1. Who we are

Multish AI Ltd provides a guided AI workspace: chat, guided flows, agents, content tools, analytics, billing, and optional business support (including website embeds and WhatsApp).

For your own Multish.ai account, we are the data controller. When a business uses Multish.ai to talk to its website visitors or WhatsApp contacts, that business is typically the controller of those visitor conversations, and we process that data to provide the service.

2. Data we collect

We collect the following categories of information, depending on how you use Multish.ai:

• Account details — first name, last name, email address, hashed password, and a Google account identifier if you sign in with Google.
• Profile and settings — optional phone number, language, workspace preferences, and any custom model API keys you choose to store.
• Workspace content — chats, guided-flow answers, generated outputs, agent personas, tasks, articles, and related files you create or upload.
• Privacy placeholders — optional labels and values you store so sensitive details can stay out of model prompts until you choose to reveal them.
• Business workspace data — businesses, branches, contacts, FAQs, and staff or visitor support conversations.
• Visitor and channel data — messages from site widgets or WhatsApp, visitor and contact session tokens, email verification records, WhatsApp identifiers, IP address, and approximate location or country when a support conversation starts.
• Billing — subscription plan, invoices, and payment status. Card details are handled by Stripe; we do not store full card numbers.
• Usage and technical data — feature usage inside the workspace, and cookies or similar data needed to keep you signed in and remember preferences.
• Integrations — GitHub installation details if you connect Launchpad, and WhatsApp connection details if you enable WhatsApp support.

3. How we use data

We use personal data to:

• create and secure your account, including email verification and password reset
• provide chats, guided flows, agents, content tools, analytics, and support inboxes
• process payments and manage subscriptions
• send service emails that are necessary to operate your account
• prevent abuse, diagnose faults, and keep the platform secure
• comply with law and enforce our terms

Our legal bases under UK GDPR are typically: performing our contract with you, our legitimate interests in running a secure product, and consent where you choose optional integrations or store extra profile details.

When you verify the same email or use a one-time WhatsApp handoff code, we may link your website-widget and WhatsApp conversations to one business contact and inbox history. Verification codes and session or handoff secrets are stored as hashes. We never ask you to send a password in WhatsApp; password setup uses a short-lived link to an HTTPS page.

4. AI processing

To generate replies and other outputs, we send the prompts, conversation context, and related files you submit to third-party AI model providers. Those providers process that content so we can return a result to you.

We do not sell your workspace content. Model providers process data under their own terms. If you use privacy placeholders, the stored values are kept in your workspace and are not sent to a model unless you choose to reveal them in a prompt or output.

5. Who we share data with

We share personal data only as needed to operate Multish.ai:

• AI model providers — to generate chat and agent outputs
• Stripe — to process subscriptions and invoices
• Google — if you use Google sign-in or import business details from Maps / Places
• Meta / WhatsApp — if you connect WhatsApp support
• Email delivery and hosting providers — to send mail and run the platform
• GitHub — if you connect Launchpad
• Authorities — when the law requires it, or to protect users and the service

Staff on a business workspace can see the conversations, contacts, and analytics for that workspace. We do not sell personal data to advertisers.

6. Cookies

We use cookies that are needed for the product to work, including:

• auth-token — keeps you signed in (essential, HTTP-only)
• theme preference — remembers light or dark mode
• workspace preferences — remembers layout and model-tier choices

We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but sign-in and some preferences will not work without the essential cookie.

7. How long we keep data

We keep account and workspace data while your account is active. If you ask us to delete your account, we remove or anonymise personal data unless we must keep a record for tax, billing, security, or legal reasons. Visitor support chats are kept with the business workspace until that business deletes them or closes the workspace.

8. Your rights

If UK GDPR applies to you, you can ask us to access, correct, delete, or export your personal data, or to restrict or object to certain processing. You can also complain to the Information Commissioner’s Office at ico.org.uk.

You can update much of your account information in the dashboard. For other requests, email us using the contact details below. We may need to verify that the request comes from you.

9. Children

Multish.ai is built for businesses and adult users. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, please contact us and we will delete it.

10. International transfers

Some of our providers are based outside the United Kingdom. When we transfer personal data internationally, we rely on appropriate safeguards such as the provider’s standard contractual clauses or an adequacy decision, where required.

11. Changes to this policy

We may update this page when the product or the law changes. The “Last updated” date at the top will change when we do. Continued use of Multish.ai after an update means you accept the revised policy.

12. Contact

Privacy questions and data-rights requests can be sent to Multish AI Ltd at admin@multish.com.