Privacy and your visitors' data.
What Askbridge collects from visitors, who sees it, how long it is kept, and what to add to your own privacy notice.
When Askbridge runs on your website, you are the controller of your visitors' personal data and Vitalos (which runs Askbridge) is your processor. Our data processing agreement sets out the terms. This article explains what that means in practice. It is not legal advice.
What Askbridge collects from visitors
| Data | When | Sent to the AI model? |
|---|---|---|
| Messages the visitor types | Every message | Yes, after redaction |
| Page address and title, referring page | Conversation start | The page address only |
| Browser type, device type, approximate country | Conversation start | No |
| A one-way hash of the IP address | Conversation start, abuse limits | No |
| Name and email address (and a message out of hours) | Only if the visitor asks for a person or leaves a message, with consent | Never |
| Ratings and "not helpful" votes | When given | No |
Redaction removes email addresses, phone numbers, UK postcodes, National Insurance and NHS numbers, card numbers, IBANs, sort codes and account numbers before any text is sent to the AI model. It cannot catch everything, so the widget asks visitors not to share sensitive details.
Where it is stored, and who sees it
- Stored in the UK (London), in your workspace, visible to your team.
- The AI model (Anthropic Claude) processes the redacted text in the US or other regions to write answers. It does not receive names, email addresses or contact details.
- Other providers that help run the service are listed on the sub-processors page.
Visitor's browser storage
After the visitor sends a first message, the widget stores a conversation reference in their browser so the conversation continues across pages. It sets no advertising or analytics cookies and does not track visitors across sites.
How long it is kept
By default:
- conversations without contact details are deleted 90 days after the last message
- conversations with contact details are deleted 365 days after the last message
Owners can shorten these periods under Settings. See Data retention.
Requests from visitors
If a visitor asks you for a copy of their conversation, or to delete it:
- Find the conversation in the inbox (search by their email if they gave one).
- Export the transcript, or delete the conversation (admins and owners).
Deletion is permanent and removes the messages straight away. Copies in encrypted backups are overwritten in line with our backup cycle. If you need help, email support@vitalos.co.uk.
What to add to your privacy notice
Your privacy notice should mention the chat assistant. We have written a paragraph you can adapt: see the visitor privacy template. In short, it should say:
- that your website has a chat assistant that uses AI, and that a person is available
- what is collected (above), and why (to answer questions, to hand over to your team, and to keep the service secure)
- your lawful basis (often legitimate interests for the chat, and consent for contact details given for a reply)
- that Vitalos provides the service as your processor, and that the AI model processes redacted text outside the UK
- how long you keep conversations
- how visitors can ask for a copy or deletion
Telling visitors it is an AI
The widget always shows an "AI" label on AI answers, and the greeting should say it is an AI assistant. See the AI disclosure for wording, including for visitors in the EU.
Things to avoid
- Do not upload files that contain customers' or staff members' personal data.
- Do not use Askbridge to make decisions about people that have legal or similarly significant effects (for example, approving credit or tenancy applications).
- Do not ask visitors for health, financial or other sensitive information in the chat.
Still stuck? Email support@vitalos.co.uk and tell us your workspace name.