Chatbot Terms

Chatbot terms.

How our website chatbot, CLU, handles your personal data — what it collects, why, who's involved behind the scenes, and the rights you have.

Who we are

This chatbot is run by Webjects Limited, a company registered in England and Wales (company number 10521644). We're the "data controller" for the personal data described here, which means we decide what's collected and how it's used. We're registered with the Information Commissioner's Office under registration number ZA936978.

This page covers our website chatbot only. How this website handles your personal data more generally — the contact form, cookies, analytics and the rest — is set out in our main Privacy Notice. If you have any questions about this page or your data, email us at info@webjects.co.uk.

What this page covers

Our website has a chatbot called CLU. It answers questions about Webjects and our services using information drawn from the pages of this website, and — if you choose — it can take your details so we can follow up with a callback or a quote.

The chatbot is built on different technology from the rest of our site, and it involves different companies handling your data, so we've given it its own page rather than folding it into our main notice. This page explains what the chatbot collects, why, who's involved behind the scenes, and the rights you have. Everything else about this website is covered by our main Privacy Notice.

Using the chatbot is entirely optional. You can browse the whole site, and contact us by our normal contact form or by email, without ever opening it.

What CLU collects

The messages you send it. When you chat with CLU, the questions and messages you type are processed so it can understand you and reply. Please treat it like a public enquiry form: don't type in sensitive information (such as health, financial or other special-category details), and don't share other people's personal details, as the chatbot isn't the right place for that.

Any details you choose to share. If you decide you'd like us to get in touch, CLU may ask for your name, your email address, and a short description of your enquiry. You only give these if you want us to follow up — you can ask questions without handing over any contact details at all. When you do share them, they're saved so our team can respond.

Technical data the service needs to run. To deliver the chatbot, the companies that power it (below) may see limited technical information — for example your internet (IP) address and basic details about your browser or device. This is standard for any online service and is used to run the chat, keep it secure, and prevent abuse.

Why we use it, and our lawful basis

Answering your questions. We use the chatbot, and the messages you send it, to answer questions about Webjects and help you find what you need. Our lawful basis is our legitimate interests (UK GDPR Article 6(1)(f)) — providing a helpful self-service tool that you've chosen to use.

Following up on your enquiry. Where you choose to share your details, we use them to reply and to take any steps you've asked us to take, such as arranging a callback or preparing a quote. Our lawful basis is again our legitimate interests (Article 6(1)(f)) — dealing with an enquiry you have chosen to send us.

Keeping the service secure. We, and the providers below, use limited technical data to run the chatbot reliably and to protect it from spam and automated abuse. Our lawful basis is our legitimate interests (Article 6(1)(f)) — keeping the service working, secure and usable.

The providers behind CLU

We keep the number of companies involved deliberately small. Two providers make the chatbot work, and both handle your data only to run the service for us — never for their own purposes.

  • Zapier, Inc. — the platform that hosts and runs the chatbot. Zapier delivers the chat widget on our site, manages the conversation, and — when you choose to share your details — stores those details in a secure table on our behalf so our team can follow up. Zapier is a US-based company and processes personal data in the United States. It acts as our data processor under a written data-processing agreement, and its transfers are covered by the safeguards described in "Where your data is processed" below. Zapier's current list of the sub-processors it uses is published on its own website.
  • OpenAI (OpenAI, L.L.C.) — the company behind GPT-4.1 mini, the AI model that generates CLU's replies. We use Zapier's built-in AI feature for this, which means OpenAI is engaged by Zapier as its sub-processor — not a separate company we contract with directly. We don't hold or use an OpenAI account of our own for the chatbot. The text of your messages is passed to OpenAI's model through Zapier so it can produce a helpful answer, which is then shown to you in the chat. OpenAI is a US-based company, and this processing takes place in the United States. Zapier's terms for its built-in AI are protective: your messages are not used to train or improve OpenAI's models, and Zapier applies OpenAI's Zero Data Retention setting, so OpenAI processes your message only to generate the reply and does not keep it afterwards.

We don't sell your personal data, and we don't use the chatbot to profile you or to target advertising.

Cookies and the chat widget

To make the chat work — for example to keep your conversation going while you move around the site — the chatbot may set a small number of strictly necessary cookies or use similar local storage in your browser. These are limited to what's needed to run a feature you've chosen to use, and under the Privacy and Electronic Communications Regulations (PECR) that kind of strictly necessary storage doesn't require separate consent. The chatbot doesn't set advertising or tracking cookies. Our site's wider cookie use, including analytics, is explained in our main Privacy Notice.

Where your data is processed

Both of the providers behind the chatbot are based in the United States, so some of your data — the messages you send, and any details you share — is processed outside the UK.

  • Zapier processes and stores data in the United States. Transfers out of the UK are covered by appropriate safeguards recognised under UK data protection law — specifically the UK Addendum to the EU Standard Contractual Clauses. Zapier, Inc. is also an active participant under the EU-US Data Privacy Framework and its UK Extension (certified since 15 September 2023, per the US Department of Commerce's official participant register).
  • OpenAI, the AI model provider engaged by Zapier, processes your messages in the United States. Because OpenAI acts here as Zapier's sub-processor rather than a provider we contract with directly, this transfer is covered by Zapier's own onward-transfer safeguards — the same UK Addendum to the EU Standard Contractual Clauses described above.

Wherever a transfer outside the UK happens, we rely on the protections that UK data protection law requires for it.

How long we keep it

Chat conversations. We keep the record of a chatbot conversation only as long as we need it to handle your enquiry and keep the service running properly. If a conversation doesn't lead to you becoming a client, we delete our copy of it, and any details you shared, within 12 months of our last contact with you.

Enquiry details. If you share your name, email and enquiry so we can follow up, we treat those the same way as any other enquiry: we keep them for up to 12 months after our last contact, and then delete them — unless you go on to work with us.

If you become a client. If your enquiry leads to us working together, we keep your records for the duration of our working relationship and then for six years afterwards, to align with our financial and tax record-keeping obligations.

On the providers' side. Zapier holds the data on our behalf for as long as we keep it, and deletes it when we do. OpenAI does not keep the content of your messages: because Zapier applies OpenAI's Zero Data Retention setting to its built-in AI, your message is processed only to generate the reply and is not retained by OpenAI afterwards.

Your rights

Under UK data protection law, you have the right to:

  • ask for a copy of the personal data we hold about you (a subject access request);
  • ask us to correct data that's wrong or incomplete;
  • ask us to delete your data, or to restrict how we use it, in certain circumstances;
  • object to us using your data where our basis is legitimate interests;
  • ask us to transfer your data to you or another provider, where that right applies; and
  • withdraw any consent you've given, without affecting anything done before you withdrew it.

To exercise any of these, email us at info@webjects.co.uk. We'll respond within one month, as the law requires, and there's normally no charge.

Complaints

If you're unhappy with how we've handled your data, please tell us first at info@webjects.co.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. Our ICO registration number is ZA936978.

Changes to this page

We review this page regularly and update it when the way the chatbot handles data changes. If we make a significant change, we'll update the date below.

Last reviewed: July 2026.