Free privacy notice

Who we are and how to contact us

ComplyChat is a service of CIaaS Limited, company number 14519311, registered at C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB. For privacy questions or rights requests, contact compliance@chat.org.uk.

What we process and why

We process your mobile number, chosen name, workspace and membership details, messages, attachments and call content to provide the service under our contract with you. The owner may supply your number and name when inviting you. Phone codes prove control of a number; passkeys use public-key credentials. We do not receive your fingerprint or face scan.

We process session and device identifiers, IP addresses, security events and limited operational records for our legitimate interests in keeping the service secure, preventing abuse and investigating faults. We process support correspondence to help you and handle complaints, and retain information where a legal obligation requires it. We do not sell your information or use private conversations to target advertising.

Calls and AI

Calls are recorded for transcription and optional AI summaries. The app tells you before a call and shows a recording indicator. Recordings and internal transcript files are removed from active storage after processing, or after 24 hours if processing cannot complete. Summaries remain with the conversation for its normal history period. Voice notes are not transcribed. AI summaries are assistance, not decisions about you, and may be inaccurate.

Who receives information and where

Your messages reach the participants in their conversation. Workspace ownership does not grant access to other people’s direct messages. Authorised ComplyChat personnel may access information where necessary to support and secure the service, handle a report or comply with the law.

Core messaging storage and processing run in UK Azure. Supporting services, including SMS, push notifications, live-call routing and maps, may process outside the UK. Our service provider list explains those services and transfer safeguards. For Free, we engage them as processors for our own controller responsibilities. There is no customer Microsoft 365 archive.

How long we keep information

Conversation content expires after three calendar months, including ordinary attachments, voice notes and AI summaries. Call captures follow the shorter processing period above. Expired content is unavailable through the app and its search; storage deletion is retried if a temporary fault prevents it. Recovery copies expire under the storage backup and recovery policy and are not available as ordinary history.

Account and membership information is kept while your account is active. We retain only what is needed afterwards to complete deletion, deal with a dispute, demonstrate terms acceptance or meet a legal obligation. Security and abuse records are retained according to their operational purpose and any relevant investigation, rather than being used to reconstruct expired conversations.

Your choices and rights

You can leave a conversation, report inappropriate content, manage device permissions and request account deletion. You may have rights to access, correct, erase, restrict or obtain a portable copy of your personal data, depending on the processing and applicable law.

You can object to processing based on legitimate interests. Contact compliance@chat.org.uk and tell us what you object to. We will consider your circumstances and explain the outcome. You can complain to the Information Commissioner’s Office.