Widget End-User Privacy Notice
This notice explains how the SmartAlex assistant, the chat and voice widget embedded on a website you are visiting, handles your personal data. It is published by SmartAlex, the company that supplies the assistant to that website. The business whose website you are visiting chooses which features are switched on and publishes its own privacy notice, so read this alongside theirs.
1. Who is responsible for your data
The business that operates the website is the controller. It decides what is collected, why, and on what lawful basis. It is responsible for telling you about it at or before the point of collection and for obtaining any consent the law requires.
SmartAlex is the processor. We operate the assistant on that business's documented instructions under the Widget Data Processing Addendum and the Widget Terms of Service. We do not decide, on our own account, what is collected from you or what it is used for.
If you want to exercise a right or ask a question about your data, the business that operates the website is your first point of contact. You can also write to us at privacy@getsmartalex.com and we will pass your request to that business and assist them in answering it.
2. What the assistant collects
Each business chooses which features to enable, so not every category applies on every website.
- What you provide. Your name, email address, telephone number, and anything else you type or say when the assistant asks.
- Conversation content. The text of a chat, and the audio, transcript and summary of a voice conversation.
- Technical and interaction data. Device and browser type, coarse location inferred from your IP address, the page you are on, and how you interact with the assistant.
- Attribution data. Campaign parameters in the page address and advertising click identifiers, collected only where you have consented and the business has enabled that feature.
- Derived data. Enquiry status, intent signals and conversation outcomes, produced so the business can respond to you.
A fuller, plain-English inventory of each category, why it is collected and what happens to it is published as What the Widget Captures.
3. Why it is collected
To hold the conversation you started and answer you, to pass your enquiry to the business so it can follow up, to produce a transcript and summary of that conversation for the business, to keep the assistant working, secure and free from abuse, and, only where you have consented and the business has enabled it, to measure the advertising that brought you to the site.
4. AI and call recording
The assistant is an automated system. You are told you are interacting with an AI assistant before the conversation begins, and it is never presented to you as a human.
Voice conversations may be recorded and transcribed. A short disclosure is shown before a voice call connects, and the assistant can speak that disclosure as its opening line. In the European Union and the United Kingdom, and in jurisdictions that require the consent of every party, the disclosure states that the call is recorded and the business cannot switch it off. The business that operates the website is responsible for meeting the recording and disclosure rules that apply to it and to you. The full position is set out in the Widget Recording and AI Disclosure.
5. What is stored on your device
The assistant stores a small amount of information on your device so that it works and so that your choices are remembered. Storage that is strictly necessary is set on first interaction, as e-privacy rules permit. Storage used for advertising and attribution is deny-by-default, is set only where a valid consent signal permits it, and is cleared when you withdraw consent. Each item, its purpose, how long it lasts and which consent bucket it falls in is listed in Widget Cookie and Storage. The visitor identifier the assistant sets is first-party to the website you are visiting and is not a cross-site tracking cookie.
6. Who your data is shared with
Your conversation and the details you provide go to the business whose website you are visiting. SmartAlex processes them on that business's behalf using the categories of sub-processor listed in the Widget Sub-processor List, each of which is bound by obligations no less protective than our Data Processing Addendum, including the restriction on model training.
Where you have consented and the business has enabled it, hashed identifiers and event data may be sent to that business's own advertising accounts so it can measure its own campaigns. Identifiers used to match a conversion are hashed on our servers before they leave and are never sent in the clear. We may also disclose data where the law requires it.
7. What we do not do
We do not use your conversations to train or improve any AI model. We do not sell your personal data. We do not build a profile of you across the websites of different businesses that use the assistant, because data is partitioned per business. We do not use device fingerprinting for advertising, and the advertising feature is switched off entirely on any website a business has declared as directed to children or as handling health or wellness information.
8. Your choices and your rights
The assistant carries a "Your data" panel. From it you can see what has been captured about you in the current session, see and change the consent you have given, and ask for a copy of your data or for it to be deleted. Requests are serviced by the business that operates the website, with our tooling and assistance.
Depending on where you live, you may have the right to access your data, correct it, delete it, receive a portable copy, object to or restrict certain processing, opt out of the sale or sharing of your personal data, and complain to your data protection authority. Those rights are exercised against the business that operates the website, as the controller. How we handle a request routed to us is set out in the SmartAlex Data Subject Access Request Procedure.
9. Global Privacy Control and other opt-out signals
The assistant reads recognised opt-out preference signals, including the Global Privacy Control, and honours them where applicable law gives them effect. When such a signal is present, the advertising feature does not fire. A business using the assistant cannot suppress or override that signal.
10. Children and sensitive audiences
The assistant is not directed at children. A business must declare whether its website is directed to children or collects or infers health or wellness information, and where it does, the advertising feature is blocked for that installation. That business remains responsible for obtaining verifiable parental consent where the law requires it, and for any consent required by health data laws. The region-specific position is set out in the Widget Region Addenda.
11. How long data is kept
Conversation content and the details you provide are held for the business that operates the website, for as long as that business instructs us and applicable law allows, and are deleted or returned when its agreement with us ends. Our retention periods, the categories they apply to and our deletion process are set out in the SmartAlex Data Retention and Deletion Policy. The business that operates the website sets its own retention period for the copy it holds.
12. Where your data is processed
SmartAlex is established in Singapore and uses infrastructure and sub-processors in more than one country, so your data may be processed outside the country you are in. Where a restricted transfer takes place it is made under an approved transfer mechanism, including the Standard Contractual Clauses and the UK Addendum, as set out in the Widget Data Processing Addendum and the Widget Region Addenda.
13. Who we are
The assistant is supplied by THERCSGROUP PTE. LTD. (trading as SmartAlex), a private company limited by shares incorporated in the Republic of Singapore.
- Registration number (UEN): 202543608D
- Registered office: 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914
- Privacy and data protection: privacy@getsmartalex.com
Our representatives for the purposes of GDPR Article 27, UK GDPR Article 27 and the Swiss FADP, and our full contact details, are published in the SmartAlex Imprint and Legal Notice. How SmartAlex handles personal data for which it is itself the controller, such as account and billing data, is described in the SmartAlex Privacy Policy.
14. Changes to this notice
We review this notice at least once a year and on any material change to the assistant or to the law. The version and effective date shown with this document reflect the most recent revision.