Privacy policy

This policy explains what we do with personal data — whose it is, why we have it, where it goes, and how long we keep it.

It covers two different situations, and the difference matters:

• Our own visitors and customers. When you browse this site or hold an account with us, we decide what to collect and why. In data protection terms we are the controller, and this policy is the whole answer.
• Your customers' data, inside our platform. When a store uses Re: Caffeinate to talk to its customers, the store decides what happens to those conversations. The store is the controller; we only act on its instructions, as its processor. What we may and may not do with that data is set by our Data Processing Agreement, not by this policy.

Who we are

Re: Caffeinate Ltd, a company registered in England and Wales, number 17458812, registered office Office 2016, 60 Tottenham Court Road, London, England, W1T 2EW.

We are registered with the Information Commissioner's Office under reference ZC251077.

For anything in this policy, email us.

What we collect, and why

If you only visit this website

Our servers keep ordinary request logs — the page requested, the time, a browser identifier, an IP address — for security and for keeping the site working. The lawful basis is our legitimate interest in operating a service that is not being attacked. These are necessary and are not something you can turn off while using the site.

Everything else on this page happens only if you agree to it.

We use analytics to understand which pages people read and where they struggle, and advertising tags so we can measure whether our marketing reaches the right people. Both set information on your device and both share data with the companies that provide them. Neither runs until you say yes.

The lawful basis for both is your consent. When you first arrive you are asked, by category, and nothing in those categories loads before you answer. You can change your mind at any time, as easily as you gave it, and withdrawing consent is as straightforward as granting it was.

Exactly which providers sit behind each category, what each one stores, and how long it lasts, is set out in our cookie policy — kept there so it stays current as tools change.

Some static files — the typefaces and the flag images — are served from content delivery networks rather than from our own servers, which is ordinary web infrastructure. A network serving a file sees the request for it, as any server does. They are not analytics, they are not advertising, and we receive nothing from them about you.

If you use the live chat widget on this site

Talking to us through the widget creates a conversation record: what you wrote, what we wrote back, and whatever contact details you gave us. The lawful basis is our legitimate interest in answering people who ask us things, and, once you are a customer, performance of our contract with you.

If you hold an account

Your name, email address, the company you work for, and your login credentials. Payment card details are handled by our payment processor and never reach us.

The lawful basis is performance of our contract with you — we cannot provide an account without those details.

Who else sees it

We use other companies to run the service. They act on our instructions and may only use what they receive to provide their service to us. Each one is bound by a data processing agreement.

The full list, what each one does, and where each processes data, is published at our sub-processor list so it can be kept current without editing this page.

We also use an email hosting provider for our own correspondence.

If you came to us through a partner — a referral link or a code — we tell that partner that a referral converted and whether their commission is accruing. We do not tell them your name, your store, your account status, or why a commission ended. The lawful basis is our legitimate interest in running the partner programme honestly, and the partner's in being paid what they are owed.

We have never sold personal data and never will.

If you consent to advertising tags, the providers behind them do receive information about your visit — that is what they are for, and it is why we ask first rather than assuming. Decline, and nothing is shared with them. The providers are named in our cookie policy.

Where your data goes

Our platform runs in the United States. If you hold an account, or if you are a customer of a store that uses us, the conversation data is processed there. Some other providers process data elsewhere — our outbound email runs in Ireland, and content sent for translation or to Store AI may transit other countries.

The United States does not have a UK adequacy decision, so these transfers rely on the UK International Data Transfer Addendum or, where a provider is certified, the UK Extension to the EU–US Data Privacy Framework. You can ask us which mechanism covers a given provider.

How long we keep it

While your account is open, we keep your data for as long as you are a customer, plus whatever we must retain afterwards for business, tax or legal reasons.

When an account is deleted, its contacts and conversations are deleted with it. This is a real deletion, not a flag — the records are destroyed.

Backups outlive the live data. We take daily and weekly backups, and the longest any backup survives is 30 days. So deleted data is gone from live systems promptly and gone from backups within 30 days.

Request logs are kept for a short period for security purposes and then discarded.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it to another provider, or object to us processing it at all. Where we rely on consent, you can withdraw it at any time.

Email us and we will answer within one month.

If you are the customer of a store that uses our platform, the store controls that data. Ask them, and they will instruct us.

Complaints

If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk, by phone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Things we do not do

We do not make automated decisions that have legal or similarly significant effects on anyone. No part of the platform decides anything about a person without a human doing it.

We do not use conversation content to train artificial intelligence models, and neither do the providers we use for translation or Store AI.

Changes

If we change this policy we will change the effective date at the top. Where a change matters to you, we will tell account holders directly rather than relying on you noticing.

Effective 26 October 2026.