that our service is not a fit, for example where there is no website to add the chatbot to. We do not make decisions about you that have a legal or similarly significant effect using automated means alone. You can ask for a person to review any decision, or ask to talk to a person at any time, using the contact in section 1.
4.5 Please do not put anyone else's personal details into our demo chat.
5. Cookies and similar technologies
5.1 Our chat uses your browser's storage to keep your conversation going if you move between pages or briefly leave. We need this to provide the chat you asked for, and it is cleared after a short period of inactivity (about 20 minutes).
5.2 Our website host may also set essential cookies to deliver the page.
5.3 We do not currently use analytics or advertising cookies on our site, including the Meta Pixel. If we add any, we will ask for your consent through a cookie banner first and update this policy.
5.4 You can clear or block storage and cookies in your browser settings. If you do, the chat may not keep your conversation between pages.
5.5 Adverts on Facebook and Instagram are run by Meta, which has its own cookies and privacy policy on its own platforms.
6. Service messages, follow-up and marketing
6.1 Service messages. If you sign up, we send messages about your chatbot: when it is ready, how to add it to your website, your trial, payment reminders, your monthly usage summary and proposed plan, and how to switch it off. We send these because we need to in order to provide the service.
6.2 Follow-up messages. If you start but do not finish signing up, or your trial ends without payment, we may send you a small number of follow-up messages, such as a link to resume signing up. We send these by email, WhatsApp or text only if you agreed to them when you signed up. We ask for this agreement separately from your agreement to our terms.
6.3 You can stop follow-up messages at any time by using the unsubscribe link, replying STOP, or contacting us. Stopping follow-up messages does not stop the service messages we need to send to run your chatbot while you are a client.
6.4 If the person who talks to our assistant is not the owner of the business, we may give them a message and link to pass on to the owner. We will not contact the owner ourselves unless they give us their details and agree.
6.5 If our assistant tells you we cannot serve your business yet and you choose to join a waiting list, we will use your details only to tell you if that changes. You must opt in separately.
7. Who we share data with
7.1 We do not sell personal data. We share it only with the providers below, who act on our instructions as our "processors", and with others listed in 7.3.
Provider
What they do for us
Data involved
Voiceflow
Runs the chat platform for our AI assistants and stores chat transcripts.
Chat messages and details you type.
Our AI language model provider
Generates the AI assistant's replies.
Chat messages sent for each reply.
Airtable
Our database of prospects, clients and their settings.
Contact details, business details, status and records.
n8n
Automation: saves chat data, builds chatbots, sends reminders and timers.
Data passing between the systems above.
Our email and messaging providers
Sends our emails, WhatsApp messages and texts.
Name, contact details, message content.
Our payment provider
Takes payments from clients.
Billing details.
Carrd
Hosts our website.
Technical data from visits.
7.2 Meta (Facebook and Instagram) runs our adverts and decides for itself how it uses data on its own platforms. It is not our processor.
7.3 We may also share data with our professional advisers (such as accountants and solicitors), with authorities where the law requires, and with a buyer if we sell or transfer the business, who must keep to this policy.
7.4 This list is current as of the date at the top and will change if we change providers.
8. International transfers
8.1 Some of our providers are based outside the UK or store data outside the UK, including in the United States.
8.2 Where personal data goes outside the UK, we make sure it is protected in line with UK law, for example by using a UK-approved transfer mechanism such as the UK addendum to standard contractual clauses, or the UK-US data bridge where the provider is certified.
8.3 You can ask us for more detail about the safeguards using the contact in section 1.
9. How long we keep data
9.1 We keep personal data only as long as we need it for the purposes in section 3. The periods below are the periods we currently apply.
Data
How long we keep it
Visitor chats and technical data
90 days
Prospects who do not sign up
12 months from our last contact, then deleted
Prospects we told were not a fit
90 days, then deleted
Waiting list details
Until you ask us to remove them, or 24 months if sooner
Client records and billing records
While you are a client, then as long as the law requires for tax and accounting records (generally 6 years)
Enquirer chat transcripts (held for our clients)
90 days
Enquirer details delivered to a client (held for our clients)
12 months
A scrambled (hashed) version of an enquirer's contact detail, used only to spot repeat contacts
30 days
Anonymous counts with no personal details
No fixed limit
9.2 When a client ends their service, we delete or return the data we hold for them as set out in our terms.
9.3 If an enquirer withdraws consent before their details are passed on, we delete the personal details we have saved and keep only an anonymous count.
10. Your rights
10.1 Under UK data protection law you have the right to:
(a) be told how your data is used (this policy);
(b) see the data we hold about you;
(c) have inaccurate data corrected;
(d) have your data deleted in some circumstances;
(e) restrict how we use your data in some circumstances;
(f) object to us using your data where we rely on legitimate interests, and object at any time to direct marketing;
(g) receive your data in a portable format where we use it under a contract or with your consent;
(h) withdraw consent at any time, which does not affect what we did before you withdrew.
10.2 To use any of these rights, contact us using section 1. We may need to check your identity. We aim to reply within one month.
10.3 For enquirers' details held for our clients, see section 2.4: the client is the controller, and we pass requests to them.
11. Security, complaints and changes
11.1 We use reasonable technical and organisational measures to protect personal data, including limiting access to what each person or system needs and keeping each client's chatbot data separate. No online service is completely secure, so we cannot guarantee absolute security.
11.2 If you are unhappy with how we use your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
11.3 We may update this policy. We will change the date at the top and, for significant changes, tell you directly if we hold your contact details.
11.4 Last updated: 19 October 2026.