Privacy
What we do with data, in the same plain English as the rest of the site. If anything here is unclear, ask us and we will fix the wording.
Last updated 23 August 2026.
Who we are
ChatRelay is operated by [LEGAL ENTITY NAME], a company registered in England and Wales, number [COMPANY NUMBER], at [REGISTERED ADDRESS]. You can reach us at [email protected].
We are registered with the Information Commissioner's Office under number [ICO NUMBER].
The bit that matters most: who is responsible for what
There are two different sets of data here and they work differently.
Messages from your customers
When someone types into the chat box on your website, you decide why that message is collected and what happens to it. In data protection terms you are the controller and we are your processor. We handle those messages on your instructions, which are the settings you choose in your account.
That means it is your job, not ours, to tell your own customers that you use us. Most people do this with a line in their own privacy notice.
Your own account
For your name, your email address, your website address and your billing details, we are the controller. That part is covered below under "Your account".
What the chat box collects
Whatever the person types, plus anything they volunteer such as an email address or a phone number so you can reply when you are not at your desk, plus which page of your site they were on when they wrote to you. Nothing else. In particular:
- The chat box sets no cookies. Before anyone opens it, the only thing that can be stored is a note that they closed the little prompt, so it does not keep popping up while they are on your site. That goes when they close the tab.
- When somebody does open it, we save one random reference on their device so their conversation follows them from page to page instead of starting again each time. It says nothing about who they are, it is only ever used to continue the chat they started, and it deletes itself a day later. We enforce that on the device as well as on our own side, so the two cannot drift apart. That is what the rules call strictly necessary, so your cookie banner does not need to change because of us.
- Once a page loads, the chat box quietly tells us it loaded, so we can warn you if it ever stops working. That message says which website it came from and nothing whatsoever about the person visiting it.
- We do not track people around your website or anywhere else.
- We do not build advertising profiles and we do not sell anything to anybody.
How long things are kept
You choose: 30 days, 90 days or a year. Whichever you pick, conversations delete themselves when the time is up. They are not archived somewhere else.
If you turn on Remember your customers, we match a returning person to an earlier conversation using the email address or phone number they typed in themselves. It can only look back as far as your retention setting, and it uses nothing else. No cookies, no device fingerprints, no tracking.
Erasure requests. If one of your customers asks you to delete their details, that is a request you have to act on rather than wait out. Tell us and we will clear our copy the same working day. The copy sitting in your own Telegram, Slack or inbox is yours to delete, because we cannot reach into your accounts.
Who else sees the messages
The whole point of ChatRelay is that your messages go somewhere you already are, so by choosing a destination you are choosing who else handles them.
| Who | Why |
|---|---|
| The app you send to | Telegram, Slack, Discord, Google Chat, Microsoft Teams, Meta (WhatsApp, Messenger, Instagram), your email provider, or your own webhook. Each has its own privacy terms and its own servers, and we have no control over them. |
| [SMS PROVIDER] | Only if you turn on text messages. |
| Vercel | Runs the service. Our functions are pinned to their London region. |
| Upstash | Stores conversations until they expire, and holds the timers that chase an unanswered enquiry. [REGION]. The timers carry a reference number and nothing anybody wrote. |
| Resend | Sends the emails: an enquiry forwarded to your inbox, and the reply we pass on to a customer who was here overnight. They handle the contents of those. |
| Cloudflare | Receives email replies addressed back to us, so that answering an enquiry by email reaches the person who sent it. |
| Stripe | Takes the payment. They see your billing details. We never do: your card number does not touch our servers. |
| [ENRICHMENT PROVIDER] | Only if you turn on "Look up who you are talking to". We send a work email domain and get back a company name and size. |
We will tell you before we add anyone to that list.
Where data is held
[STATE WHERE. If any provider is outside the UK or EEA, name the safeguard, normally the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.]
Note that if you send messages to WhatsApp, Messenger or Instagram, Meta processes them under their own terms and that involves transfers outside the UK. Choosing Telegram, Slack or a webhook does the same in each of their own ways. This is unavoidable in a product whose job is to deliver messages to those places, which is why you get to pick.
This website
Three things happen on chatrelay.co.uk that are worth naming.
- A screenshot service. If you type your web address into the demo, our server asks Microlink for a picture of that site. They are told the address. They are not told your IP address, and they never hear from your browser at all: the picture reaches you from us. We hold the picture for a day so the next person asking about the same site does not cost another fetch.
- We keep the address you typed. Just the domain, such as example.co.uk, so we know which kinds of business are interested. We do not store your IP address against it and we do not try to work out who you are. It is deleted after 90 days.
- A one-off note in your browser. We store a single flag called
cr-openerso the opening animation does not replay every time you visit. It is not a cookie, it never leaves your device, and it is gone when you close the tab.
Nothing else on this site loads from anywhere but us. The typefaces are served from our own domain rather than from Google, so visiting a page here does not tell Google you were here. There is no analytics script, no tag manager, no embedded video from another site and no advertising pixel. If you open your browser's network tab on any page of chatrelay.co.uk, every single request goes to chatrelay.co.uk.
Your account
We keep your name, your email address, the websites you use us on, your settings and your billing records. We use them to run the service, take payment and email you about the service. Billing records are kept for six years because HMRC requires it. Everything else is deleted within 30 days of you closing your account.
We send you service emails, such as a receipt or a warning that something has stopped working. We will not add you to a marketing list unless you ask.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to what we are doing with it. Email [email protected] and we will answer within one month.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
Security
Messages are encrypted in transit. Access to the production systems is limited to the people who need it. If there is ever a breach that puts anyone at risk, we will tell the ICO within 72 hours and we will tell you.
Changes
If we change this, we will change the date at the top. If the change matters, we will email you about it rather than hoping you notice.