Privacy Policy

1. About this policy

Last updated: 6 October 2026.

Reesponder is provided by CONVRO LTD, a company registered in England and Wales under company number 17444294, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

In this policy, “CONVRO”, “we”, “us” and “our” mean CONVRO LTD. A “Customer” is an organisation or individual using Reesponder for their business. A “Visitor” is a person interacting with Reesponder on a Customer’s website.

This policy covers our websites, customer portal, installed web application, support communications, embedded widget and related services. It explains both our own processing and processing we perform on a Customer’s behalf.

This policy is a privacy notice, not a request for consent. It does not replace a Customer’s own privacy notice, the Terms of Service or an applicable Data Processing Agreement.

2. Who is responsible for your information?

For our business relationship with you, CONVRO acts as a controller. This includes administering accounts, managing subscriptions, communicating with customers, maintaining business records and protecting our service.

For information processed through a Customer’s assistant, the Customer generally acts as the controller and CONVRO acts as its processor. The Customer decides why it uses the assistant, which website content and integrations it connects, which Actions it enables, and how its staff use conversation information. If the Customer is itself a processor, CONVRO may act as a subprocessor.

We process that Customer-controlled information on documented instructions, subject to applicable law and our agreement with the Customer. We may separately act as a controller where processing is necessary for our own legal obligations or legitimate service-security and business-administration purposes.

If you use an assistant on another organisation’s website, read that organisation’s privacy notice as well. It is normally your first point of contact for questions about your conversation, order information or a request made through the assistant.

3. Where information comes from

We receive information from:

• You, when you create an account, contact us, send a chat message, provide feedback or submit information for an Action.
• Customers and their authorised team members, including invitations, website configuration and uploaded or entered Knowledge.
• Websites and pages that a Customer asks Reesponder to crawl.
• Connected platforms and customer-selected services, where an authorised integration or Action retrieves information.
• Your browser or device, through requests, session information, browser storage and technical events.
• Payment and other service providers, such as payment-status notifications and information needed to operate the service.

Publicly available information can still be personal information. Its availability online does not remove the Customer’s responsibility to have an appropriate reason for using it.

4. Accounts, subscriptions and business communications

Account and business information may include your name, email address, organisation, workspace membership, role, connected domains, preferences, subscription, invoices, usage records, authentication events and communications with us.

We use Stripe for payment processing. We receive information needed to manage payments and subscriptions, such as customer and payment references, transaction status and relevant billing details. Reesponder does not store your full payment-card number or card security code.

Payment providers may also process information as independent controllers for their own legal, fraud-prevention and financial obligations. Their privacy notices apply to that processing.

Certain information is necessary to create an account, authenticate you, take payment or provide support. If it is not provided, the relevant service may be unavailable. Optional profile and configuration information is not required unless it is needed for a feature you choose to use.

5. Website content and Knowledge

Customers can provide Knowledge through website crawling, supported documents and manually entered content. We process the source content, page addresses, document details, extracted text and search representations needed to retrieve relevant information for the assistant.

Knowledge may contain personal information, including names, business contact details or information included in a Customer’s documents. Customers should provide only content they are entitled to use and that is appropriate for the intended audience.

Knowledge is used to prepare answers. Information included in Knowledge may therefore be disclosed to Visitors through those answers. Customers should not treat the Knowledge area as a private archive for secrets or documents that the assistant must never disclose.

Removing a Knowledge source prevents its further use once the removal has been processed. It does not automatically remove information already included in retained conversations, customer exports or another recipient’s records.

6. Conversations and website context

When a Visitor interacts with an assistant, Reesponder may process:

• Messages, generated replies, feedback and conversation status.
• Website, visitor, browser-tab and conversation identifiers.
• The current page address, language and relevant page context.
• Information the Visitor supplies voluntarily, such as an email address, order reference or support request.
• Relevant Action inputs, results, verification and confirmation events.
• Timing, usage, delivery and error information needed to operate and support the conversation.

