Privacy Policy

For the accounts of people who sign up to StaceyChat (“users”), we are the controller of their information under the UK GDPR and the Data Protection Act 2018.

For the messages a business's customers send it, and anything else a business puts into StaceyChat about its own customers, the business is the controller and we process that information on its behalf and on its instructions. If you are a customer of a business that uses StaceyChat, please contact that business first about your information; we will help it respond.

• Account details: your name, email address and password (stored only as a secure hash by our authentication provider), or, if you sign in with Google, your name, email address and profile picture from your Google account.
• Business details: your business's name, time zone, team members and their roles, and the settings you choose.
• What you teach Stacey: the knowledge, guidance, custom answers, files and web pages you add, and the history of changes to them.
• Chats: messages sent and received through the WhatsApp numbers and Telegram bots you connect, with the sender's name, number or username and profile details the chat app provides, plus Stacey's drafts, replies and the reasons for them (“Why?”).
• Keys and connections: the AI provider key you add (Google Gemini or Anthropic Claude), Telegram bot tokens, WhatsApp connection details, and connected-system credentials. These are kept in restricted storage that only our servers can read.
• Google Calendar, if you connect it: see section 4.
• Device and technical data: the cookies needed to keep you signed in and remember which business you are working in, your text-size choice on each device, and, if you turn alerts on, the push-notification address your browser gives us. Our hosting providers keep standard server logs (such as IP address, browser type and time of request) for security and troubleshooting.

We do not use advertising or tracking cookies, and we do not run third-party analytics on StaceyChat.

• To provide StaceyChat: to receive messages, have Stacey draft or send replies, show your inbox, send you alerts, and keep a record of what Stacey did and why.
• To keep accounts and the service secure, prevent misuse, and fix problems.
• To contact you about your account, such as confirming your email, resetting your password, invitations and important service notices.
• To meet our legal obligations.

Our legal bases are: performing our contract with you; our legitimate interests in running, securing and improving a reliable service; your consent where we ask for it (for example, alerts and connecting Google Calendar), which you can withdraw at any time; and legal obligation.

We do not sell personal information, we do not use it for advertising, and we do not use your data or your customers' messages to train AI models.

StaceyChat uses Google in two optional ways.

Sign in with Google. If you choose it, Google shares your name, email address and profile picture with us. We use them only to create and sign you in to your account and to show your name to your team.

Google Calendar. An owner or admin of a business can connect a Google Calendar so Stacey can check availability before answering a customer about dates and times. There are two choices:

• Read only (the default) asks for permission to see your calendar list, so you can choose which calendar Stacey checks, and the free/busy times of that calendar. StaceyChat does not see the titles, descriptions, attendees or any other details of your events.
• Read & write also asks for permission to create events. Stacey uses it only to add a “Hold” event on the chosen calendar when she offers a customer a time, and only once that reply has actually been sent. The hold notes that it was added by StaceyChat, from which chat app and which customer. StaceyChat never changes or deletes any other event.

How it is used and shared. Busy times are read when Stacey needs them to answer a customer. To write the reply, the busy times Stacey looked up are given to the AI provider your business has chosen (Google Gemini or Anthropic Claude), using your business's own API key, and may appear in the reply's “Why?” record. Google Calendar data is not used for any other purpose, is not shared with anyone else, is not used for advertising, and is not sold. No person at StaceyChat reads it unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.

Storage and deletion. We keep the Google access token in restricted storage that only our servers can read, encrypted in transit and at rest. We don't keep a copy of your calendar. Disconnecting Google Calendar on StaceyChat's Connected systems page deletes the token and revokes StaceyChat's access with Google straight away. You can also remove access at any time from your Google account at myaccount.google.com/permissions.

StaceyChat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised AI or machine-learning models.

We share information only with the service providers we need to run StaceyChat, under contracts that require them to protect it and use it only for us:

• Supabase (database, file storage and sign-in), with our data held in Frankfurt, Germany.
• Vercel (website and server hosting), running in Frankfurt, Germany.
• The AI provider your business chooses, Google (Gemini) or Anthropic (Claude), which receives the messages, notes and look-ups Stacey needs to write each reply. This uses your business's own API key, so that provider's terms with your business also apply.
• WhatsApp and Telegram, to receive and deliver the messages of the numbers and bots you connect. WhatsApp numbers are connected through our own linked-device connection service; please read our WhatsApp notice.
• Google, if you sign in with Google or connect Google Calendar.
• Push services run by your browser's maker (such as Apple, Google or Mozilla), to deliver alerts to devices where you turned them on.
• Other systems your business connects to StaceyChat, which receive the look-ups Stacey makes there.

We may also disclose information if the law requires it, to protect people's rights and safety, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

Our main data storage is in the European Union. Some providers, such as the AI providers and push services, may process data in other countries, including the United States. Where information leaves the UK or EEA, we rely on adequacy decisions or on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

• Account and business information: for as long as the account is open.
• Chats and Stacey's decisions: until the business deletes them (for example with “Clear chat”), removes the channel, or closes its account.
• Keys and tokens: until you remove or disconnect them.
• When an account is closed, we delete its information within 30 days, except where the law requires us to keep something longer. Backups are overwritten on their normal cycle.

All traffic is encrypted with HTTPS, data is encrypted at rest by our hosting providers, each business's data is kept separate by database access rules, and keys and tokens are kept in storage only our servers can read. No system is perfectly secure, so please use a strong password and tell us straight away if you think your account has been misused.

Depending on where you live, you can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another service. You can withdraw consent at any time, for example by turning alerts off or disconnecting Google Calendar. To make a request or to close your account, write to petergrant01@gmail.com and we will reply within one month.

If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

StaceyChat is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.

We may update this policy. We will change the date at the top, and tell account owners by email or in the app before a significant change takes effect.

Plugged-In Ventures Ltd. Email: petergrant01@gmail.com.