Legal
Nossic Chat data processing terms
Version 1 · 12 October 2026
In short
- When you put Nossic Chat on your website, you are the controller of your visitors' data and Nossic processes it for you.
- We only use it to run your chat, keep it in the UK, keep it secure, help you answer your visitors' requests, and delete it when you ask or when your retention period ends.
- These terms are part of using Nossic Chat. The workspace owner accepts them when creating a workspace.
These terms meet Article 28 of the UK GDPR and the EU GDPR. They apply between Nossic ("we") and the customer who owns a Nossic Chat workspace ("you"), and they apply alongside our privacy notice.
1. The processing
| Subject matter | Providing Nossic Chat: the chat bubble on your website, the inbox, chat flows, AI answers and routing, and related features. |
|---|---|
| Duration | While you use Nossic Chat, then until the data is deleted under section 9. |
| Nature and purpose | Receiving, storing, showing, routing and answering chat messages for you; generating AI suggestions, answers and summaries from your knowledge base on our own servers. |
| People | Visitors to your websites who use the chat; your team members. |
| Personal data | Messages and attachments of text; names, email addresses and answers visitors give; the page they were on; browser (user agent); a random visitor identifier; timestamps; your team's names and emails. |
| Special categories | Not intended. Don't ask visitors for health, religious, political, biometric or similar data through the chat. |
2. Your instructions
We process the data only on your documented instructions: these terms, your workspace settings, and what you and your team do in Nossic Chat. If the law makes us do otherwise, we'll tell you first unless the law forbids it. We'll tell you if we think an instruction breaks data protection law.
We don't use your visitors' data for our own purposes, sell it, or use it to train AI models.
3. Confidentiality
Everyone at Nossic who can access the data is bound to keep it confidential and accesses it only when needed to run, support or secure the service.
4. Security
We protect the data with appropriate technical and organisational measures (Article 32), including: encryption in transit (HTTPS and secure WebSockets); servers in a private network reachable from the internet only through our gateway; access limited to authorised staff with strong authentication; each workspace's data separated by access controls; visitor identifiers stored only as hashes; encrypted backups; and keeping software up to date.
5. Sub-processors
You authorise us to use these sub-processors:
| Sub-processor | What for | Where |
|---|---|---|
| DigitalOcean | The gateway server that carries encrypted traffic between the internet and our servers | London, UK |
Chat data, AI processing and storage all happen on Nossic's own servers in the UK. We'll give at least 30 days' notice on this page and by email to workspace owners before adding or replacing a sub-processor, so you can object. We hold each sub-processor to data protection terms as strict as these.
6. Where the data goes
We store and process the data in the UK. We won't transfer it outside the UK or the European Economic Area unless the law allows it and the required safeguards are in place.
7. Helping you
- Visitors' rights: you can find, export and delete a visitor's conversations in your Nossic Chat inbox. We'll help with anything you can't do yourself, and pass on to you any request a visitor sends us.
- Breaches: we'll tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own duties.
- Assessments: we'll give reasonable help with data protection impact assessments and consultations with regulators about Nossic Chat.
8. Information and audits
We'll give you the information you reasonably need to show these terms are being met, and allow and contribute to audits by you or an auditor you choose, with reasonable notice, confidentiality and no more than once a year unless a regulator requires it or there's been a breach.
9. Retention and deletion
- Conversations are deleted automatically after the retention period you set for your workspace (12 months after the last message unless you change it).
- You can delete a visitor and their conversations at any time.
- When you delete your workspace, or your account, we delete its data straight away, apart from encrypted backups, which are overwritten within 5 weeks.
10. Your part
- You need a lawful basis for the chat, and must tell your visitors about it in your own privacy notice. You can use the wording below.
- Only put the chat on websites you control, and set them in your workspace's allowed websites.
- The chat bubble only stores its identifier in the visitor's browser once they open the chat or write, which is strictly necessary for the service they asked for. Mention it in your cookie information.
Suggested wording for your privacy notice
"Our website's live chat is provided by Nossic Chat (Nossic, nossic.uk), which processes chat messages for us on servers in the UK. When you use the chat, we keep your messages, any name, email or answers you give us, the page you were on and your browser type, to answer your questions. The chat stores a random identifier in your browser, only once you open it, so your conversation can continue on other pages. We keep chat conversations for [12 months] after the last message."
11. Other terms
These terms last as long as we process data for you. If they conflict with any other terms between us about personal data, these terms win. We may update them to reflect changes in the law or our service; we'll give workspace owners at least 30 days' notice of changes that materially affect them. Questions: privacy@nossic.uk.