Page addresses may include query parameters. Customers should avoid placing passwords, access tokens or unnecessary personal information in URLs or in page context supplied to the widget.

Authorised Customer team members can access conversation information according to their permissions and the applicable retention settings. If an interaction is escalated, relevant information may also be included in the Customer’s configured support workflow or notification.

Where enabled and available under the Customer’s plan, website journey features may associate page activity with a pseudonymous visitor or conversation. This differs from using only the current page to answer a question.

7. Actions, identity verification and connected services

Actions allow an assistant to retrieve information or carry out a configured operation through a connected service. Business supports read-only Actions; Scale supports read and write Actions. Processing depends on the Actions the Customer configures and enables.

Action information may include an order reference, email address, request details, selected options, returned account or order information, execution status and a record of the Visitor’s confirmation. The relevant inputs are sent to the configured service, and results may be displayed in the conversation or used by the assistant to explain the outcome.

Where an Action requires email verification, we process the submitted email address, send a one-time code and maintain temporary verification and attempt records. Server-side code verification uses a hash rather than storing the code in readable form. Codes expire after 10 minutes; successful verification is valid for a limited period, currently 30 minutes.

Supported write Actions require the Visitor to confirm the proposed operation before execution. Email verification and an Action confirmation are operational safeguards; they are not blanket consent to unrelated processing or proof of a person’s identity for every purpose.

Shopify, WordPress, WooCommerce and custom integrations may involve website identifiers, authorised access credentials, connection status and information returned by the connected system. Connecting a website does not by itself mean that Reesponder imports the platform’s entire customer or order database.

Customers choose the systems and endpoints used by their Actions and are responsible for the permissions and disclosures associated with those choices. A Customer-selected endpoint may be operated by the Customer or by another provider under its own terms.

Disconnecting an integration stops future authorised access through that connection. It does not undo an operation already completed or delete records held independently by the connected service.

8. AI processing and use of content

Reesponder uses external AI infrastructure to generate responses. Approved AI service providers process these requests on our behalf. Relevant messages, conversation context, Knowledge extracts and, where applicable, Action information are submitted for processing so that the assistant can produce a response.

We do not need to send every document or an entire connected database for each answer. However, information you include in a message, relevant source content or an Action result may become part of the context used to generate a response.

CONVRO does not use Customer Knowledge or Visitor conversations to train a CONVRO-owned general-purpose foundation model. Operational analysis, troubleshooting and evaluation of the service are separate activities and may involve information processed for those purposes.

Processing by an external AI provider is also subject to the applicable API terms and any data-processing arrangements agreed with that provider. Our statement about CONVRO’s own model-training use is not a promise of zero retention or identical data-use terms across every external provider. Customers can contact us for information about the applicable provider arrangements.

AI responses can be inaccurate. The Customer remains responsible for deciding whether an assistant and its configured Actions are appropriate for the intended use.

9. Cookies, browser storage and the installed app

Reesponder uses browser storage and similar technologies for authentication, conversation continuity, preferences, usage accounting and service operation.

• Customer portal: authentication cookies and browser settings support sign-in, account security and interface preferences.
• Widget visitor identifier: local storage holds a randomly generated identifier scoped to the website installation and browser origin. It helps recognise the same browser for service operation and usage accounting.
• Widget session information: session storage holds browser-tab and conversation information to maintain continuity within the browser session.
• Installed web application: a service worker supports the app experience and an offline fallback. It does not provide an offline archive of private conversations or account pages.

The widget’s local-storage visitor identifier has no application-set expiry. It can remain until browser storage is cleared or removed by the browser. Session storage normally lasts for the tab’s session, subject to browser session-restoration behaviour.

Loading the widget can make network requests and initialise storage before a Visitor sends a message. Charging usage only after the first message does not mean that no technical processing occurs before that message.

Customers must assess the storage and access technologies used on their websites, provide appropriate information, and obtain consent before loading technologies where applicable law requires it. Describing a feature as useful or operational does not automatically make it exempt from consent requirements.

