Privacy Policy
Effective date: 13 November 2026.
Summary in plain language
- Two roles. For people who visit our website or use our console (our customers and their agents), we decide what happens to your data: we are the controller. For people who chat with a business through the mlivechat widget, that business decides: we only process the chat on its behalf, as its processor (a "data intermediary" in Singapore law).
- If you chatted with a business and want your data seen, corrected or deleted, ask that business first. It can delete your chats itself. If you cannot reach it, write to us and we will pass your request on.
- What we collect for accounts: name, email, password (stored only as a one-way hash), role, job title and photo if you add them, sign-in sessions, and what you do in the console.
- Where it is stored: Huawei Cloud in Singapore. Emails we send go through Resend, which may be outside Singapore.
- We do not sell personal data, show ads, or use a map or location service. We do not look up where you are from your IP address.
- Cookies: the console uses one sign-in cookie. Details are in the Cookie and Storage Notice.
- Your rights: you can ask to access, correct or delete your data, and, in the EU, to object, restrict or port it. Write to support@mlive.chat; it also reaches our Data Protection Officer.
The full Privacy Policy
1. Who we are
mlivechat ("we", "us") provides mlivechat, a live-chat service for businesses (the "Service"), and operates the website https://mlive.chat and the console https://app.staging.mlive.chat.
- Privacy contact: support@mlive.chat
- Data Protection Officer (Singapore PDPA s.11(3)): the mlivechat privacy team, support@mlive.chat
- EU representative (GDPR Art. 27): none appointed. We will name one here if the law requires it.
2. Scope: controller and processor
| Who you are | Our role | Which document applies |
|---|---|---|
| Visitor to https://mlive.chat | Controller | This policy, Part A |
| Customer account owner, administrator or agent using the console | Controller | This policy, Part A |
| Person who chats with a business through its mlivechat widget ("Visitor") | Processor / data intermediary for that business | That business's privacy policy; this policy, Part B, explains what we do on its behalf |
Part A: data we control
A1. What we collect and why
| Data | Source | Purpose | GDPR legal basis (where GDPR applies) |
|---|---|---|---|
| Name, email address, password (stored only as an argon2id hash), organisation name, company size, website hostname | You, at sign-up and onboarding | Create and run your account; confirm your email | Contract (Art. 6(1)(b)) |
| Role, job title, avatar, groups, chat limits, routing status and its history | You or your organisation's administrators | Route chats; show your team who is available; agent activity reports for your organisation | Contract; legitimate interests of your organisation and us (Art. 6(1)(f)) |
| Sign-in sessions (a random token stored only as a hash), email-confirmation, invite and password-reset records | Generated by the Service | Keep you signed in; secure sign-up, invites and resets | Contract; legitimate interests (security) |
| IP address and request metadata | Your browser | Rate-limit abuse (for example password guessing) and keep the Service secure | Legitimate interests (security) |
| Emails we send you and their delivery status | Generated by the Service | Account confirmation, invites, password resets, offline-message and data-deletion notices | Contract |
| Messages you send us (support, sales) | You | Answer you | Legitimate interests; contract |
| Billing details | You | Charge for the Service, through our payment provider once paid plans start | Contract; legal obligation (tax records) |
| Browser signals checked by Cloudflare Turnstile | Your browser, when you sign in to the console or send our contact form | Tell people from bots and keep spam and password guessing out | Legitimate interests (security) |
For Singapore's PDPA, we collect, use and disclose this data with your consent (given when you sign up and use the Service, PDPA s.13–15), or where an exception in the PDPA's First or Second Schedule applies (for example, legitimate interests, or to perform a contract). We use it only for the purposes above, which a reasonable person would consider appropriate (PDPA s.18).
A2. What we do not do
We do not sell personal data, rent it, use it for third-party advertising, or build location profiles. The Service contains no map and no IP-to-location lookup.
A3. Who we share it with
- Huawei Cloud (AP-Singapore region, ap-southeast-3): hosting, database, object storage and content delivery in the AP-Singapore region.
- Resend (United States; mail is sent from its Tokyo, Japan region): delivering transactional email. The provider receives the recipient address, subject and message content.
- Cloudflare: DNS for our domains, and Turnstile, which checks console sign-ins and our contact form for bots. It receives your IP address and browser signals during that check.
- Our payment provider: payment processing, once paid plans start. We will name it here before then.
- Your own organisation: owners and administrators can see the agent profiles, activity and chats of their organisation.
- Authorities or others where the law requires it, or to protect rights, safety and the Service.
- A buyer or successor of our business, under equivalent protections, with notice to you.
