Privacy Policy
What we collect, why we collect it, and the choices and rights you have.
1. Who we are
Way2Chat is a live chat service operated by Way2Chat (“we”, “us”). This policy explains how we handle personal data when you visit this website, create an account, or use the service.
This policy is a notice about how we process data. It is not a contract, and you are not asked to “agree” to it.
2. Our two roles
We handle personal data in two different capacities, and your rights run through a different organisation in each.
- As a controller — for our own customers' account and billing data, for people who visit this website, and for anyone who contacts us. We decide why and how that data is used, and this policy covers it.
- As a processor — for the visitors who chat on our customers' websites. The business that runs that website is the controller: it decides to use live chat and what to do with the conversations. We process that data only on its instructions, under our Data Processing Terms.
3. What we collect
Account and billing data
- Name, email address, company name and password. Passwords are stored only as a one-way bcrypt hash.
- Plan, subscription and payment records. Card payments are handled by our payment provider; we never receive or store full card numbers. For cryptocurrency payments we record the coin, amount and transaction reference.
- Team members and assistants you invite, and their names, emails and roles.
Data processed on behalf of our customers
- Chat messages and files that website visitors send, and agents' replies.
- Details a visitor chooses to give, such as a name or email address, and email verification codes.
- Technical information such as IP address, browser user agent, the page a chat started on, and whether a visitor is currently on the site.
- Satisfaction ratings and offline messages.
Usage, device and security data
- Sign-in activity, the actions taken in an account (shown to the account owner in its activity log), and error logs.
- Notification tokens for the agent mobile app, used only to deliver notifications.
- Storage on your device described in our Cookie Policy.
We do not buy personal data, we do not run advertising or analytics trackers on this website, and we do not use conversation content to train AI models.
4. How we use it, and our legal bases
Where the GDPR or UK GDPR applies, we rely on the following legal bases.
| Purpose | Legal basis |
|---|---|
| Creating and running your account and delivering the service | Performance of a contract |
| Taking payment, issuing receipts, keeping financial records | Performance of a contract; legal obligation |
| Service emails: verification, security alerts, billing notices, changes to the service | Performance of a contract |
| Preventing abuse, fraud and unauthorised access; rate limiting | Legitimate interests in keeping the service secure |
| Answering your support and sales questions | Legitimate interests; steps before entering a contract |
| Functional storage for the support chat on this website | Consent, which you can withdraw at any time |
| Complying with law and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds to continue. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Who we share it with
- Service providers that host, deliver or support the service under contract. They are listed, with what they do and where, on our Sub-processors page.
- Integrations you switch on, such as sending notifications to your own Slack workspace. Those are sent at your direction.
- Authorities or other parties where the law requires it, or where needed to protect people's safety or our rights.
- A successor if our business is sold or merged, subject to this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
Our service is hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside those regions. Where it is, we rely on appropriate safeguards recognised by the relevant authorities, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for more information about these safeguards.
7. How long we keep it
| Data | Retention |
|---|---|
| Accounts that never verify their email | Deleted automatically after 24 hours |
| Open conversations | While they remain open and the account is active |
| Closed conversations, with their messages, ratings and attachments | Deleted automatically once the chat-history period of the account's plan has passed since the conversation was closed. Each plan's period is shown on our Pricing page. |
| Pages visitors viewed on a customer's website | Deleted after 90 days |
| Account and team data | While the account is active. Deleted within 30 days of a verified deletion request or account closure, except where we must keep it longer by law. |
| Payment and invoice records | As long as tax and accounting law requires |
| Expired sign-in sessions and one-time tokens | Deleted when they expire |
| Rate-limiting records | Deleted after 1 day |
| Records of cookie choices made on this website | Kept as evidence of the choice; they contain no name, IP address or device details |
Customers who need a longer record than their plan keeps should keep their own copy, move to a plan with longer history, or ask us for a transcript while the conversation still exists.
8. Security
We protect data with measures including encrypted connections, hashed passwords and keys, access controls that separate every customer's data from every other's, and rate limiting. No system is perfectly secure; our Security page describes what we do and how to report a vulnerability.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to our processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing that happened before.
To exercise these rights, email admin@way2chat.com. We will respond within one month, and may need to verify your identity first. You also have the right to complain to your local data protection authority.
10. Additional rights for US residents
If you live in a US state with a comprehensive privacy law, such as California, you have the right to know what personal information we collect and how we use and disclose it, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising.
We treat a Global Privacy Control signal from your browser as a valid request to opt out, and we apply it automatically on this website. We will not discriminate against you for exercising any of these rights. You may use an authorised agent, whom we may ask to show proof of authority.
11. Children
The service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
When we make a material change we will update the effective date above and tell account holders by email before it applies. Previous versions are available on request.
13. Contact us
Questions about this policy or your data: admin@way2chat.com