Privacy Policy

Effective date: 26 October 2026

This policy explains how SupportLime ("we", "us") handles personal data. It covers two groups of people: customers who create an account and embed our chat widget on their website, and visitors who use that widget on a customer's website. For visitor data, our customer is the data controller and we act as their processor; this policy describes what we do on their behalf.

1. Data we collect from customers

  • Account data: email address, name, profile picture (when you sign in with Google or Apple), preferred language, IP address at signup, and first-touch marketing attribution (referrer and UTM parameters).
  • Billing data: handled by Stripe. We store your Stripe customer and subscription identifiers, plan and invoice status; we never store card numbers.
  • Content you give us: website URLs we crawl, pages, pasted text, Q&A pairs and files you upload so the assistant can answer from them; widget settings; team members you invite.
  • Usage data: pages of the dashboard you use, API and MCP requests, and technical logs (IP address, browser, timestamps) kept for security and debugging.

2. Data we process about website visitors

  • Conversations: the messages a visitor types into the widget, the assistant's and the team's replies, and feedback (thumbs up or down).
  • Contact details: an email address and name if the visitor chooses to leave them, or if the customer identifies the visitor through our JavaScript API.
  • Context: the page URL, referrer, browser language, user agent and IP address, and a random visitor identifier stored in the widget's browser storage so a returning visitor sees their previous conversation.

The widget sets no third-party cookies and does no advertising tracking.

3. How we use data

  • To provide the service: crawl and index your content, generate answers, deliver conversations to your inbox, send notifications, bill your subscription.
  • To keep the service safe: rate limiting, abuse detection, bot protection (Cloudflare Turnstile on signup), fraud prevention with Stripe.
  • To improve the product: aggregated, non-identifying usage statistics. We do not use customer content or visitor conversations to train AI models, and our AI providers are used under terms that prohibit training on this data.
  • To communicate: transactional emails (login codes, notifications, billing). We do not send marketing email without consent.

4. Sub-processors

We use these providers to run SupportLime. Each is bound by data-processing terms.

  • OpenAI (USA): generating answers and text embeddings from your content and visitor messages. API data is not used for training.
  • Cloudflare (global): hosting of the website and widget, vector search index, file storage, DDoS protection and bot checks.
  • Amazon Web Services (USA/EU): transactional email delivery (SES).
  • Stripe (USA/EU): payments, invoices, billing portal.
  • Google and Apple: optional sign-in.
  • Microsoft Clarity and Google Analytics on supportlime.com only (never inside the widget): anonymised usage analytics.

Application data is stored on servers operated by us in the European Union, with backups encrypted at rest.

5. Retention

  • Conversations and contacts: for as long as the customer's account is active, subject to the history limit of their plan (30 days on Free, one year on Starter, unlimited on Growth and Scale). Customers can delete contacts and conversations at any time.
  • Indexed content: until the customer removes the source or deletes the website.
  • Account data: until the account is deleted; some billing records are kept for the period required by tax law.
  • Technical logs: up to 90 days.

6. Your rights

Depending on where you live (including under the GDPR and UK GDPR) you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Customers can delete their account from the settings page; this anonymises the account record. Visitors should contact the website they chatted with, which can delete their contact and conversations; you can also write to us and we will pass the request on or act on it where we are the controller.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the people who operate the service. Widget requests are tied to a signed visitor token and the customer's allowed domains; dashboard access uses one-time email codes or Google/Apple sign-in. Report security issues to security@supportlime.com.

8. Children

SupportLime is a business tool and is not directed at children under 16. We do not knowingly collect data from children.

9. Changes

We will post changes here and update the effective date. Material changes affecting customers will be announced by email.

10. Contact

SupportLime is operated by PM Digital. Email: hello@supportlime.com. Data-processing agreement for customers available on request.

Feedback? Need help?