You can use browser controls to clear or restrict storage. This may sign you out, reset preferences or interrupt conversation continuity. Clearing browser storage does not itself delete information already held on our servers.

10. Technical information and security logs

Our servers and infrastructure providers process technical information needed to deliver and protect the service. This can include IP addresses, request times, browser information, requested resources, response status and error or security events.

A randomly generated visitor identifier is not a Visitor’s name, but it can still be personal information when it relates to an identifiable person or can be linked with other records. Pseudonymous information is not automatically anonymous.

An IP address is not required as a permanent conversation-profile field for the assistant to operate. Nevertheless, IP addresses may be processed in network delivery, infrastructure logs, rate limiting, fraud prevention and incident investigation. We do not promise that IP addresses are never processed.

11. Why we process information

We process information to:

• Create and administer accounts, workspaces and team access.
• Connect websites, prepare Knowledge and deliver the assistant.
• Maintain conversations, retrieve relevant context and carry out authorised Actions.
• Verify access to protected information and record necessary confirmations.
• Provide conversation history, feedback, analytics and support workflows.
• Calculate usage, administer subscriptions and maintain payment and accounting records.
• Deliver authentication, service, support and permitted marketing communications.
• Diagnose faults, assess service quality, prevent abuse and maintain reliability and security.
• Meet legal obligations, respond to valid requests and establish, exercise or defend legal claims.

Access to message content for support or investigation is limited to circumstances where it is relevant to the purpose being addressed. We do not sell or rent personal information or use Customer conversation content to build advertising profiles for sale to third parties.

12. Our lawful bases

Where CONVRO acts as controller, the lawful basis depends on the purpose and circumstances:

• Contract: processing necessary to enter into or perform a contract with you, where you are the individual contracting party.
• Legitimate interests: administering business relationships and team accounts, providing support, protecting the service, preventing misuse and improving reliability, where those interests are not overridden by your rights and interests. This commonly applies when you act on behalf of a business Customer.
• Legal obligation: processing required for accounting, tax, regulatory or other applicable legal duties.
• Consent: processing for which consent is required, including certain marketing communications or storage and access technologies.

Where we act as processor, the Customer determines the lawful basis for its processing and provides the relevant instructions. Our contract with a Customer is not, by itself, the Customer’s lawful basis for processing every Visitor’s information.

Where processing relies on consent, you can withdraw it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

13. Analytics, usage and conversation continuity

Reesponder processes usage and interaction records to administer plan allowances and provide the analytics available to the Customer. These records can include conversation counts, response activity, feedback, Action outcomes and relevant website activity.

The six-hour usage window and the allocation of AI answers described in our Terms are billing and service-accounting rules. They are not transcript-retention periods and do not mean that all related information is deleted after six hours or after 20 answers.

We may retain limited usage and operational records separately from message content. A record remains personal information where identifiers or other details still allow it to be linked to an individual.

Conversation context is used to maintain the current interaction. Reesponder does not automatically treat every previous conversation as permanent personal memory for future chats. This does not prevent a configured Action from retrieving relevant information from a Customer’s connected system.

14. Who information is shared with

Information may be disclosed, as relevant to the service, to:

• The Customer and its authorised users: including staff responsible for conversations, support, configuration and analytics.
• Service providers: hosting, database, network delivery, security, AI processing, email delivery, payment and other operational providers. Our service uses external AI infrastructure, Stripe for payments and Cloudflare for network and security services.
• Connected services: platforms and endpoints selected or authorised by the Customer for integrations, Actions and support workflows.
• Professional advisers: where reasonably necessary for legal, accounting, insurance or similar professional services.
• Authorities and other legally entitled recipients: where disclosure is required by law or is necessary and lawful to protect rights, investigate abuse or respond to legal proceedings.
• Parties to a business transaction: where necessary in connection with a proposed or completed restructuring, financing, merger or sale, subject to appropriate confidentiality and data-protection arrangements.

These recipients do not all receive the same information. For example, payment processing does not require a copy of every Visitor conversation.

