1. Who We Are

This Privacy Policy describes how Aqua Networks Limited ("WebTalk", "we", "us", or "our") collects, uses, and protects your personal information when you use our live chat platform at webtalk.sh.

We are the data controller for the personal data we process. We are registered under UK GDPR and the UK Data Protection Act 2018.

2. Information We Collect

Account information

When you register as a manager or admin, we collect your name, email address, and a hashed password.

Workspace and configuration data

We store the workspace name, API keys, widget configuration (colours, position, greeting), and team member details you provide.

End-user data (via the widget)

When visitors use your embedded WebTalk widget, we may collect: a session token, email address and name (only if you choose to identify users via WebTalk.identify()), conversation messages, timestamps, and the page URL where the widget was opened. We also store custom traits you pass through the identify API.

Usage and technical data

We collect standard server logs including IP addresses, browser user-agent strings, and request timestamps for security and operational purposes. These are retained for 30 days.

Cookies

We use session cookies for authentication and localStorage for widget state. See our Cookie Policy for details.

3. How We Use Your Information

• To provide, maintain, and improve the WebTalk platform
• To authenticate you and keep your account secure
• To deliver support conversations between your team and your customers
• To send transactional emails (e.g. unread message notifications) when enabled
• To send Web Push notifications when you have opted in
• To respond to support requests and legal inquiries
• To comply with our legal obligations under UK law

We do not use your data for advertising. We do not sell or rent your personal data to any third party.

4. Legal Basis for Processing

Under UK GDPR, our legal bases for processing are:

• Contract performance — processing necessary to deliver the service you have signed up for
• Legitimate interests — security monitoring, fraud prevention, and service improvement
• Legal obligation — where required by applicable law
• Consent — for Web Push notifications and optional marketing communications

5. Data Sharing

We share data only with the following categories of third parties, under appropriate data processing agreements:

• Hosting & infrastructure: Replit Inc. (cloud hosting, United States) — covered by Standard Contractual Clauses
• Email delivery: Resend (transactional emails)
• Web Push: Browser vendor push services (FCM / APNs) for notification delivery

We do not transfer data to any other third parties without your explicit consent.

6. Data Retention

We retain account data for as long as your account is active. Conversation messages and end-user profiles are retained indefinitely unless you request deletion. Server logs are purged after 30 days. If you close your account, we delete all associated personal data within 30 days of your request, except where we are required to retain it by law.

7. Your Rights

Under UK GDPR you have the following rights:

• Access — request a copy of the data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request we limit processing of your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, where processing is based on consent

To exercise any right, email us at legal@webtalk.sh. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We implement appropriate technical and organisational measures to protect your data, including: TLS encryption in transit, hashed password storage (bcrypt), session-based authentication, and regular security reviews.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered account holders of material changes by email. The current version is always available at webtalk.sh/privacy.

10. Contact

For privacy-related queries, please contact our data protection contact at: