Legal
Privacy notice
This notice explains what personal data we collect, why, who we share it with and the rights you have under UK data protection law.
Last updated:
1. Who we are
ChatMesh is provided by ChatMesh Ltd, a company registered in England and Wales with company number [company number], whose registered office is at [registered address] (“ChatMesh”, “we”, “us”). We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
For the personal data described in this notice we are the controller. You can contact us about privacy at privacy@chatmesh.io or by post at our registered office. We have not appointed a Data Protection Officer because we are not required to, but our privacy contact handles all data protection matters.
2. Who this notice covers
- Visitors to chatmesh.ascend-digital.co.uk, our marketing website.
- Customers and their team members who sign up for or use the ChatMesh agent portal and API.
- People who contact us, for example by email, for sales or support.
Chatting on a website that uses ChatMesh? When you use a ChatMesh chat widget on someone else’s website, that business is the controller of your conversation and ChatMesh processes it on their behalf as a processor, under our data processing terms. Please read that business’s own privacy notice, and contact them first to exercise your rights. We’ll help them respond.
3. What we collect, why, and our lawful basis
| Data | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Account details: name, email, password (stored only as a salted hash), workspace name, role | Create and run your account, authenticate you, let your team collaborate | Contract (6(1)(b)) |
| Billing details: billing name and address, VAT number, plan, payment status and invoices | Take payment, issue invoices, keep tax and accounting records | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Card details | Collected and processed directly by Stripe — we never see or store full card numbers | Contract (6(1)(b)) |
| Service and security logs: IP address, browser/user agent, timestamps, API key usage, actions in the portal | Keep the service secure and reliable, prevent fraud and abuse, debug problems | Legitimate interests (6(1)(f)) in operating a secure service |
| Support and sales correspondence | Answer your questions and improve our help | Contract (6(1)(b)) or legitimate interests (6(1)(f)) |
| Service emails (e.g. invites, security alerts, billing notices) | Tell you about things that affect your account | Contract (6(1)(b)) |
| Product news emails | Occasional updates about ChatMesh — you can unsubscribe at any time | Consent (6(1)(a)) or, for existing customers, legitimate interests under the PECR “soft opt-in” |
| Marketing website: standard web server logs (IP address, requested URL, user agent, time) | Deliver the website and protect it from abuse | Legitimate interests (6(1)(f)) |
| Analytics and advertising measurement (only if you accept cookies): pages visited, device and browser details, the campaign that brought you here (UTM tags, Google and Meta click IDs), and whether you signed up, started checkout or bought a plan (plan, price and an order reference) | Understand how people find ChatMesh and measure our advertising (Google Analytics, Google Ads, Meta Pixel) | Consent (6(1)(a)), withdrawable at any time with “Cookie settings” |
Analytics and advertising tools run only on our marketing website and on the portal’s sign-up and billing pages, and only after you click Accept. They never run in the app’s inbox or in the chat widget on our customers’ websites. See our cookie policy. We do not sell personal data, and we do not use your data — or your customers’ conversations — to train AI models.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share data with
We use carefully selected service providers (processors) who act only on our instructions under contracts that meet UK GDPR Article 28:
| Recipient | What for | Location |
|---|---|---|
| Hosting and infrastructure provider: [hosting provider] | Servers, databases and backups that run ChatMesh | EU/UK region |
| Stripe | Payment processing, subscriptions, invoices and fraud prevention | UK/EU and USA |
| Email delivery provider: [email provider] | Sending account and service emails | [location] |
| Google (Google Analytics, Google Ads), only with your consent | Website analytics and measuring our advertising | EU/UK and USA |
| Meta (Meta Pixel), only with your consent | Measuring our advertising on Meta platforms | EU/UK and USA |
Integrations you choose to enable. If a customer connects Slack or Discord, conversation content (including visitor names and email addresses, where provided) is sent to the channel they choose, so their team can reply from there. Likewise, if a customer connects an AI agent or webhook, data is sent to the provider or endpoint the customer configures. These services are chosen and controlled by the customer and process data under their own terms.
We may also share data with professional advisers (such as lawyers and accountants), with law enforcement or regulators where the law requires it, or with a buyer or successor if our business is sold or reorganised — in which case this notice will continue to apply.
5. International transfers
ChatMesh is hosted in the EU/UK region. Some providers, such as Stripe, may process data outside the UK. Where that happens we rely on UK adequacy regulations (including those covering the EEA and the UK Extension to the EU–US Data Privacy Framework where applicable) or on appropriate safeguards such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for a copy of the relevant safeguards.
6. How long we keep data
- Account data: for as long as your account is open, then deleted within 30 days of closure, except where we must keep it longer.
- Conversation data held for customers: as directed by the customer; deleted within 30 days after their workspace is closed.
- Backups: overwritten on a rolling basis within [35] days.
- Billing and tax records: six years from the end of the financial year they relate to, as required by HMRC.
- Security and server logs: up to 90 days, unless needed to investigate an incident.
- Support correspondence: up to two years after the issue is resolved.
- Marketing preferences: until you unsubscribe; we keep a suppression record so we don’t email you again.
7. How we protect data
We use encryption in transit (TLS), encrypt integration secrets at rest, apply least-privilege access controls and keep our systems up to date. Read more on our security page. If a personal data breach occurs that is likely to result in a risk to you, we will notify the ICO within 72 hours where required and tell affected people without undue delay where required.
8. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict how we use your data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability — receive data you gave us in a machine-readable format;
- withdraw consent at any time, where we rely on consent;
- not be subject to solely automated decisions with legal or similarly significant effects.
To exercise any of these rights, email privacy@chatmesh.io. We may need to verify your identity. We’ll respond within one month, which can be extended by two further months for complex requests — we’ll tell you if so. There’s normally no fee.
9. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Children
ChatMesh is a business service and is not intended for children. We do not knowingly collect personal data from anyone under 16 for our own purposes.
11. Changes to this notice
We’ll update this notice when our practices change and show the date at the top. If changes are significant, we’ll tell customers by email or in the portal.