Depending on its role, a recipient may act as a processor, subprocessor or independent controller. Customers can request information about subprocessors and the applicable Data Processing Agreement using the contact details below. Subprocessor authorisation and notification requirements are governed by the applicable agreement.

15. International processing

CONVRO is established in the United Kingdom. Reesponder does not offer a general promise that all information remains exclusively in the United Kingdom or European Economic Area. External providers and Customer-connected services may process information in other countries.

The processing locations and transfer arrangements depend on the provider and service involved. Customer-selected integrations may introduce additional destinations under the Customer’s own arrangements.

Where a transfer is restricted by applicable data-protection law, it requires a permitted transfer mechanism. Depending on the circumstances, this may involve an adequacy decision or contractual safeguards, such as applicable standard contractual clauses and the UK Addendum or International Data Transfer Agreement, together with any necessary additional measures.

Contact us to request details of the processing locations and transfer arrangements applicable to the service, including how to obtain information about relevant safeguards. This policy does not itself constitute a transfer agreement or consent to an otherwise unlawful transfer.

16. How long information is retained

Retention depends on the type of information, the Customer’s plan and settings, our contractual instructions and applicable legal requirements.

• Conversation content: standard transcript retention is 7 days for Core, 30 days for Business and 90 days for Scale. A supported shorter retention setting takes precedence. Expired content is removed through scheduled retention processing.
• Conversation-related Action data: stored inputs, results and verification information are subject to the associated conversation-retention and cleanup processes. Limited execution metadata may remain separately for operational and audit purposes.
• Action tests: administrative test-run records are scheduled for cleanup after 24 hours.
• Verification records: codes and verification grants expire after their validity periods; expired records are removed through scheduled cleanup.
• Knowledge and configuration: retained while needed for the connected website and service, unless removed earlier or deleted through the applicable account lifecycle.
• Account, support and business records: retained for the relationship and for an appropriate period afterwards where needed to resolve enquiries, maintain required records or handle claims.
• Billing and accounting records: retained separately where required by tax, accounting, payment or other legal obligations.
• Security and technical logs: retained according to their operational purpose, incident-investigation needs and the relevant infrastructure arrangements.

Where a fixed period is not stated, we consider the purpose, sensitivity and amount of information, whether it remains necessary, the risk of retaining it, and relevant legal or contractual requirements.

Deletion from active systems does not necessarily erase every backup copy at the same moment. Where backups exist, residual copies remain restricted and are removed through the applicable backup lifecycle. We may preserve specifically relevant records where required by law or necessary for an active dispute or security investigation.

Customer exports, delivered emails and records held by connected services have their own retention rules. Deleting a Reesponder record does not automatically delete those independent copies.

Tailored demos: we use the contact details, company, public website and goals submitted with a demo request to review it and respond. Request records are retained for 90 days. An unpublished prepared demo is available for review for up to 48 hours; a published demo link expires 36 hours after publication and can be revoked earlier. Access ends at expiry or revocation. Website snapshots, retrieved public website Knowledge and demo conversation content are then removed from the active demo service through scheduled cleanup. Limited demo preparation metadata is retained for 30 days and security audit records for 90 days, measured from creation.

17. Removing a website or closing a workspace

Removing a website disables its active installation and associated access, and initiates removal or invalidation of related Knowledge and integration configuration. It does not automatically erase every historical conversation, usage entry or accounting record associated with that website. Those records remain subject to their applicable retention rules.

Where workspace termination triggers our deletion workflow, access is suspended and workspace deletion is scheduled for 12 days after termination. Deletion is then carried out through background processing. This is a scheduling interval, not a guarantee that every backup or separately required business record disappears at precisely the same time.

Stopping a subscription renewal is not necessarily the same as immediately terminating and deleting a workspace. Access may continue until the end of the applicable paid period. Customers should use the relevant account controls or contact us if they require clarification or wish to request earlier deletion.

Removing one workspace does not necessarily remove a user’s account or information relating to other workspaces to which that user still belongs.