A4. International transfers
Our primary storage is in Singapore. Where personal data is transferred outside Singapore (for example to the email provider), we take steps to ensure the recipient is bound by legally enforceable obligations giving a standard of protection comparable to the PDPA, such as contractual clauses, as required by PDPA s.26 and Part 3 of the Personal Data Protection Regulations 2021.
If you are in the European Economic Area, the UK or Switzerland: Singapore does not have an EU adequacy decision. Where GDPR applies to our transfer of your data to Singapore or onward, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or another valid safeguard under GDPR Chapter V. You can request a copy at support@mlive.chat.
A5. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | While the account is active, then deleted within 30 days of account closure |
| Sign-in sessions | 30 days from last use (sliding); ended earlier by sign-out or a password reset |
| Unconfirmed sign-ups and join requests | Link valid 24 hours; record deleted after 7 days |
| Password-reset links | Valid 1 hour; deleted once used, or when the password is reset |
| Email invites | Expire 7 days after they are sent |
| Queued emails and background jobs | Removed 1 hour after they finish |
| Billing records | 5 years after the end of the financial year they belong to (tax law) |
| Backups | 14 days |
A6. Security
See Annex 2 of our Data Processing Agreement for the technical and organisational measures in place. They include tenant isolation in the database, hashed passwords and tokens, secure cookies, rate limiting and private file storage. We do not claim any third-party security certification.
A7. Your rights
Depending on where you live, you may have the right to:
- access your personal data and learn how it has been used or disclosed in the past year (PDPA s.21);
- correct it (PDPA s.22; GDPR Art. 16);
- withdraw consent (PDPA s.16), which may mean we can no longer provide the Service;
- under GDPR: erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection to processing based on legitimate interests (Art. 21);
- complain to a supervisory authority: in Singapore the Personal Data Protection Commission (pdpc.gov.sg); in the EU your local data protection authority.
Send requests to support@mlive.chat. We will verify your identity and respond within the time the law requires (GDPR: one month; PDPA: as soon as reasonably possible, with notice if we need more than 30 days). We may charge a reasonable fee for PDPA access requests where the law allows.
Philippines: if you are in the Philippines, the Data Privacy Act of 2012 (RA 10173) may also give you the rights to be informed, to object, to access, to rectification, to erasure or blocking, to data portability, to damages, and to complain to the National Privacy Commission.
A8. Children
The Service is for businesses. It is not directed at anyone under 18, and we do not knowingly collect their data for our own purposes.
A9. Data breaches
If a breach affecting your data is notifiable, we will notify the PDPC and affected individuals as the PDPA requires (the PDPC within 3 calendar days of assessing that a breach is notifiable), and the competent supervisory authority under GDPR Art. 33–34 where it applies.
Part B: data we process for our customers
B1. Our role
When you chat with a business through the mlivechat widget, that business (our "Customer") is the controller. We process your data only on its documented instructions, under our Data Processing Agreement with it, and for no purpose of our own.
B2. What the widget collects
| Data | How it is collected |
|---|---|
| Messages you write, and files you send (images and documents up to 10 MB; executable files are refused) | You, in the chat |
| Your name, email address and answers to pre-chat or offline forms | You, if the business's form asks |
| Pages you visit on the business's website while the widget is loaded (address, title, time), the referring page | Your browser, through the widget |
| IP address | Your connection; stored with each visit and shown to the business's agents |
| Browser and operating system | Derived from your browser's user-agent string |
| City and time zone | Only if the business's website sends them as "session fields"; we do not derive location from your IP address |
| Other session fields (up to 50 short values the business's website chooses to send) | The business's website |
| Chat rating, time stamps, and whether you are online | The Service |
| A visitor identity token | Stored in your browser by the widget so the chat continues between pages and visits; see the Cookie and Storage Notice |
Agents of the business can see this data in their console. The business may also send chat events to its own systems through webhooks or bots it configures; that onward use is the business's responsibility.
B3. Retention and deletion
Chats and files are kept until the business deletes them or closes its account. The business's owner can delete all data about one visitor (by email address) or all chats at any time; stored files are then removed, normally within 24 hours. Files that were uploaded but never sent are deleted after 24 hours.
B4. Your requests
Contact the business you chatted with. It can act on your request directly. If you contact us, we will forward your request to that business without undue delay and help it respond, as our agreement requires.
3. Changes
We will post changes here and update the effective date. We will notify account owners by email of material changes.
4. Contact
mlivechat. Privacy: support@mlive.chat. DPO: the mlivechat privacy team, support@mlive.chat.