Privacy
Privacy notice
How Chat Forensics uses personal data, written for the people who upload chats and for the people in them. Last updated 26 September 2026.
1. Who we are
Chat Forensics is built and run by Debut Web Consultants in the United Kingdom. We decide how and why the personal data described here is used, which makes us its controller under UK data protection law.
For anything about your data, email support@chat-forensics.com. support@chat-forensics.com
2. What we process
- Your account
- Your email address, a display name if you give one, and your password, which is stored only as a salted scrypt hash. If you sign in with Google or Microsoft, they tell us your name, email address and an account identifier, and Google also sends the address of your profile picture.
- Two-step sign-in
- If you set up sign-in codes from an authenticator app, we keep the app's secret key (encrypted with AES-256-GCM, saved when you start setting it up), your unused recovery codes (stored only as keyed hashes), and a count of wrong codes, which locks sign-in for a while after too many.
- Your uploads
- The chat export you upload, the voice notes, images and videos you choose to have analysed, the file's name and size, and when you uploaded it.
- The people in the chat
- An export holds the names, phone numbers and messages of everyone in the conversation, and whatever they wrote about other people. Most of them are not our customers. This notice is written for them too.
- Previews and reports
- The free preview and the reports we produce, kept in your account under labels such as Participant A rather than names. Questions you ask about a report are anonymised in the same way before they are sent to the AI provider.
- Payments and credits
- What you ordered, the amount, the currency and Stripe's payment reference, and a history of your card payments, refunds and credits, with a numbered receipt for each card payment, credit purchase and card refund. Your card details go straight to Stripe; we never see or store your card number.
- Referrals
- If you join through a friend's referral link, we record who referred you and whether the referral has been rewarded. To stop the same card claiming a reward twice, Stripe's fingerprint of the card used for your first paid report is kept with the reward.
- Technical data
- Your IP address, which we use to limit repeated sign-in and upload attempts; the country or browser language that comes with your visit, which decides whether you are quoted in pounds or dollars; and the cookies described in section 11. We use your IP address to show prices in your local currency; it isn't stored.
3. Why we use it, and our lawful bases
- To provide what you ask for
- Creating your account, reading and pricing your upload, running the free preview and the report you buy, and keeping it in your account. Lawful basis: performing our contract with you (UK GDPR Article 6(1)(b)).
- To take payment, keep your credit balance and give refunds
- Charging you, keeping your credit balance and payment history, issuing receipts, and refunding a report that fails. Lawful bases: contract, and our legal obligation to keep accounting records (Article 6(1)(c)).
- To keep your account secure
- Two-step sign-in if you turn it on, locking sign-in after repeated wrong codes, limiting repeated attempts, checking what uploaded files really are, and investigating misuse. Lawful basis: our legitimate interest in running a secure service (Article 6(1)(f)), and contract where you have asked for two-step sign-in.
- To run the referral scheme
- Recording who referred whom, paying both sides their credits, and stopping the same person or card claiming twice. Lawful basis: our legitimate interest in rewarding referrals fairly and preventing abuse (Article 6(1)(f)).
- To answer you
- Replying to support and privacy requests. Lawful basis: contract, or our legitimate interest in answering people who write to us.
- For the other people in a chat
- We process their messages only to produce the report our customer asked for. Lawful basis: legitimate interests, namely our customer's interest in understanding a conversation they took part in and ours in providing the service. We weigh that against their interests, which is why names are replaced before the AI reads the chat, uploads are deleted quickly, and the service is only for conversations the customer was part of, with only adults in them.
4. Sensitive information in chats
Chats often reveal health, sex life or sexual orientation, religious or political beliefs, ethnic origin, or information about crimes and allegations. UK law calls most of this special category data and gives criminal offence data extra protection too. We never ask for it, but it will be in an upload if it is in the chat.
We process it only to produce the report you asked for, with the safeguards in this notice: names replaced before analysis, encryption, short retention and access limited to your account. The condition we rely on is that the processing is necessary to establish, exercise or defend legal claims (UK GDPR Article 9(2)(f) and, for criminal offence data, paragraph 33 of Schedule 1 to the Data Protection Act 2018). Please only upload a chat where you have a genuine reason to have it analysed.
