Privacy Policy

1. Who We Are

Empirical Management Consulting Ltd, trading as SMEChatbot.com, is registered in England and Wales under company number 06510103.

Registered office: View our registered office at Companies House

Privacy contact: info@smechatbot.com.

For information about our own website visitors, prospective customers, account holders, and billing contacts, we generally act as a data controller. For leads and conversations handled by a chatbot on a business customer's website, the business customer generally determines the purposes and means of processing and acts as controller; we generally act as its processor, subject to the actual arrangement.

2. Scope of This Notice

This draft explains how personal information may be handled when you visit SMEChatbot.com, contact us, request a demonstration, purchase services, use an account, or interact with a chatbot we operate. A business customer's own privacy notice should explain its collection and use of information from visitors to its website.

Where we process information only on a business customer's instructions, requests about that information should ordinarily be directed to the relevant business. We will assist the business in accordance with our data processing agreement and applicable law.

3. Information We May Collect

• Contact and business details: name, business name, work email, telephone number, service requirements and messages.
• Account and order information: selected package, subscription status, invoices, payment status and support history.
• Chatbot information: questions, responses, lead details, appointment requests and any information a visitor chooses to enter.
• Technical information: IP address, device/browser information, logs, timestamps and security diagnostics where collected.
• Preferences: marketing choices and cookie preferences where supported.

Please do not submit passwords, payment-card details, health information or other sensitive personal information through chatbot messages unless expressly requested through an appropriate secure process.

4. Where Information Comes From

We may receive information directly from you, from a business customer using our services, from payment and hosting providers, and automatically from your interactions with our website and systems. Information supplied by business customers may include their business content, service areas and customer enquiries.

5. Why We Use Information and Legal Bases

When we act as controller, the legal basis depends on the activity:

• Contract / steps before a contract: responding to service requests, creating accounts, delivering subscriptions and managing support.
• Legal obligation: tax, accounting, regulatory compliance and responding to valid legal requests.
• Legitimate interests: securing services, preventing misuse, maintaining service quality and handling ordinary business enquiries, subject to balancing individuals' rights.
• Consent: where required for optional marketing or non-essential cookies and similar technologies.

When we act as processor, the business customer's lawful basis governs the underlying chatbot/lead processing; we process that data under documented instructions, subject to applicable law.

6. Chatbot Conversations and Lead Capture

Our services can answer enquiries, collect lead information and route requests to the relevant business. The business customer is generally responsible for identifying the lawful basis, providing appropriate notices and deciding which information its chatbot should collect.

AI-generated responses may be inaccurate. Users should avoid providing unnecessary personal information in chat messages. We do not sell chatbot conversation data. We do not use customer conversations to train AI models without an appropriate lawful basis and authorisation.

Implementation check: The precise model hosting, logging, subprocessors and AI processing arrangements must be verified before this notice is finalised.

7. Payments and Subscriptions

We use Stripe for checkout, payment processing, subscriptions and customer billing functions. Stripe may process payment-card and billing information under its own applicable privacy terms and its role in the transaction. We receive information such as payment status, transaction identifiers, billing contact details and invoice records; we do not need to store full payment-card numbers in our own application.

For details about Stripe's own processing, see Stripe's Privacy Policy.

8. Service Providers and Subprocessors

Depending on the service and deployment, information may be processed by providers supporting payments, website hosting, databases, automation, email delivery, security and AI processing. Our technical stack includes Supabase for certain data storage functions and n8n for workflow automation; these references do not by themselves establish which company is a data recipient or where information is hosted.

We disclose personal information only as reasonably needed to provide services, meet legal obligations, protect systems or carry out other disclosed purposes. We do not sell personal information.

To verify before publication: the current list of legal entities, hosting locations, subprocessors, email providers and their contractual safeguards.

9. International Transfers

Personal information may be accessed or stored outside the United Kingdom or European Economic Area depending on the hosting and provider configurations. Where applicable law requires it, we will use a valid transfer mechanism and any necessary supplementary safeguards.

To verify before publication: actual data residency, international access and relevant transfer arrangements for each provider.

10. Retention and Deletion

Our intended standard retention approach is:

• Chatbot conversations: a target of 90 days.
• Business-customer lead records: during the subscription and up to 30 days following expiry, subject to instructions and legal requirements.
• Managed website files: up to 30 days following service expiry, subject to contractual arrangements.
• Billing and accounting records: for the applicable statutory retention period.

These are proposed service rules, not a confirmation that automated deletion has been implemented. Actual retention, backup copies, deletion schedules, and any legal holds must be checked and aligned with customer agreements and the applicable data processing agreement before final publication.

11. Security

We aim to apply appropriate technical and organisational safeguards, such as access controls, encrypted connections, restricted credentials, logging and maintenance. No online service can guarantee absolute security.

If you suspect a security issue, contact info@smechatbot.com. Where we act as processor, we will notify the relevant controller of a personal data breach without undue delay as required by applicable law and the data processing agreement.

12. Your Privacy Rights

Depending on the circumstances and applicable law, you may have rights to access, correct, erase or restrict personal information, object to certain processing, receive portable information and withdraw consent. You may also have rights relating to decisions made solely by automated means.

To exercise rights relating to our own processing, email info@smechatbot.com. We may need to verify your identity. For information collected by a business customer's chatbot, please contact that business first; we will assist where required.

You may complain to the UK Information Commissioner's Office (ICO), or to a relevant EEA supervisory authority where applicable.

13. Cookies and Similar Technologies

Our website may use essential technologies required for core functions and security. Optional analytics, advertising or similar technologies should only be used in accordance with applicable consent requirements, including a genuine choice to reject where consent is required.

To verify before publication: an inventory of actual cookies, scripts, storage mechanisms, their purposes, providers and durations, and whether a compliant consent interface is needed. This draft does not claim that a consent banner has already been deployed.

14. Marketing Communications

We may send service communications needed to administer accounts or subscriptions. Optional promotional messages will be sent only where permitted by applicable electronic marketing and data protection rules. Where consent is the basis, you may withdraw it at any time. Marketing emails should include an appropriate opt-out method.

15. Children

Our paid services are intended for adults acting for themselves or their organisations. Our services are not designed to intentionally collect children's personal information through SMEChatbot.com. Business customers must assess whether their own chatbot deployment is likely to be used by children and implement appropriate protections.

16. Changes to This Notice

We may update this notice to reflect changes to our services, technology, legal requirements or processing activities. Material changes will be communicated where required. The effective date will be shown when a final version is approved and published.

17. Contact

Empirical Management Consulting Ltd
Trading as SMEChatbot.com
Company number: 06510103
Registered in England and Wales

Email: info@smechatbot.com

Registered office: see the dynamically retrieved address in Section 1 above.