Legal
Data processing terms
When your website visitors chat with you through ChatMesh, you are the controller and we process their data on your behalf. These terms, which form part of our Terms of service, set out how.
Last updated:
Need a signed copy? Our data processing terms apply automatically to every customer. Enterprise customers can also request a countersigned Data Processing Agreement — see how to request one.
1. Roles
For personal data in Customer Data, the Customer is the controller and ChatMesh Ltd is the processor, within the meaning of the UK GDPR (and, where it applies, the EU GDPR).
2. Details of processing
| Subject matter | Providing the ChatMesh live-chat, ticketing and integrations service. |
|---|---|
| Duration | For the term of the Customer’s subscription, plus the deletion period below. |
| Nature and purpose | Hosting, storing, transmitting and displaying conversations; routing them to the portal and to integrations the Customer enables; providing API, MCP and webhook access the Customer configures. |
| Categories of data subjects | The Customer’s website visitors and end users; the Customer’s staff and team members. |
| Types of personal data | Names and email addresses (where provided), message content, the page URL a chat started from, technical data such as IP address and browser details, and any other data visitors choose to include in messages. |
| Special category data | Not intended. Customers should not ask visitors for special category data through the chat unless they have a lawful basis and appropriate safeguards. |
3. Our commitments as processor
- Instructions — we process Customer Data only on the Customer’s documented instructions (including these terms and the Customer’s configuration of the Service), unless the law requires otherwise.
- Confidentiality — everyone with access to Customer Data is bound by confidentiality.
- Security — we maintain appropriate technical and organisational measures (Article 32), described on our security page.
- Sub-processors — we use only the sub-processors listed below, under written contracts with equivalent data protection obligations. We’ll give at least 30 days’ notice of new sub-processors, and the Customer may object on reasonable grounds.
- Assistance — admins can permanently erase an individual conversation, its messages and the related visitor record from the portal or API, and we help the Customer respond to data subject requests and with data protection impact assessments and consultations with the ICO, taking into account the nature of the processing.
- Breaches — we notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information the Customer reasonably needs to meet its own obligations.
- Deletion — at the end of the service, we delete Customer Data within 30 days (and from backups within their rotation period), unless the Customer asks us to return it first or the law requires us to keep it.
- Audits — we make available the information necessary to demonstrate compliance and allow for reasonable audits, normally satisfied by written answers and documentation.
- Transfers — Customer Data is hosted in the EU/UK region. Any restricted transfer is made under UK adequacy regulations or appropriate safeguards (IDTA or UK Addendum to the EU SCCs).
4. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| [hosting provider] | Cloud hosting, databases, backups | EU/UK region |
| [email provider] | Transactional email (e.g. invites, notifications) | [location] |
Customer-enabled services are not our sub-processors. When a Customer connects Slack, Discord, an AI model provider (for example via MCP or the API) or a webhook endpoint, the Customer instructs us to send data to a service it has chosen and contracts with directly. Stripe processes billing data about the Customer’s account as our own processor, not Customer Data about website visitors.
5. The Customer’s responsibilities
- Have a lawful basis for the processing and give website visitors appropriate privacy information.
- Configure the Service appropriately — for example, restrict allowed origins, manage team access and API keys, and choose which integrations to enable.
- Ensure that any instructions given to us comply with data protection law.
6. Requesting a countersigned DPA
- Email legal@chatmesh.io with the subject “DPA request”.
- Include your organisation’s legal name, company number, registered address, your ChatMesh workspace name, and the name and email of the person who will sign.
- We’ll send our standard DPA for electronic signature, normally within five business days. Countersigned DPAs are included with Enterprise plans; for other plans these online terms apply.
Our contact for data protection matters is privacy@chatmesh.io. ChatMesh Ltd, company number [company number], [registered address].