Privacy Policy

SimplyChat is live chat software that businesses install on their own websites. This policy describes what the SimplyChat service collects, where it is stored, and who else processes it.

Two different groups of people

Account holders are the businesses that sign up for SimplyChat and install the widget. For their account data, SimplyChat is the controller.

Website visitorsare the people who browse an account holder's website and chat through the widget. For that data the account holder is the controller and SimplyChat acts as their processor: we handle visitor data on their instructions and store it for them. If you are a visitor asking about your data, the operator of the website you were browsing is the right first point of contact — although you can reach us directly too.

What we collect from account holders

• Your email address and password, handled by our authentication provider — we never see a plaintext password.
• Your agent display name and avatar URL.
• Your sites: name, domain, widget appearance, hours of operation, and saved canned replies.
• If you turn on push notifications, the push endpoint and keys your browser issues, so we can deliver a notification to that device.

What the widget collects from website visitors

Whenever the widget loads on a page, it records:

• A random visitor token the widget generates and stores in the visitor's browser, so a returning visitor keeps the same conversation.
• IP address, and an approximate location (country, region, city) derived from it.
• The browser user agent, and the browser, operating system and device type read from it.
• The network operator the connection belongs to, which is used to filter out automated traffic from data-centre networks.
• Pages viewed on the account holder's site while the widget is loaded: URL, page title, the referring URL, and timestamps.
• The content of chat messages, and any files sent in a chat.
• A name and email address only if the visitor types them into the pre-chat form or leaves an offline message, or if the website passes them to the widget for a signed-in customer.

Agents can also see which page a visitor is on in real time while the visitor is on the site. This is visible to the operator of that website, not to other SimplyChat customers.

Cookies and local storage

The chat widget sets no cookies. It uses your browser's local storage for two values: the visitor token described above, and a flag recording that the pre-chat form has already been completed. The SimplyChat dashboard sets a session cookie so account holders stay signed in. There are no advertising or analytics cookies, and the SimplyChat marketing site runs no third-party analytics or tracking scripts.

Where data is stored

Application data — accounts, sites, visitors, conversations, messages and chat attachments — is stored with Supabase on Amazon Web Services infrastructure in the United States (us-east-1). The application itself is hosted by Vercel. If you are in the UK, EU or elsewhere, your data is therefore transferred to and processed in the United States.

Who else processes it

• Supabase — database, file storage, authentication and realtime delivery.
• Vercel — application hosting and content delivery.
• Anthropic — when automatic chat translation or agent reply suggestions are used, the relevant message text is sent to Anthropic's API to produce the translation or suggestion.
• Your browser's push service — for account holders who enable push notifications, a short notification is delivered through the push service operated by the browser vendor.

SimplyChat does not sell personal data and does not share it for advertising.

Files sent in chat

Images and files sent through the widget are stored in a public storage bucket under a long, randomly generated path. The link is not listed or indexed anywhere, but anyone who has the link can open the file without signing in. Do not send anything through chat that you would not want readable by someone holding that link.

How long it is kept

Conversations, messages, visitor records and offline messages are kept until the account holder deletes them or deletes the site they belong to. Deleting a site permanently removes that site's visitors, conversations, messages and offline messages; this cannot be undone. A visitor's live session is marked inactive shortly after they leave the page, and an inactive conversation is closed automatically after about 15 minutes.

Your choices

• You can clear the visitor token at any time by clearing your browser's site data; the next visit starts a new, unlinked visitor record.
• Account holders can delete individual offline messages, whole sites, or their canned replies from the dashboard at any time.
• To request access to, correction of, or deletion of personal data, contact us at the address below. Where SimplyChat is acting as a processor for a website operator, we will pass the request to them.

Children

SimplyChat is a business tool and is not directed at children.

Changes

If this policy changes materially we will update the date at the top of this page. Continued use of the service after a change means you accept the updated policy.

Contact

Questions about this policy, or a request about your data: support@simplychat.io.