Last updated: 21 June 2026
This Privacy Policy explains how Butterfield AI ("we", "us", "our") collects, uses, and protects personal data when you use our website (butterfieldai.com), our virtual assistant widget service ("the Service"), and related communications. We are committed to handling personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For the purposes of UK data protection law, Butterfield AI is the data controller in respect of the personal data described in Section 2 (Business Customers) below, and a data processor in respect of personal data submitted by your website visitors via the Widget, as described in Section 3.
Butterfield AI is a sole trader business based in the United Kingdom, providing an AI-powered virtual assistant widget for small business websites.
When you sign up for Butterfield AI as a business customer, we collect:
| Data | Purpose |
|---|---|
| Name and contact details | Account administration, communication, support |
| Business information (services, pricing, hours, location) | To configure and train your virtual assistant |
| Payment information | Processed securely by Stripe, our payment processor — we do not store full card details |
| Usage data (conversations, leads, email logs) | To provide the Service and generate your account dashboard and summaries |
We use this information to provide the Service, process payments, send transactional emails (such as lead alerts and weekly summaries), and respond to support enquiries.
When a visitor to your website interacts with your Butterfield AI widget, they may voluntarily provide personal information such as their name, phone number, and email address during the course of conversation. This information is:
In this context, you (the business customer) are the data controller for your own customers' information, and Butterfield AI acts as a data processor, processing this data solely on your instructions and for the purpose of providing the Service. If you are a business customer, you are responsible for ensuring your own privacy notice to your website visitors reflects the use of an AI virtual assistant and the data it may collect.
We use personal data for the following purposes:
Where UK GDPR applies, we rely on the following legal bases:
We share data with the following categories of third-party service providers, solely to the extent necessary to operate the Service:
| Provider | Purpose |
|---|---|
| Anthropic (Claude AI) | Powers the AI responses generated by your virtual assistant |
| Stripe | Payment processing and subscription management |
| Resend | Transactional email delivery (lead alerts, summaries, account emails) |
| Railway | Cloud hosting infrastructure for our application and database |
These providers process data under their own privacy policies and, where applicable, data processing agreements with us. We do not sell personal data to third parties.
Some of our service providers may process data outside the UK or European Economic Area, including in the United States. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognised under UK GDPR to ensure your data remains protected.
We retain personal data for as long as necessary to provide the Service and fulfil the purposes described in this policy, including:
You may request deletion of your account and associated data at any time by contacting us, subject to our legal retention obligations.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact us using the details below.
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encrypted connections, access controls, and secure cloud infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Our website may use minimal cookies necessary for core functionality. We do not currently use third-party advertising or tracking cookies. If this changes, this policy will be updated accordingly.
Our Service is intended for use by businesses and is not directed at children. We do not knowingly collect personal data from individuals under the age of 16.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified to active subscribers by email. The "Last updated" date at the top of this page indicates when it was last revised.