19. Security and incident handling

Reesponder uses technical and organisational controls designed to protect information, including access controls, workspace separation, encrypted network connections, domain-bound widget installation, protected integration credentials and validation of relevant signed requests.

Opaque authentication and installation tokens are stored server-side in hashed form where the service uses hash-based verification. Integration credentials that must be recovered to contact a provider are protected using encryption. These are different mechanisms and do not mean that all service information is end-to-end encrypted.

Customers are responsible for managing team access, protecting their own accounts and connected systems, and configuring Actions appropriately. No internet service or security measure can guarantee that an incident will never occur.

If a personal data breach affects information we process on a Customer’s behalf, we notify the affected Customer without undue delay after becoming aware of it, in accordance with applicable law and our agreement. Where CONVRO acts as controller, we make notifications to authorities and affected individuals when legally required.

20. Automated responses and decisions

The assistant generates responses automatically and can select or propose configured Actions. Supported operations may then be executed subject to their verification, permission and confirmation requirements.

Reesponder is not designed to independently determine eligibility for employment, credit, insurance, healthcare or other decisions with legal or similarly significant effects.

A Customer must not assume that an AI-generated response or a Visitor’s confirmation removes its obligations concerning significant automated decisions. If its intended use falls within those rules, it must establish the required legal basis, safeguards, explanations and human-review arrangements.

Visitors should contact the website operator to challenge an outcome or request human assistance with a consequential matter.

21. Service messages and marketing

We send messages needed to operate the service, such as authentication codes, invitations, billing notices, security communications, support responses and configured operational notifications.

Where we send direct marketing, we do so in accordance with applicable law. You can opt out using the mechanism provided in the message or by contacting us.

Opting out of marketing does not prevent necessary service communications. We may retain a limited suppression record so that we can respect your marketing preference.

22. Children

Reesponder business accounts are intended for adults aged 18 or over. The service is not designed specifically for children, and we do not routinely verify the age of every website Visitor.

Customers remain responsible for considering the audience of their websites, including whether children are likely to access their assistant and whether additional notices, restrictions or safeguards are required.

If you believe that a child’s information has been processed inappropriately, contact the relevant website operator or CONVRO using the details below.

23. Your rights

Depending on the applicable law and circumstances, you may have the right to:

• Access your personal information and receive a copy.
• Correct inaccurate or incomplete information.
• Request deletion of personal information.
• Request restriction of processing.
• Object to processing based on legitimate interests, including related profiling.
• Object at any time to processing for direct marketing.
• Receive certain information in a portable format and request its transfer where the right applies.
• Withdraw consent where processing relies on consent.
• Exercise applicable rights concerning significant automated decisions.
• Complain to a relevant supervisory authority.

These rights are subject to their legal conditions and exceptions. For example, some information may need to be retained to meet a legal obligation even when deletion has been requested.

To make a request concerning information controlled by CONVRO, email [email protected]. Please explain your request and provide enough information for us to locate the relevant records. Do not send passwords or unnecessary identity documents.

We may request proportionate additional information to verify your identity or clarify the request. We respond within the applicable legal deadline, generally one month, subject to permitted extensions or adjustments. If an extension applies, we explain it as required by law.

If your request concerns an assistant on a Customer’s website, contact that Customer first. Where we act as processor, we assist the Customer with requests under our agreement and applicable law rather than independently deciding how its information should be used.

24. Questions and complaints

You can contact us about a privacy concern without first making a formal rights request. We will consider the issue and explain the appropriate next steps.

You also have the right to complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint . Where applicable, you may instead contact the supervisory authority in your country of residence, place of work or the place of the alleged infringement.

You do not have to contact us before exercising your right to complain to an authority.

25. Changes to this policy

We may update this policy to reflect changes to the service, our processing practices or applicable requirements. The date at the beginning identifies the latest revision.

Where a change materially affects how personal information is processed, we provide an appropriate notice, such as an account notification, email or website notice. Where a new use requires consent or another legal step, publishing a revised policy does not replace that requirement.