Privacy Policy

Introduction

Webclerk ("we," "our," or "us") provides AI-powered customer-support chatbots that businesses embed on their own websites. This Privacy Policy explains what data we collect, how we use it, and the rights you have. It covers both our business customers and the visitors who chat with a Webclerk-powered chatbot on a customer's website.

Who This Policy Covers

Business customers

If you have a Webclerk account, we act as the data controller for your account information and the content you provide to build your chatbot.

Chatbot visitors

If you chat with a Webclerk-powered chatbot on a business's website, that business is the data controller for your conversation. We process conversation data on the business's behalf as a data processor. Requests about your conversation data should be directed to the business whose website you used; we support them in fulfilling those requests.

Information We Collect

From business customers

• Contact information (name, email, phone number)
• Business information (company name, website URL)
• Website content and documents you provide for your chatbot's knowledge base

From chatbot conversations

• Messages visitors send to a chatbot and the responses it generates
• Optional details a visitor chooses to share during a conversation (for example, contact details for a follow-up)

Collected automatically

Our servers keep standard access logs, including IP addresses, for security and operations. The Webclerk dashboard uses only strictly necessary session cookies to keep you signed in — we use no analytics or advertising cookies, and no tracking technologies. The embedded chat widget does not set cookies on visitors' browsers.

How We Use Your Information

• Provide and maintain the chatbot service
• Generate AI responses grounded in the business's own content
• Respond to your requests and communications
• Maintain the security and reliability of the service
• Send service updates; marketing communications only with your consent
• Comply with legal obligations

Legal Bases for Processing

Where the GDPR applies, we process personal data on these bases:

• Performance of a contract — providing the chatbot service you signed up for
• Legitimate interests — securing and operating the service, and improving it
• Consent — marketing communications, which you can withdraw at any time
• Legal obligation — where processing is required by law

AI Processing and Subprocessors

To generate chatbot responses, we send the business's knowledge-base content and the conversation messages to Google Cloud's Vertex AI platform (the Gemini model). We use Vertex AI's EU endpoint, so this processing takes place within the European Union, and our own infrastructure is hosted in the EU as well. Under Google Cloud's data-processing terms, this data is not used to train Google's models.

What is shared with the AI provider:

• The business's knowledge-base content (website content and uploaded documents)
• Visitor messages sent to the chatbot and the responses generated for them

We do not share business customers' account contact details (name, email, phone) with the AI provider. We do not sell personal data, and we do not share it with any third party for advertising.

Facebook Messenger Channel

Businesses can connect their Facebook Page to Webclerk so their chatbot also answers messages sent to that Page on Facebook Messenger.

What we receive from Meta when a business connects a Page

• The list of Pages the business manages (Page names and IDs, shown only during connection)
• A Page access token that we store to operate the connection

What we receive for a connected Page

Messages sent to the Page on Messenger (message text, a page-scoped sender ID assigned by Meta, and timestamps). We do not receive the sender's name, profile, or contact details.

How we use it

To generate automated replies grounded in the business's own content (via the same Vertex AI processing in the EU described above), and to hand the conversation over to the Page's own inbox when a human should take over. The business remains the data controller for these conversations; we act as a processor.

Messenger conversations follow the same retention rule as other conversations: automatically deleted after 90 days of inactivity.

We do not use data received from Meta for advertising, do not sell it, and share it with no third party other than the AI subprocessor described above.

To have your Messenger conversation data deleted, see our Data Deletion Instructions.

Data Retention

• Chatbot conversations are automatically deleted after 90 days of inactivity. Aggregate usage counts (with no message content) are retained for billing and capacity purposes.
• Business account data is retained for as long as the account is active, and afterwards only as long as required by law.
• You may request deletion of your data at any time — see our Data Deletion Instructions.

Data Security

We implement appropriate security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

Your Rights

Where the GDPR applies, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

To exercise these rights, contact us at admin@webclerk.io. If your request concerns a conversation you had with a chatbot on a business's website, please contact that business — we will support them in fulfilling your request.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page. The "Last updated" date at the top reflects the most recent revision.

Contact Us

If you have any questions about this Privacy Policy, please contact us at admin@webclerk.io