Privacy Policy

Last updated: 8 September 2026

This policy explains how Serochat (“Serochat”, “we”, “us”) handles personal data when you use the Serochat service at serochat.ai, our dashboard, our embeddable chat widget, and related APIs (together, the “Service”). It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018, and reflects equivalent rights for users in the EU and California where applicable.

1. Who we are

The data controller for personal data we hold about our account holders and prospective customers is Serochat, a sole trader established in the United Kingdom, with a correspondence address at 12 Lamborn Avenue, WA8 5DE. You can reach our privacy team at [email protected].

2. Our two roles: controller and processor

Serochat plays two different data-protection roles depending on whose data is involved:

• We are the controller for data about you as an account holder — your sign-up details, billing relationship, and how you use the dashboard.
• We are a processor for the visitor conversations, lead-capture submissions, and uploaded knowledge-base content inside your workspace. You (the workspace owner) are the controller of that data; we process it on your instructions to operate the agent on your site. The contractual terms governing that processing are set out in our Terms of Service and incorporated Data Processing Addendum.

Sections 3–7 below describe what we do as controller. Section 8 covers the processor role.

3. What personal data we collect about you

Account data

• Email address, full name, optional company name, optional website URL.
• Password — stored only as a bcrypt hash; we cannot recover the plaintext.
• Email-verification status and timestamp, last login timestamp.
• Workspace membership and role (admin / editor / viewer).
• Referring affiliate code, if any, captured from the ref cookie at sign-up.

Billing data

• Stripe customer ID, subscription ID, plan code, billing cycle (monthly or annual), trial-end and renewal dates, cancellation flags.
• Card and bank details are held by Stripe under their own privacy policy; we never see or store them.

Authentication and session data

• Server-side session records containing your user ID, the IP address that opened the session (stored in 16-byte binary form), and a truncated user-agent string. Used to keep you logged in and to spot suspicious activity.
• Email-verification, password-reset, and team-invitation tokens. We store only a SHA-256 hash of each token, not the token itself, and every token is single-use. They expire on different clocks: an email-verification link after 24 hours, a password-reset link after 30 minutes, and a team invitation after 7 days.

Integration credentials

• When you connect a third-party knowledge source (Google Drive, Microsoft 365 / OneDrive / SharePoint, Notion, Zendesk, Confluence, or a custom API), we store the OAuth tokens or API keys you provide. Tokens are encrypted at rest with an application key not stored alongside the database.
• For OAuth integrations we also store the connected account email so you can identify the connection in the dashboard.

Operational logs and abuse signals

• Server logs: HTTP method, path, status code, response time, request timestamp, and IP address. Retained for up to 30 days for security and reliability investigations.
• Widget event log: a per-request record used for rate limiting and abuse detection on the public widget API. The visitor’s IP is stored only as a SHA-256 hash, never in plaintext.

Communications

• Any email or support correspondence you send us, retained for as long as we need it to respond and meet our legal obligations.

4. Why we use it — and on what lawful basis

We do not send marketing email by default. If we add a newsletter or similar in future, we will collect a separate opt-in and rely on consent for it.

5. Sub-processors we share data with

We use the following sub-processors to deliver the Service. Each is bound by a data-processing agreement and, where data leaves the UK or EEA, by appropriate transfer safeguards (see section 7).

Notion, Zendesk, Confluence, and any custom API you connect are sources you authorise us to read from on your behalf; they are not sub-processors of ours, but their own privacy terms apply to the data they hold.

An up-to-date list of sub-processors is maintained at [email protected] on request. We will give existing customers reasonable notice before adding a new sub-processor that materially affects their data.

6. We do not sell your personal data

We do not sell or rent personal data, and we do not share it with advertisers or data brokers. We do not use customer content, conversation transcripts, or lead submissions to train third-party AI models.

7. International transfers

Your application data and database are hosted in the United Kingdom (London). Several of our sub-processors (notably Groq, OpenAI, Stripe, Google, Microsoft, DigitalOcean, Cloudflare, and Postmark) are headquartered in the United States and may process data there. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with the supplementary technical measures (encryption in transit, encryption of credentials at rest) described in section 11.

8. Data we process on your behalf (processor role)

When you use the Service, the following categories of data are processed by us under your control as the workspace owner:

• Knowledge-base content — the documents, articles, URLs, and Q&A you upload or connect from third-party sources for the agent to draw on.
• Conversation data — messages exchanged between visitors and the agent on your site, message timestamps, model latency, satisfaction signals, and an opaque visitor identifier we set from our own domain, in a cookie and in your site’s local storage (see section 10).
• Lead-capture data — name, email, phone, and any other fields a visitor voluntarily submits through the agent or through configured forms.

We process this data only to provide the Service to you, to send it to Groq to generate the answer in the conversation, to send the search query and your knowledge-base text to OpenAI for the sole purpose of finding the right passage to answer from, and to support the administration features (search, export, deletion) you use in the dashboard. We do not access it for any other purpose unless you ask us to (for support) or we are legally required to.

Two further uses of Groq are part of running the Service rather than answering a visitor, and we would rather name them than leave them inside “providing the Service”. A nightly job sends the questions your agent answered badly or could not answer to Groq to group the near-duplicates, which is what fills the suggestions on your Training page; the grouping is done within your own workspace and never across customers. And we sample recorded turns — the question, the reply, and the passages the reply was drawn from — back through a model to measure how often the agent answered correctly, which is how we find and fix the failures nobody reported. Both use the same provider under the same terms, and neither trains a model.