5. What the AI providers see
- Before chat text is sent to an AI provider, participant names, phone numbers, email addresses and links are replaced with labels such as Participant A, and other people and places named in the messages become Person 1 and Place 1.
- This is automatic and can miss things. A nickname, an unusual spelling or the details of events can still identify someone, so we treat the anonymised text as personal data too.
- Voice notes, images and videos cannot be anonymised. If you choose to have them analysed, the files themselves are sent to the AI provider. The transcripts and descriptions that come back go through the same anonymiser before they are stored. If you would rather a file never left our server, do not include it.
- The link between each label and the real name is never sent to a provider or written to our logs. For a paid report we keep it encrypted with the report, so that only your account sees the real names when the report is opened. It is deleted with the report.
7. International transfers
Our servers are in Germany, which the UK recognises as protecting personal data adequately. OpenAI, OpenRouter, Google and Stripe may process data in the United States, and so may Google Analytics and Google Ads if you accept them (section 11). For those transfers we rely on the UK's adequacy regulations where the provider is certified under the UK Extension to the EU-US Data Privacy Framework, and otherwise on the International Data Transfer Addendum in the provider's data processing terms. Email us for more detail on a particular provider.
8. How long we keep it
- While your upload is being received it is briefly written to our server; it is then encrypted with AES-256-GCM and the readable copy deleted, normally within seconds. Media is briefly decrypted to a temporary file while it is analysed, then deleted.
- The encrypted upload and the media attached to it are deleted about an hour after your paid report finishes. An upload that nobody buys a report for is deleted after seven days. If a paid report fails and we refund it automatically, the upload is deleted about an hour after the refund, unless you order another report on it before then, in which case the rules above apply to the new order.
- A ZIP is held encrypted while you choose what to analyse. Everything in it you don't choose is deleted, and so is the whole file if you leave it for 30 minutes.
- Previews and reports are stored under labels rather than names and stay in your account until you delete them. Deleting a chat from your dashboard deletes its reports and the encrypted name map with them.
- The file name, which can include a contact's name, is kept with the report until you delete it.
- When you download a report as a PDF, it is created in memory and sent straight to your browser; it is never saved on our server.
- Stripe keeps the payment records. Our copy of an order is deleted when you delete the chat, but your account's payment and credit history, with its receipts, stays with your account.
- Account details, two-step sign-in data and referral records are kept while you have an account. Turning two-step sign-in off deletes its secret key and recovery codes.
- To close your account, email us and we delete your account and its data within one month, except payment records and receipts we must keep for tax and accounting purposes (normally six years).
- The sign-in cookie expires after 30 days.
9. AI training and provider retention
- We do not use your chats, media or reports to train AI models.
- OpenAI: under its business API terms, data sent through its API is not used to train its models. We tell OpenAI not to store our requests or its replies (the API's store setting is off). Like every API customer without a zero-retention agreement, OpenAI may still keep them for up to 30 days to detect abuse, and then deletes them.
- OpenRouter: its privacy policy says it does not use inputs or outputs for model training, and does not keep image, audio or video files beyond routing the request, except as needed for abuse detection, security, billing or legal compliance.
- Google handles the videos it receives under its own API terms.
10. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it if it is wrong;
- delete it;
- restrict how we use it, or object to our using it on the basis of legitimate interests;
- give you the data you provided in a machine-readable form.
You do not need an account to use these rights: if you think a chat that mentions you was uploaded, you can ask too. Because uploads are deleted quickly, we may no longer hold it, and we will tell you what we do hold. Some rights have limits, for example where answering would reveal another person's messages. We respond within one month. Email a privacy request
A report is produced by AI, but it makes no decision about anyone that has a legal or similarly significant effect. You can delete a chat and all of its reports yourself at any time from your dashboard. To close your account, email us and we delete your account and its data within one month, except payment records and receipts we must keep for tax and accounting purposes (normally six years).
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, on 0303 123 1113 or online. Complain to the ICO
12. Age
Chat Forensics is for people aged 18 and over. Before every upload you confirm that you were part of the conversation, you're 18 or over, and everyone taking part is an adult. A chat may still mention children; their information is protected in the same way as everyone else's.
If you are worried about a young person's messages, we have free guidance for parents and carers, with the UK services that can help. Read the teen online safety guidance
13. Changes to this notice
We will update this notice when what we do changes, and change the date at the top. This version was last updated on 26 September 2026.