Privacy notice
ChatBundle is run by Nicholas Johnson, trading as ChatBundle (“we”), the controller of the data described here. Address: Campion Drive, Oldham. Contact: help@chatbundle.co.uk.
We never store your chat
- Your chat export is read on your device. The free check uses no AI and sends nothing.
- To survive the payment step, your chat, your picks and your bundle details stay in this browser on your device. ChatBundle stops using them 24 hours after you pick your messages (or after your last change, if you haven’t picked yet). They are deleted the next time you open Make my bundle in this browser, or straight away if the page is still open when that time comes after you have picked. If you never open Make my bundle in this browser again, they stay until you delete them with Clear my chat from this device or clear this browser’s site data.
- After you pay, we send our server only the messages in the dates you choose, your description of the issue and the roles you gave. It passes them to Anthropic’s Claude API, builds the PDF in memory and returns it to you. Nothing of your chat is kept in our database, files, logs or caches.
- Anthropic doesn’t train on this content. By default it deletes API inputs and outputs within 30 days, or keeps them for up to 2 years if its safety systems flag them.
What we keep
Email address (monthly plan, through Supabase sign-in)
- Why:
- To sign you in and run your account
- Lawful basis:
- Contract
- How long:
- While you have an account. Deleting your account removes it straight away.
Payment records (held by Stripe; we never see card numbers)
- Why:
- Payments, refunds and accounts
- Lawful basis:
- Contract; legal obligation
- How long:
- 6 years after the end of the financial year they relate to (HMRC)
One usage line per bundle: date, bundle type, page count, message count, selected count and status
- Why:
- Running the service, fair use and refunds
- Lawful basis:
- Legitimate interests
- How long:
- 6 years, with the payment records
A one-way fingerprint (SHA-256) of your chat file
- Why:
- Ties one payment to one chat
- Lawful basis:
- Legitimate interests
- How long:
- Our database: cleared daily once 48 hours old (at most about 3 days). Stripe payment record: kept with the payment.
Business name and logo (monthly plan, if added)
- Why:
- Printed on your bundle covers
- Lawful basis:
- Contract
- How long:
- Until you remove them or delete your account
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Email address (monthly plan, through Supabase sign-in) | To sign you in and run your account | Contract | While you have an account. Deleting your account removes it straight away. |
| Payment records (held by Stripe; we never see card numbers) | Payments, refunds and accounts | Contract; legal obligation | 6 years after the end of the financial year they relate to (HMRC) |
| One usage line per bundle: date, bundle type, page count, message count, selected count and status | Running the service, fair use and refunds | Legitimate interests | 6 years, with the payment records |
| A one-way fingerprint (SHA-256) of your chat file | Ties one payment to one chat | Legitimate interests | Our database: cleared daily once 48 hours old (at most about 3 days). Stripe payment record: kept with the payment. |
| Business name and logo (monthly plan, if added) | Printed on your bundle covers | Contract | Until you remove them or delete your account |
The fingerprint can’t be turned back into your chat. We don’t keep message text, names from your chat, your issue description, the file name, the PDF or the picks. Our logs hold only numbers and codes.
Deleting your account
You can delete your account on the Account page. On the monthly plan, cancel it in Manage billing first: you can delete your account once the plan has ended.
- Removed straight away: your sign-in (email address), your business name and logo, and our record of your subscription.
- Kept, with nothing linking it to you: the usage line for each bundle (dates, bundle type and counts) and the numbers for each AI call.
- One-off bundles: these are bought without signing in, so they aren’t linked to your account. Our record of them (amount, date, status and the email given at checkout) is kept with the payment records.
- Kept by Stripe: its own payment records, including the email on your receipts. To ask for those to be removed, email us and we’ll pass your request to Stripe, or contact Stripe through stripe.com/privacy. Stripe has to keep some payment records by law.
- Not touched: the chat saved in your browser. Use Clear my chat from this device for that.
Other people in your chat
We process their messages only to make the bundle you asked for, while the request runs, on the basis of legitimate interests. For sensitive information we rely on Article 9(2)(f) UK GDPR (legal claims). Before paying, you confirm you’re in the chat or acting for someone who is, with their permission.
Bundles made for clients
On the monthly plan, if you make bundles from clients’ chats, you’re the controller and we’re your processor under the data-processing terms in our terms of service.
Who processes data for us
- Supabase: Database and sign-in. London (UK) region.
- Vercel: Hosting, bot protection and anonymous visit statistics. London (UK) region; Vercel is a US company.
- Stripe: Payments and receipts. Stripe Payments UK, with some processing in the United States.
- Resend: Sending our emails, including sign-in codes. Sent from its Ireland region; Resend stores data in the United States.
- Anthropic: AI that picks messages and writes the neutral summary. United States.
- ImprovMX: Forwarding emails sent to help@chatbundle.co.uk. European Union and United States.
- Google (Gmail): The inbox where we read and answer emails sent to help@chatbundle.co.uk. United States and other countries.
Vercel BotID runs on this site. When you sign in or go to pay for a one-off bundle, a small script from Vercel checks that the request comes from a person, not a bot. To do this it sends details about your browser and the request (such as your IP address) to Vercel, and may set cookies. It is used only for security.
Vercel Web Analytics also runs on this site. It counts page views: the page (with any campaign tag in the link, such as utm_source), the site that linked to it, your rough location (country, region and city), and your device type, operating system and browser. It sets no cookies and keeps only anonymous data: it tells visits apart with a code made from the request, which it resets every day. It is used only to see how people find and use the site.
Transfers to Anthropic in the United States are covered by the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, in Anthropic’s data processing addendum. Vercel’s and Stripe’s data processing agreements use the same clauses. Resend is certified under the EU–US Data Privacy Framework and its UK Extension. ImprovMX handles most email in the European Union, and Google stores email in the United States and other countries under the safeguards in its own terms.
Your rights
You can ask to see, correct, delete, restrict or move your data, or object to how we use it, by emailing help@chatbundle.co.uk. You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.