Tenth Chapter Ltd, trading as Natter (“Natter”, "we", "us", "our"), provides a conversational AI platform to customers designed to facilitate employee and stakeholder feedback via surveys, one-on-one conversations, and AI chatbot discussions with Natalie AI.

We are committed to safeguarding the privacy of our customers and service users, as well as the privacy of our website visitors, prospective customers and business partners.

Our service is not intended for children and we do not knowingly collect data relating to children.

This Privacy & Cookies Policy (“Policy”) applies to the data we process as a data controller, including the management of our main website www.trynatter.com, marketing and improving our services, and other internal purposes.

This Policy explains how we collect, use and otherwise process personal data in these circumstances. We will be responsible for complying with applicable data protection laws in respect of such personal data.

Use of your data on the Natter platform

Your organization may invite you to participate in Natters and/or Natalie AI conversations on the Natter platform. Participation is optional, and you can leave a Natter session or Natalie AI conversation at any time.

When you use the Natter platform as an employee or other stakeholder of one of our customers, that customer is the data controller and Natter is the data processor. We will refer to the customer as your ‘organization’ or our ‘customer’ in this Policy.

In the context of Natter sessions and Natalie AI conversations, your organization controls how and why your personal data is used, and sets up and manages your account. Your organization’s relevant privacy policies and notices will apply to this processing (and not this Policy).

The lawful basis for this processing is decided by your organization and will be set out in their relevant privacy policy and notices, but in most cases, this will be based on their legitimate interests or contractual obligations in providing you with access to the Natter platform.

As data processor, our processing activities are governed by our contractual arrangements with your organization, and this Policy does not apply. For further information about how and why your personal data is processed by your organization, please see their relevant privacy notices.

We keep this Policy under regular review to make sure it is up to date and accurate. You should check this page occasionally to ensure you are happy with any changes to this Policy.

We will alert you of material changes by placing a notice on our website and/or the Natter platform, or sending you an email. It may not always be possible for us to alert you of changes (for example, if you opt-out of legal update emails from us). If you use our services after any changes to the Policy have been posted, that means you agree to the changes.

You and/or your organization may share your personal data with us. For example, certain User Account Data such as your name, email address and profile picture when inputted into the Natter platform, and the output of Natter sessions and surveys that you participate in.

We may also collect data directly from you at conferences or other events, when showcasing Natalie AI or other features of the Natter platform.

We collect data indirectly about your interactions, use, and experiences with the Natter platform and website. This includes Usage Data such as your IP address, operating system or geographical location. As part of our marketing activities, we may also collect data indirectly via desk research or through trusted third parties such as Clay.

A description of the data collected is set out in Section 5 below.

In some cases, we act as a data controller, and in other cases, as a data processor. This depends on the type of data collected and its purpose.

Information we process as a ‘data processor’

‍Natter acts as a processor when handling information on behalf of your organization. Your organization will provide you with a data notice in respect of this processing.

We process:

User Account Data

Personal data shared by you or your organization including to register an account for you on the Natter platform, including email address and name, profile photo, account identifiers, tags (e.g. location, role and seniority), educational information, employment information, statistical or demographic data and marketing preferences, account preferences and settings.

The primary source of the User Account Data is you and/or your organization, although some elements of the User Account Data may be generated by our services. If you log into our services using a social media account, we will obtain elements of the User Account Data from the relevant social media account provider.

Your organization may invite you to take part in a Natter session, survey or Natalie AI conversation using a direct link, without requiring you to create a user account. In such circumstances your organization remains the data controller and Natter the data processor, in the same way as for users with an account. Your organization’s privacy notices will apply to this processing, and your organization is responsible for providing you with information about how your personal data is used. User Tags (e.g. location, role and seniority), Platform Communications Data and Transcript Data generated during such a session are processed in the same way as for users with an account.

Platform Communications Data

Data captured as part of a survey, one-on-one Natter session or Natalie AI conversation, in the form of video data, audio data, conversational data, text-based chat data, and survey responses (including quantitative responses and any free-text responses). This may include identifiers and contextual information disclosed during conversation (such as name, job role and other employment information, anecdotes, image, and gender), as well as voice characteristics, tone, speech patterns, sentiment and contextual inferences drawn from free-flowing dialogue. For Natalie AI conversations, this may also include AI-generated responses, which could contain personal data disclosed by the user during the conversation.

The source of the Platform Communications Data is you, the person(s) with whom you communicate via the Natter platform and/or our services providers, and we process this data on your organization’s behalf for the purpose of providing the services and generating aggregated insights.

Transcript Data

We may transcribe video-based conversations between participating users on the Natter platform, and Natalie AI conversations. Transcript Data may include a video and audio recording of a conversation you have had with another user, captured for the purposes of transcribing the dialogue. We do this for the purpose of generating insights, conversational summaries and identifying themes.

Note that Transcript Data is redacted on your organization’s behalf to remove key categories of personal data (see more information about our transcription and anonymization processes below).

Support Data

You, or your organization on your behalf, may submit support requests to us. As part of our service to your organization, Natter will process the contact details and issue description to resolve those requests.

Additional information about processing in these circumstances will be provided through your organization’s own privacy notices.

