Privacy Policy
Last updated October 2026. Plain English, because a policy nobody can read protects nobody.
1. Who we are
This policy covers WayChat, operated by LEGAL ENTITY NAME, registered in COUNTRY (“we”, “us”). You can reach us at hello@waychat.io.
2. Two different relationships
It matters which one applies to you, because the answers differ:
- You have a WayChat account. We are the controller of your account data and this policy governs it in full.
- You chatted with an agent on somebody else’s website. That business is the controller of your conversation. We only process it on their instructions, as their processor. Your request to see or delete that data should go to them — though you can write to us and we will route it.
3. What we collect
If you hold an account
- Business name, email address, and a hashed password
- Your website address, and the pages our crawler reads from it
- Your settings: widget appearance, custom Q&A, products and prices, booking slots
- Subscription and billing status
- Ordinary server logs: IP address, browser, timestamps
If you chat with an agent
- The messages you send and the agent’s replies
- Anything you volunteer in the chat — typically name, email and phone when you ask to be contacted
- Voice audio, only if the business has enabled voice and you choose to speak
- Technical data: IP address, browser, the page you were on, timestamps
Payments
If you buy something from a business through its agent, the payment runs through that business’s own Stripe, PayPal, Square or Authorize.Net account. Card details go directly to that provider. We never see, handle or store card numbers.
4. Why we process it, and on what basis
| What | Why | Basis |
|---|---|---|
| Account details | Run your account, bill you, support you | Contract |
| Crawled page content | So the agent can answer from your site | Contract |
| Conversations & leads | Deliver the service to the business | Processor, on the business’s basis |
| Server logs | Security, abuse prevention, debugging | Legitimate interests |
| Service emails | Verification, lead alerts, billing notices | Contract |
We do not use your content or your visitors’ conversations to train our own models, and we do not sell, rent or trade personal data to anyone.
5. Who else is involved
Generating a reply means sending the relevant conversation text to a third-party AI provider. These are the categories of sub-processor we rely on:
| Category | What it does |
|---|---|
| AI model providers | Turn a question plus your site content into an answer |
| Voice providers | Speech-to-text and text-to-speech, only when voice is enabled |
| Hosting | Runs the application and the database |
| Email delivery | Sends verification, lead alert and billing emails |
| Payment providers | Our own subscription billing; your customers’ payments go to your account |
The current named list is available on request at hello@waychat.io.
BEFORE LAUNCH: name the actual providers here — GDPR requires the specific list, not just categories.
6. Where it is processed
Our servers and some of our providers are outside your country, so your data may be transferred internationally. Where that involves personal data leaving the UK or EEA, we rely on Standard Contractual Clauses or an adequacy decision. CONFIRM HOSTING REGION AND TRANSFER MECHANISM
7. How long we keep it
- Account data — while your account is open, then up to 90 days after you close it
- Conversations and leads — until the business deletes them, or 90 days after their account closes
- Crawled page content — refreshed on each crawl; removed when you delete the source
- Server logs — a short rolling window for security and debugging
- Billing records — as long as tax and accounting law requires
8. Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or export it in a portable format. Write to hello@waychat.io and we will respond within 30 days. If you chatted with an agent on another company’s site, ask that company first — they control that conversation.
You also have the right to complain to your data protection authority.
9. Security
Passwords are hashed, never stored in readable form. Traffic runs over HTTPS. Stored third-party credentials are encrypted. Access to production data is limited to people who need it to run the service. No system is perfect, and we will not pretend otherwise — if a breach affects you, we will tell you.
10. Cookies and local storage
We keep this deliberately small:
- A session cookie to keep you logged in. Strictly necessary; it carries no tracking.
- Local storage on this site to remember your light/dark preference.
- The chat widget stores a conversation identifier so your chat survives a page refresh.
We do not run advertising or cross-site tracking cookies.
11. Children
This is a business product and is not directed at children under 16. We do not knowingly collect their data; if you believe we have, write to us and we will delete it.
12. If you run an agent on your site
You are the controller of those conversations. That means it is on you to tell your visitors that an AI agent handles the chat, to link your own privacy policy, and to collect any consent your local law requires. Our Terms of Service cover this in more detail.
13. Changes
If we change this policy materially we will update the date above and email account holders before it takes effect.
14. Contact
Questions, requests or complaints: hello@waychat.io, or through the contact page.