This policy explains how Chambre.io ("Chambre", "we", "us") collects and uses personal data. We are based in the United Kingdom and comply with the UK GDPR, the EU GDPR and the Data Protection Act 2018. If you have questions or want to exercise your rights, contact support@chambre.io.
1. Who this policy covers
- Customers and their teams: people who sign up for, or use, the Chambre console. Chambre is the controller of this data.
- Visitors to chambre.io: including people who talk to our own agent. Chambre is the controller.
- Visitors to our customers' websites: when our customers use Chambre on their own sites, they are the controller and we act as their processor under our Data Processing Addendum. Please read the privacy notice of the website you were visiting, and contact that business to exercise your rights.
2. What we collect
- Account details: name, work email, company, role, password (stored as a secure hash by our authentication provider), two-step sign-in settings and team membership.
- Billing details: plan, billing address and payment status. Card details are collected and stored by Stripe; we never see or store full card numbers.
- Configuration: your agent's settings, knowledge sources and the websites you connect.
- Conversations and leads: chat messages and, for voice chats, the audio stream and its transcript; form answers, meeting bookings and details a visitor chooses to share (such as name, email, phone or company). These are shown to the customer's team as leads.
- Usage and device data: pages viewed, features used, voice minutes, browser type, and a hashed (not stored in full) IP address used for security and abuse prevention.
- Connected accounts: if you connect a calendar or CRM, we store an encrypted access token and the information needed to create bookings or leads.
- Webhook settings and delivery records: if a customer sets up a lead webhook, we store the address they give us, an encrypted signing secret, and a record of each delivery (time, result and the lead that was sent).
- Content customers add: documents, Q&As and public web pages a customer asks us to read for their agent's knowledge, and information about the companies they create ABM rooms for.
3. How and why we use it
| Purpose | Lawful basis |
|---|---|
| Providing the Service, your account and support | Contract |
| Running free trials, billing and fraud prevention | Contract; legitimate interests |
| Security, abuse limits and service monitoring | Legitimate interests |
| Improving the Service using aggregated, de-identified usage data | Legitimate interests |
| Product and marketing emails to business contacts (you can opt out any time) | Legitimate interests or consent where required |
| Meeting legal, tax and accounting obligations | Legal obligation |
We do not sell personal data. We do not use customer conversations to train AI models offered to other customers. We do not make decisions with legal or similarly significant effects about anyone solely by automated means.
4. Voice and AI
Voice conversations are streamed in real time to speech recognition, language model and voice synthesis providers so the agent can understand and respond. Typed chats are sent to a language model in the same way. Visitors are told they are talking to an AI system. Audio is not kept after the conversation unless the customer turns on recording; transcripts are kept for the customer's retention period.
In the console, AI writing help (for example drafting an ABM room or rewriting a section) sends the customer's instructions, their offering and publicly known information about the target company to a language model. We access these models through LiveKit, which routes requests to model providers such as OpenAI and Google. These providers process the text only to return a response and, under their API terms, do not use it to train their models.
5. Google user data (Google Calendar)
Customers can choose to connect a Google account so their AI agent can offer real meeting times and book meetings. When they connect, we ask Google for permission to:
- See the email address of the connected Google account (scopes
openidandemail), so the customer can see which calendar is connected. - See free and busy times on their primary calendar (
calendar.freebusy), so the agent only offers times when the customer's team is available. We read only whether a time is free or busy, not the details of existing events. - Create calendar events (
calendar.events), so that when a website visitor books a meeting the event, with a Google Meet link and the visitor as a guest, is added to the customer's calendar.
How we use it. We use this data only to show available times and create the bookings the customer has asked for. We store the Google refresh token encrypted (AES-256) in our database and the connected account's email address; we do not store the contents of the customer's calendar. Free and busy times are read when a visitor asks to book and are not kept.
What we never do. We do not sell Google user data, use it for advertising, use it to train or improve AI or machine-learning models, or let people read it, except with the customer's consent, for security, to comply with the law, or where it is aggregated and anonymised for internal operations. We do not transfer it to anyone except as needed to provide this feature or as required by law.
Limited Use. Chambre's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Removing access. A customer can disconnect Google at any time in the console (Integrations), which deletes the stored token, or remove Chambre's access in their Google Account under Security › Third-party apps with account access. When an account is closed we delete its Google tokens.
6. Who we share it with
We use carefully chosen sub-processors under written contracts, including: Supabase (database and authentication), Netlify (hosting), LiveKit (real-time voice, speech recognition, language model and voice synthesis), LemonSlice (avatar video), Stripe (payments and invoicing), and Google (calendar bookings, if you connect it). We will tell customers before adding a sub-processor that processes their visitors' data. We may also share data with professional advisers, or where the law requires it.
Where customers send leads. A customer can choose to send each new lead automatically to a system of their own choosing, such as their CRM (for example Salesforce, HubSpot or Marketo), a scheduling tool, or an automation service (for example Zapier, Make or n8n), using a webhook or a connected integration. The lead can include the visitor's contact details, the page they were on, campaign tags, their answers and, if the customer switches it on, the conversation transcript. We send it only to the address the customer sets, signed so they can check it came from us. Once delivered, that data is held under the customer's control and their own privacy notice, and the services they use are their processors, not ours.
7. International transfers
Some providers process data outside the UK and EEA, for example in the United States. Where they do, we rely on adequacy regulations or the UK International Data Transfer Addendum and EU Standard Contractual Clauses, with supplementary measures where needed. EU data residency is available on Fleet (Enterprise) plans.
8. How long we keep it
- Account and configuration data: while your account is active, then deleted within 30 days of closure.
- Conversation transcripts: for the retention period the customer sets (default 12 months).
- Webhook delivery records: up to 90 days.
- Billing records: 6 years, as tax law requires.
- Security logs: up to 12 months.
9. Security
We protect data with encryption in transit and at rest, per-customer isolation enforced in the database, encrypted storage of connected-account tokens, domain locking, rate limiting, role-based access and audit logs.
10. Your rights
You can ask to access, correct, delete, restrict or port your personal data, and object to processing based on legitimate interests or to direct marketing. Email support@chambre.io. We reply within one month. If we process your data on behalf of a customer, we will pass your request to them. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
11. Cookies and local storage
Our website and widget use strictly necessary storage to keep you signed in (you are signed out automatically after 30 minutes without activity), remember your settings, keep a chat together as one conversation during a visit, and remember a conversation for up to 30 days on that device. We use analytics cookies only with your consent. You can clear a conversation at any time with "Clear conversation".
12. Children
The Service is for businesses and is not directed at children under 16.
13. Changes
We will post updates here and tell customers by email about material changes.