Privacy policy

Who we are

Conversationly.ai is a service of Artificial Industries (UK) Ltd [to be confirmed], a company registered in England and Wales (company number [NUMBER]), registered office [ADDRESS]. In this policy, “we” and “us” mean that company.

For questions about this policy or your data, email [privacy@conversationly.ai].

Our two roles

• Controller: for people who visit this website, use Try it out, send us an enquiry, or have a dashboard account. We decide how that data is used.
• Processor: for visitors who use the Conversationly chat on a customer's website. The customer (the website's owner) is the controller and decides how those conversations are used. We process them on the customer's instructions, under our terms and data processing agreement. If you chatted on another company's website, contact that company first; we'll help them respond.

What we collect and why

Visiting this website

Our hosting providers keep standard server logs (such as IP address, browser and the page requested) to run the service and keep it secure.

Sonar counts visits to this website without cookies or other storage on your device: it records the pages viewed, the referring site and campaign tags, your browser, language, time zone and screen size, and (from your IP address) your approximate location. Lawful basis: our legitimate interest in understanding how the site is used. This website doesn't use analytics or advertising cookies.

Try it out

When you enter a web address, we read that website's public pages and build a temporary demo. To limit misuse, we use a one-way hashed version of your IP address; the platform never receives the address itself. The demo, its content and your questions are deleted automatically after 24 hours. Please don't enter personal information in your questions.

Lawful basis: our legitimate interest in showing what the product does and preventing abuse.

Demo and partner enquiries

When you fill in a form, we collect what you enter, such as your name, work email, company and message, and use it to reply and arrange a call. Lawful basis: our legitimate interest in responding to business enquiries. We keep enquiries for [24 months] after our last contact unless you become a customer.

Dashboard accounts

To create an account we collect your name, email address and, if you sign in with Google, your Google profile name and picture. We also keep the organisations you belong to, your role, the sites you add and the settings you choose. Lawful basis: performing our contract with you or your organisation.

Billing

Stripe handles payments. We receive and keep your organisation's billing name, address, VAT number, subscription status and invoice history, but never full card numbers. Lawful basis: contract, and our legal obligation to keep accounting records (normally six years).

Chat on our customers' websites

As a processor for the website's owner, we store:

• the questions visitors ask and the answers given, with the sources used;
• a random conversation ID, kept in the visitor's browser (local storage, not a cookie) so they can continue a conversation;
• the visitor's IP address and approximate location, only if the website's owner turns on Sonar insights with IP matching.

If the website's owner connects Sonar, we send it a summary of each conversation once it has finished (and the full transcript, if the owner turns that on) so the owner can see what visitors ask. Email addresses and phone numbers are removed before anything is sent.

Questions are sent to the AI provider that writes the answer: OpenAI by default, or the provider the website's owner chooses. We use OpenAI's API, which by default doesn't use API data to train its models.

Conversations are kept for [RETENTION PERIOD, e.g. 12 months], or until the website's owner deletes them or closes their account.

Website content we index

For each site a customer adds, we read and store its public pages to answer questions. Customers are responsible for what they ask us to index.

Who we share data with

We use these service providers to run Conversationly. Each one processes data only on our instructions and under a data processing agreement.

We don't sell personal data, and we don't use customers' conversations to train AI models.

International transfers

Where a provider processes data outside the UK, we rely on the UK's adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

How long we keep data

• Try it out demos: 24 hours.
• Dashboard accounts: while the account is open, then deleted within [30 days] of closing it.
• Conversations: [RETENTION PERIOD], or as the website's owner decides.
• Billing records: six years, for tax and accounting.
• Enquiries: [24 months] after our last contact.

Your rights

Under UK data protection law you can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive a copy in a portable format. Email [privacy@conversationly.ai]; we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

Data is encrypted in transit. API keys that customers store with us, such as their own AI provider key, are encrypted at rest. Access to production systems is limited to the staff who need it.

Changes to this policy

We'll update the date above when this policy changes, and tell customers by email about significant changes.