Privacy Policy

Effective Date: 22 March 2026 Last Updated: 11 October 2026

1. Introduction

CTrend Ltd ("Company", "we", "us", or "our"), a company registered in England and Wales (Company Number: 17200901, Registered Address: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the CTrend platform ("Service").

This policy applies to all users of the Service, including: - Account holders (operators, administrators) and people using CTrend for personal purposes - End users who interact through connected messaging channels - Visitors who use the webchat widget embedded on third-party websites - Users of the CTrend mobile application - Users of the CTrend browser extension

Data Controller: CTrend Ltd, registered in England and Wales (Company Number: 17200901). Registered Address: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ Contact: privacy@ctrend.co.uk

1.1. Personal and Business Use

Personal use. If you use CTrend for personal purposes, we are the controller of your account data and of the messages that pass through the Service, including messages from the people you talk to (for example, when we translate or transcribe them). We use them only to provide the Service to you — to show, translate, transcribe and deliver them — keep them encrypted, and delete them on the schedule in Section 6. We do not use them to train AI models or for advertising. Our legal basis is our contract with you (Art. 6(1)(b)) and, for the people you talk to, our legitimate interest in providing the service you asked for (Art. 6(1)(f)). The people you talk to can contact us at privacy@ctrend.co.uk to exercise their rights.

Business use. If you use CTrend for your business, we process your customers' messages and contact details on your behalf as a processor under our Data Processing Agreement.

2. Data We Collect

2.1. Account Data

2.2. Messaging Data

2.3. AI Processing Data

2.4. Voice and Audio Data

2.5. Usage Data

2.6. Technical Data

2.7. Mobile Application Data

2.8. Browser Extension Data

2.9. Campaign and Broadcast Data

2.10. Webhook and Integration Data

3. How We Use Your Data

We process your personal data for the following purposes:

Purpose Legal Basis (UK GDPR)
Providing the Service (messaging, AI agents, webchat) Performance of contract (Art. 6(1)(b))
Processing messages through connected channels Performance of contract (Art. 6(1)(b))
AI-powered automated responses and routing Legitimate interest (Art. 6(1)(f)) — see §3.1
Contact memory extraction (personalised AI responses) Legitimate interest (Art. 6(1)(f)) — see §3.2
Automatic message translation Legitimate interest (Art. 6(1)(f))
Voice transcription (STT) Performance of contract (Art. 6(1)(b))
Knowledge base search for AI responses Performance of contract (Art. 6(1)(b))
Billing and payment processing Performance of contract (Art. 6(1)(b))
Campaign and broadcast messaging Legitimate interest (Art. 6(1)(f))
Webhook event delivery to operator endpoints Performance of contract (Art. 6(1)(b))
Service security and fraud prevention Legitimate interest (Art. 6(1)(f))
Service improvement and analytics Legitimate interest (Art. 6(1)(f))
Legal compliance Legal obligation (Art. 6(1)(c))
Email communications (welcome, password reset) Performance of contract (Art. 6(1)(b))

3.1. AI Automated Decision-Making (Art. 22)

Our Service uses AI agents to automatically process and respond to incoming messages. This includes: - Message routing: AI determines whether to respond automatically or escalate to a human operator - Escalation decisions: AI may hand a conversation over to a human operator - Response generation: AI generates replies based on configured persona, knowledge base, and conversation history

These automated decisions do not produce legal effects or similarly significant effects on end users. The Service provides operators with the ability to: - Review and override any AI decision - Disable AI responses for specific contacts or conversations - Configure escalation rules to ensure human review

If you believe an automated decision has significantly affected you, you may contact us at privacy@ctrend.co.uk to request human review.

3.2. Contact Memory — Balancing Test

We use AI to extract factual information from conversations (e.g., customer name, vehicle model, service preferences) to provide personalised responses in future interactions. We rely on legitimate interest (Art. 6(1)(f)) because:

4. Data Sharing

We share your data with the following categories of recipients:

4.1. Sub-Processors

The current list of third-party services that process data on our behalf is available to customers within the Service, and to anyone on request to privacy@ctrend.co.uk.

4.2. Messaging Platforms

When you connect a messaging channel (e.g., Telegram, WhatsApp, Email), messages are transmitted through the respective platform's infrastructure in accordance with their own privacy policies.

