Last Updated: June 23, 2026
Welcome to HumanWidget.com! This Privacy Policy explains how Human Widget (“HumanWidget,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you use our services: the embeddable Chat Widget and Community Rooms (collectively, the “Service”).
By using the Service, you agree to the collection and use of information in accordance with this policy.
Our Role and Your Role Under GDPR
For the purposes of data protection laws like the GDPR and Canada’s PIPEDA:
You, the User (website owner), are the Data Controller for any personal data collected from visitors on your website via our services. You determine the purposes and means of processing this data.
Human Widget acts as the Data Processor on your behalf. We process this data solely based on your instructions and for the purpose of providing the Service.
1. Information We Collect
Information You Provide to Us (Our Users – Website Owners)
Account Information: When you register for a Human Widget account, we collect your email address, company name, website URL, and password. This is used to create and manage your account, provide support, and communicate with you about the Service.
Configuration Data: Information you provide to customize the chat widget or community rooms, such as display names, agent profiles, room rules, or your Google Tag Manager ID.
Information Processed on Your Behalf – Chat Widget (End-Users of Your Website)
Chat Content: When visitors use the chat widget, the content of their conversations is transmitted through our Service. We process this data on your behalf.
Contact Information (Offline Form): If an End-User uses the offline contact form, we collect the information they submit (e.g., name, email, phone number, message) on your behalf.
Visitor Identifier: To maintain conversation continuity, we assign a unique, anonymous identifier to each End-User, stored in their browser’s localStorage. This identifier contains no personal data.
IP Address for Security: We collect End-Users’ IP addresses solely to enable you to ban non-compliant users from your widget. This IP address is not used for any other purpose.
Information Processed on Your Behalf – Community Rooms (Participants)
Name and Email Address: Collected when a participant joins a room, used to identify them within the room and enable moderation.
Messages: The content of messages sent within the room.
Activity Timestamps: The time of messages and participation.
Moderator Device Token: For verified moderators, a token is stored in the participant’s browser localStorage for up to 30 days to avoid repeated verification on the same device. This token is strictly functional and contains no personal data.
Display Name: Saved in the participant’s browser localStorage to pre-fill the join form on return visits. Participants can clear this at any time using the “Not you?” link on the join form.
Analytics & Tracking Data (With Consent – Enterprise Plan Only)
If you are on an Enterprise Plan and have enabled the Google Tag Manager (GTM) integration in your dashboard, and an End-User provides consent via the privacy banner, our widget will send event data to your GTM container. This feature is exclusively available to Enterprise Plan customers. We do not collect or transmit this data without End-User consent.
2. How We Use Information
- To Provide and Maintain Our Service: To allow you to set up and manage your chat widget and community rooms, and to facilitate real-time communication.
- To Manage Your Account: To communicate with you about your account, subscription, updates, and support.
- To Improve Our Service: To understand how our services are used in order to improve functionality.
- For Security: We process IP addresses (chat widget) and reCAPTCHA tokens (sign-up, login, forgot password, reset password, and community room join forms) to protect against abuse and spam.
- For Analytics (Enterprise Plan Only): Via the GTM integration, active only with End-User consent.
- For Billing and Compliance: Payment processing is handled by Paddle. We use your account information to manage your subscription and comply with legal obligations.
We do not sell your personal information or the personal information of your End-Users to third parties.
3. Data Retention and Deletion
Chat Widget — Active Subscriptions
Standard Plan: Chat messages are deleted after 90 days. Contact information is deleted after 90 days of inactivity.
Pro Plan: Chat messages and contact information are deleted after 1 year of inactivity.
Enterprise Plan: Data is retained for the full duration of your active subscription with no automatic purge.
Chat Widget — Canceled, Lapsed, or Inactive Accounts
All associated chat messages and contact data across all plans — including Enterprise — are permanently deleted within 90 days of your subscription period ending (i.e., after your paid period has fully lapsed following cancellation).
Community Rooms
Messages and participant data (name and email) are retained for as long as the room remains active. When a room is closed or archived, all associated messages and participant data are automatically and permanently deleted within 30 days. This deletion runs as an automated daily process on our servers.
Browser localStorage entries (display name and moderator device token) remain on the participant’s own device and are not controlled by us. Participants can clear them at any time through their browser settings or the “Not you?” link on the join form.
4. Your Data Protection Rights & How to Exercise Them
Consent Management: We provide tools to display a GDPR-compliant consent banner on the chat widget. It is your responsibility as the Data Controller to enable this feature where required by law.
Community Rooms — Participant Rights: As the Data Controller, you are responsible for facilitating participants’ requests to access, correct, or delete their data. You can manage room data from your dashboard. For requests you cannot fulfill yourself, contact us at privacy@HumanWidget.com.
Right to Access, Rectify, or Erase Data:
- For your Human Widget account: Contact us at support@HumanWidget.com
- For your End-Users and room participants: As the Data Controller, you must facilitate these requests.
- Users can also contact us directly at privacy@HumanWidget.com to earase their data.
5. Data Security
We implement reasonable administrative, technical, and physical security measures to protect your data, including encrypted connections (HTTPS) and token-based authentication. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
6. Sharing and Disclosure of Information
We do not share personal data with third parties except in the following circumstances:
Service Providers: Third-party companies used for hosting and infrastructure, contractually obligated to protect your data.
Payment Processing (Paddle): All payment processing is handled by Paddle.com. We do not receive or store credit card information. Paddle’s privacy policy applies to payment data.
Google reCAPTCHA: reCAPTCHA is used on our sign-up, login, forgot password, reset password, and community room join forms to prevent abuse. Data is processed by Google at the moment of form submission only — reCAPTCHA is never loaded on page load. Google’s Privacy Policy and Terms of Service apply.
Analytics Services (Google — Enterprise Plan Only): For Enterprise customers who enable the GTM integration on the chat widget, data is shared with Google only after End-User consent is obtained via the privacy banner.
Legal Requirements: We may disclose information if required by law or to protect our rights.
Business Transfers: In the event of a merger or acquisition, we will provide notice before your data is transferred.
7. Children’s Privacy
Our Service is designed for use by organizations, including those who may support young people under the age of 16. We do not directly offer services to children. We act as a data processor for these organizations, and any collection of children’s information through our Service is controlled by our customers, who are responsible for obtaining necessary parental or guardian consent.
If you believe we have inadvertently received personal information from a child without proper authorization, please contact us and we will delete it promptly.
8. Data Storage Location
All data is stored on servers located in Canada.
9. International Data Transfers
Your information may be transferred to and maintained on computers located outside of your jurisdiction when using third-party services referenced in this policy (such as Google reCAPTCHA or Paddle). Your consent to this Privacy Policy represents your agreement to that transfer.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of changes by posting the new policy on this page and updating the “Last Updated” date. For material changes, we will make reasonable efforts to notify you directly.
11. Contact Us
If you have any questions about this Privacy Policy, please contact us:
By email: privacy@HumanWidget.com