Legal

Privacy Notice

Last updated: 27 September 2026

1. Who we are

Andy Partner is run by Andesphere Ltd, a company registered in England and Wales with company number 16350517, registered office 169 Westbourne Grove, Westcliff-on-Sea SS0 9TX, United Kingdom ("Andesphere", "we", "us").

Contact for anything in this notice: support@andesphere.com.

This notice explains how we use personal data about:

people who sign up for, or use, an Andy Partner account ("account holders"), including team members invited to a workspace;
visitors to andypartner.com and app.andypartner.com;
people who contact us or join our mailing list.

For this data, Andesphere Ltd is the controller.

If you messaged a business that uses Andy

Businesses use Andy to answer their customers on WhatsApp, Instagram, their website chat and other channels. When you message one of those businesses, that business is the controller of your data. We process it for them, under a contract, and only on their instructions. Their privacy notice applies, so please contact that business first. If you contact us, we will pass your request to them.

2. The data we collect

Account data. Your name, email address, profile image, sign-in details, language preference, the workspaces you belong to and your role in them.
Terms acceptance record. The date you accepted our terms and privacy notice, the versions you accepted, and the IP address and browser used at the time.
Billing data. Your plan, subscription status, billing name, email and billing details. Stripe collects your card or payment details. We do not see full card numbers.
Content you give us. Agent settings, instructions, knowledge documents, website addresses, files, and the messages you send to support or to our own assistant.
Usage and device data. Pages and features used, clicks, errors, device type, operating system, browser and approximate location from your IP address. In the web app, session recordings, with on-screen text masked.
Security logs. Activity records with your email address, IP address and browser details, used to secure accounts and investigate abuse.
Communications. Emails and messages between you and us, and your email preferences.
Mailing list. Your email address, language, the page you came from and your IP address, if you join our mailing list.

We do not ask account holders for special category data. Please do not put it in your account profile.

3. Why we use it and our lawful basis

Our lawful bases come from Article 6 of the UK GDPR.

Create and run your account and provide Andy. Account data, content, usage data. Basis: contract.
Take payments and keep billing and tax records. Billing data. Basis: contract and legal obligation.
Keep the service secure, prevent fraud and abuse, and fix errors. Security logs, usage and device data, error reports. Basis: legitimate interests (a safe, working service).
Understand how the product is used and improve Andy Partner. Usage and device data, including cookieless analytics and masked session recordings. Basis: legitimate interests (improving our product).
Send service messages, such as alerts, billing notices and changes to terms. Account data. Basis: contract.
Send product news and offers to account holders. Account data. Basis: legitimate interests. You can opt out in any of those emails.
Send our mailing list emails. Mailing list data. Basis: consent.
Answer questions and support requests. Communications, account data. Basis: contract or legitimate interests.
Keep a record of your acceptance of our terms. Terms acceptance record. Basis: legitimate interests (proving the agreement).
Follow up on signups and payments in our internal sales CRM. Name, email, signup and first payment events. Basis: legitimate interests (running our business).
Comply with law and defend legal claims. Any of the above, as needed. Basis: legal obligation and legitimate interests.

What we do not do.

We do not use your data, or your end customers' data, to train AI models.
We do not use Andy data in other Andesphere products, apart from the internal sales CRM described above.
We do not sell personal data.

4. Automated decisions

We do not make decisions about account holders that have legal or similarly significant effects based only on automated processing. Andy's AI answers your end customers on your behalf. You control its settings and can hand any conversation to a human.

5. Who we share data with

Service providers (sub-processors) that host, secure and run Andy, including AI model providers. The full list, with what each receives, is on our sub-processors page.
Payment provider. Stripe processes payments.
Services you connect. When you connect WhatsApp, Instagram, Google Calendar, Google Drive, Slack or a social account, data passes to that service under your own agreement with it.
Authorities and advisers, where the law requires it, or to protect our rights.
A buyer or successor, if our business is sold or restructured. They must protect your data as this notice says.

6. International transfers

Some of our providers store or process data outside the UK, mainly in the United States. Our main database (Convex) is hosted in the United States. The bridge behind the WhatsApp Direct connection runs in the Netherlands, in the European Economic Area, which the UK recognises as adequate.