4.3. AI and Language Providers

If you use AI features, message content may be processed by third-party providers of AI models, speech-to-text and translation, located mainly in the United States. The current list is available to customers within the Service and on request to privacy@ctrend.co.uk.

Our AI model providers do not use your data to train their models.

Translation

Translation in CTrend is performed:

4.4. Payment Processor

Payment data is processed by Paddle.com Market Ltd (United Kingdom). We do not store credit card numbers. Paddle acts as the Merchant of Record for all transactions.

4.5. Operator-Configured Integrations

Operators may configure: - Webhook endpoints that receive event notifications containing message and conversation data - CRM integrations (e.g., HubSpot) that sync contact information - Calendar integrations (Google Calendar) for appointment booking - Automation workflows for custom automation

Data shared through these integrations is controlled by the operator (data controller) and subject to their own privacy policies.

We may disclose your data if required by law, court order, or governmental authority.

5. International Data Transfers

Some of our sub-processors are located outside the United Kingdom (primarily the United States). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

Specific transfer mechanisms for each sub-processor are documented in our Sub-Processor List, available to customers within the Service and to anyone on request to privacy@ctrend.co.uk.

6. Data Retention

Data Type Retention Period
Account data Duration of account; deleted immediately on account deletion request
Messages and conversations 6 months, then automatically deleted; deleted earlier, immediately, on account or contact deletion request
Contact memory (AI-extracted facts) Duration of account; deletable on request per contact
Knowledge base documents Duration of account; deleted immediately on account deletion
AI processing logs, including actions taken by AI agents 90 days (automatically purged)
Webhook event logs 30 days (automatically purged)
Media files (images, audio, video, documents) Not stored permanently; temporary copies are deleted within 24 hours
Cached translations 30 days, then automatically deleted
Payment records 7 years (legal requirement)
Server and access logs 30 days
Sign-in and security log (sign-ins, password and two-factor changes, account deletion; with IP address and browser) 12 months, then automatically deleted
Free trial and free plan abuse prevention records Indefinite (email addresses, phone numbers and WhatsApp account identifiers used to sign up are retained to prevent repeated free trials and abuse of the free plan, even after account deletion)
Refund records (email address, payment customer ID and phone number of a customer who received a refund) 3 years, to prevent repeated refund abuse, then automatically deleted
AI agent acceptance records (who accepted the AI agent terms, when, from which IP address and browser) 7 years, kept after account deletion as evidence that the terms were accepted (establishment, exercise or defence of legal claims), then automatically deleted
Abuse event logs Retained with account link removed (anonymised)

After the retention period, data is permanently deleted from all active systems by automated cleanup workers.

Retention for legal reasons. If we receive a specific complaint, a request from law enforcement or another public authority, or are involved in a dispute concerning an account, we may preserve that account's data beyond the periods above and decline its deletion for as long as necessary to comply with the law or to establish, exercise or defend legal claims (UK GDPR Article 17(3)(b) and (e)). This applies only to the accounts concerned, never to all users, and we record who placed the hold and why. Data export is available on every plan before account deletion, from the account menu on our website.

7. Your Rights

Under the UK GDPR, you have the right to:

How to Exercise Your Rights

Contact us at privacy@ctrend.co.uk with your request. We will verify your identity before processing.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

9. Data Protection by Design (Art. 25)

We apply data protection principles throughout the design and development of the Service:

10. Data Breach Notification

In the event of a personal data breach:

  1. To the ICO: We will notify the Information Commissioner's Office within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms.
  2. To affected individuals: Where a breach is likely to result in a high risk to your rights, we will inform affected individuals without undue delay, describing the nature of the breach and the measures taken.
  3. To data controllers (operators): We will notify operator organisations as specified in our DPA.

11. Data Protection Officer

CTrend Ltd has appointed a Data Protection Officer (DPO), who can be contacted at dpo@ctrend.co.uk.

The DPO is responsible for overseeing data protection compliance, responding to data subject requests, and maintaining the company's Data Protection Impact Assessments.

For general privacy enquiries, you may also contact: privacy@ctrend.co.uk

12. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service (in-app notification) and/or via email. The "Last Updated" date at the top of this policy indicates when it was last revised. We encourage you to review this page periodically.

14. Complaints

If you have concerns about how we handle your data, you may contact us at privacy@ctrend.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

15. Contact

CTrend Ltd Company Number: 17200901 61 Bridge Street, Kington, Herefordshire, HR5 3DJ Email: privacy@ctrend.co.uk