You are responsible, as controller, for having a lawful basis to process the visitor and lead data, for giving any notices required in your jurisdiction, and for handling data-subject requests you receive from your visitors. We will assist you where reasonably required by data-protection law.

9. How long we keep data

• Account data — for as long as your account is active. When you request deletion from the dashboard, the account enters a 7-day grace period (signing back in cancels it). After the grace period the account and its associated workspaces, members, conversations, documents, and sessions are hard-deleted from the primary database, and drop out of our database backups as those rotate. Backups are retained for up to 14 days, so no copy of a deleted account survives more than 21 days from the day you asked for deletion.
• Billing records — retained for 7 years after the end of the relationship to comply with UK accounting and tax law, even if you delete the account. The data retained is limited to what HMRC requires (invoice records, payment amounts).
• Conversation transcripts — deleted automatically once a conversation has been idle for the retention window we run, currently 90 days from its last message. Workspace admins can also delete individual conversations or bulk-clear them at any time.
• Lead and document data — retained while your workspace exists, at your discretion; a captured lead outlives the transcript it came from, with the link to that conversation cleared. Both are deleted when the parent account is hard-deleted.
• Server logs — up to 30 days.
• Widget event log (IP-hashed) — up to 90 days; the setting we currently run is 30.
• Support correspondence — up to 3 years after the last interaction.

We will action a regulator-directed immediate erasure request promptly without waiting for the grace period.

10. Cookies

On our own website and dashboard we use a small number of strictly-necessary first-party cookies, plus one optional analytics service — Google Analytics — that runs only if you accept it through our cookie banner. The chat widget on our customers’ sites sets one further cookie, which is third-party by construction because we set it from our domain rather than theirs; it has its own section below. We do not use advertising or cross-site tracking cookies anywhere.

If you accept analytics, Google Analytics records pseudonymous usage events — pages visited, referrer, device and browser type, and coarse location derived from your IP address. We strip query strings from page URLs (keeping only campaign parameters) before anything is sent to Google, we have disabled all advertising features, and we never send your name or email address to Google Analytics. Declining changes nothing about how the Service works, and you can change your cookie choice at any time on this page.

What the widget stores on your visitors’ devices

If you embed Serochat on your own site, this is the complete list of what lands in a visitor’s browser, written so you can lift it straight into your own cookie notice.

• One cookie, serochat_vis_<your embed token>. It is set by serochat.ai in the response to the widget’s first API call, not by your domain, so in your visitor’s browser it is a third-party cookie — a browser set to block those simply never receives it. It is HttpOnly, Secure and SameSite=None, lasts 30 days, and carries a signed, opaque conversation identifier and nothing else.
• Three localStorage keys on your own domain: serochat_vid_<token>, the same opaque visitor id; serochat_vtok_<token>, the signed proof of that id, which is how browsers that block third-party cookies keep a conversation continuous; and serochat_lead_done_<token>, a flag so a visitor who has already given their contact details is not asked for them again.

That is everything. The widget loads no analytics, advertising or tracking script of ours onto your site, sets nothing else, and none of these values encode personal data. Because the cookie is set the moment the widget first calls our API, any consent your jurisdiction requires has to be collected before the widget loads — that is your call to make as the controller of your site, and we would rather you had the exact list than a summary.

11. Security

We take technical and organisational measures appropriate to the data we hold:

• TLS for all traffic to the dashboard, widget, and API.
• Passwords stored as bcrypt hashes; password-reset and invitation tokens stored as SHA-256 hashes only.
• Integration OAuth tokens and API keys encrypted at rest with an application key kept outside the database.
• Parameterised queries throughout to prevent SQL injection; rate-limited authentication endpoints to slow credential-stuffing.
• Principle of least privilege on internal access; production access is restricted to named engineers and logged.
• Visitor IPs hashed before being written to the widget event log.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to [email protected] and we will respond as quickly as we can. In the event of a personal-data breach affecting you, we will notify you and, where required, the Information Commissioner’s Office without undue delay and in any case within 72 hours of becoming aware.

12. Automated processing

The chat agent uses a large language model to generate replies, but those replies do not produce legal or similarly significant decisions about visitors. We do not use automated decision-making within the meaning of Article 22 UK GDPR.

13. Children

The Service is intended for use by businesses and people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact [email protected] and we will delete it.

14. Your rights

Subject to applicable law you have the right to:

• Ask what personal data we hold about you and get a copy of it.
• Correct inaccurate personal data.
• Delete personal data we hold about you (subject to legal retention, e.g. billing records).
• Restrict or object to certain processing.
• Receive your personal data in a portable format.
• Withdraw consent where we rely on it (this does not affect prior processing).

Workspace admins can perform most of these directly from the dashboard. For anything else, email [email protected] and we will respond within one month.

If you are unhappy with how we have handled your personal data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the supervisory authority in your country of residence within the EEA. We’d appreciate the chance to put things right first.

15. Changes to this policy

We will post material changes here with an updated date and, where the change is significant, notify existing account holders by email. Continued use of the Service after the change takes effect constitutes acceptance of the revised policy.

16. Contact

Privacy questions: [email protected]
Security reports: [email protected]
Postal: Serochat, 12 Lamborn Avenue, WA8 5DE.