When data goes to a country without UK adequacy regulations, the transfer needs an approved safeguard, such as the UK Extension to the EU-US Data Privacy Framework, the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us which safeguard applies to a provider at support@andesphere.com.

7. How long we keep data

Account data. While your account is open. When you delete your account, we delete your user record, plan and usage records and feedback posts, and remove your workspace memberships.
Workspaces you own alone. When you delete your account, they are archived, not deleted. Their agents, conversations, contacts, leads and documents stay stored, and nothing deletes them automatically. To have them erased, email support@andesphere.com. We complete full erasure within 30 days of verifying your request.
Agents. Deleted permanently 7 days after you delete them, with their documents, recordings, messages, leads and related records.
Conversations, contacts and leads. Kept while the agent exists, unless you delete them sooner. There is no fixed maximum period.
Billing records. As long as tax and accounting law requires. Stripe keeps its own payment records.
Security and activity logs. There is no fixed end date. When you delete your account, the entries keep your email address. You can ask us to erase them, unless we need them to prevent fraud or abuse.
Incoming channel event records (WhatsApp, Instagram, Slack). 24 hours.
Our records of emails we sent. 7 days, or 28 days for emails that were never finalised.
Mailing list. Until you ask us to remove you. If you unsubscribe, we keep your entry marked as unsubscribed so we do not email you again.
Backups. Until the backup is overwritten or deleted.

We may keep anonymised statistics that no longer identify anyone. Our data deletion page explains the steps in detail.

8. Your rights

You have the right to:

access your personal data and get a copy;
correct inaccurate data;
have your data erased;
restrict how we use it;
object to our use of it, including for direct marketing;
receive data you gave us in a portable format, and have it sent to another controller;
withdraw consent at any time, where we rely on consent.

Some rights have limits. For example, we must keep billing records for tax law.

How to use your rights. Email support@andesphere.com from the address on your account. You can also delete your account in the app. There is no self-serve export, so we handle access and portability requests by email. We may ask you to prove who you are. We reply within one month. We may extend this by two more months for complex requests, and we will tell you if we do.

9. Complaints

Please contact us first at support@andesphere.com. You can also complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113

10. Cookies and similar storage

We use cookies only to run the website and app and to remember your choices. We do not use advertising or tracking cookies, and we do not show a cookie banner.

Cookies

andy_locale: remembers the language you chose. Lasts 1 year. Website and app.
Clerk sign-in cookies: keep you signed in securely. App only. Clerk, our sign-in provider, sets them and controls how long they last.
last_workspace_slug: opens the workspace you last used. Lasts 30 days. App only.
selected_chatbot_id: remembers the agent you selected. Lasts 30 days. App only.
sidebar_state: remembers whether the sidebar is open. Lasts 7 days. App only.
andy_ref: remembers who recommended Andy to you, so they can be credited if you sign up. Set only when you arrive through someone's referral link. Lasts 60 days. Website and app. Not set for visitors in the UK or the European Economic Area (the EU, Iceland, Liechtenstein and Norway).

Session storage (cleared when you close the browser tab)

andy.utm: keeps the campaign tags from the link you arrived on, so your signup can record where you came from. Website only.
andy.ref: remembers who recommended Andy to you until you close the tab, so the account you create in it is credited. Set only when you arrive through someone's referral link. For visitors in the UK and the European Economic Area it is the only place we keep it. Website and app.
Our website chat widget keeps a conversation identifier, so a member of our team can take over the chat.

Our product analytics (PostHog) on the website and the web app keep their identifiers in memory only. They set no cookies and store no identifiers in your browser.

11. Children

Andy Partner is a business service. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, email support@andesphere.com and we will delete it.

12. Security

We protect data with access controls, encrypted storage of connection credentials, and signature checks on incoming webhooks. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

13. Changes to this notice

We will post any changes here and update the date at the top. If a change is significant, we will email account holders before it takes effect.

14. Customers in Chile

If your account is with Andesphere SpA under our Chilean terms, the Spanish privacy policy applies instead.