‍Information we process as a ‘data controller’

The personal data we collect includes:

Customer Relationship Data

The contact details of our customers’ and prospective customers’ personnel, including name, email address, telephone number, job title and other information about our interactions with those personnel. This includes the information contained in those communications. Customer Relationship Data may also be processed by third-party service providers acting as subprocessors, including CRM (‘customer relationship management’) providers. The source of the Customer Relationship Data is you and/or your organization.

Direct User Data

We may collect account data directly from you at conferences or other events, when showcasing Natalie AI or other features of the Natter platform, or indirectly as part of our marketing activities. For example, email address and name, profile photo, account identifiers, tags (e.g. location, role and seniority), educational information, employment information, statistical or demographic data and marketing preferences, account preferences and settings. This is separate to our service provision to your organization.

Feedback Survey Data

Your responses to voluntary surveys, questionnaires or product feedback requests. This data is processed to provide, maintain, and improve the Natter platform’s functionality.

General Communications Data

We may process information contained in or relating to support queries and other communications that you send to us or that we send to you that does not fall within any of the other categories detailed above. This may include the communication content and metadata associated with the communication. Our services will generate the metadata associated with communications made using the contact forms.

Usage Data

We may process data about your use of our website and services. The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. We also collect cookies (please see the ‘cookies’ section below). This data is collected by our analytics tracking systems.

We apply data minimization principles and we will only process data where we deem such data to be:

When we are acting as the data controller, we decide the purpose of processing and the relevant lawful basis as below:

Operations

We may process your personal data for the purposes of operating our website, the processing and fulfilment of orders, enabling the use of our services, generating invoices, bills and other payment-related documentation, and credit control. The lawful basis for this is our legitimate interests.

Relationships and communications

We may process User Account Data, Direct User Data, Customer Relationship Data and/or General Communications Data for the purposes of managing our relationships, providing support services, complaint handling, and communicating with you by email, SMS, post and/or telephone. The lawful basis for this is our legitimate interests.

Direct marketing

We may process User Account Data and Customer Relationship Data for the purposes of creating, targeting and sending direct marketing communications by email, SMS, social media messages and/or post and making contact by telephone for marketing-related purposes. The lawful basis for this processing is our legitimate interests, or where required by applicable law, your consent.

Personalization

We may process User Account Data, Platform Communications Data, General Communications Data and/or Usage Data for the purposes of personalizing the content and advertisements that you see on the Natter platform. The lawful basis for this processing is our legitimate interests, namely offering the best possible experience to our service users.

Research and analysis

We may process User Account Data, Platform Communications Data and/or Usage Data for the purposes of researching and analyzing the use of our services, conducting round table events and drafting research papers as well as researching and analysing other interactions with our business. The lawful basis for this processing is our legitimate interests, namely monitoring, supporting, improving and securing our website, services and business.

Record keeping

We may process your personal data for the purposes of creating and maintaining our databases, back-up copies of our databases and our business records generally. The lawful basis for this processing is our legitimate interests, namely ensuring that we have access to all the information we need to properly and efficiently run our business in accordance with this Policy.

Security

We may process your personal data for the purposes of security and the prevention of fraud and other criminal activity. The lawful basis of this processing is our legitimate interests, namely the protection of our website, services and business, and the protection of others.

Insurance and risk management

We may process your personal data where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks and/or obtaining professional advice. The lawful basis for this processing is our legitimate interests, namely the proper protection of our business against risks.

Legal claims

We may process your personal data where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The lawful basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights and the legal rights of others.

Legal compliance and vital interests

We may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or to protect your vital interests or the vital interests of another natural person.

Where you access Natter via your organization, your organization controls how and why your personal data is used in respect of the data processed during a Natter (e.g. User Account Data and Platform Communications Data), and is responsible for determining the lawful basis of processing that data. Please see your organization’s relevant privacy notices for more information on this.

Redacted transcripts of Natter sessions are used to create aggregated analysis and insights for customers.

At the start of a Natter session, both participants will be asked if they are happy for Natter to transcribe the conversation. Transcription will only happen if both participants say yes.

Sometimes, your organization may set transcription as mandatory. The Natter platform will inform you if this is the case. If you do not wish to participate, you may leave the Natter session.

Natalie AI conversations are also transcribed.

Natter uses a series of controls to anonymize transcripts, including redaction and aggregation. Please see Our Approach to Data Privacy & Anonymity for further information.

While Natter applies technical and organizational measures designed to reduce identifiability, users should note that, as with all free conversational data, there is a risk that personal data could remain in transcripts, and that a user could be identifiable as a result.

We place obligations on our customers and third-party suppliers to only use transcripts for the purposes for which they are created, and to not reverse-engineer transcripts or combine them with other data sets to try to identify individuals.

We use AI to support key features of the Natter platform, including to:

1. enable pairing of individuals to one-on-one conversations in Natter sessions;

2. redact key categories of personal data from Transcript Data and free-text responses;

3. power Natalie AI, an AI-supported conversational agent that facilitates dialogue with individual users in natural language; and

4. create insights for our customers about their businesses, based on de-identified data from Natter and Natalie sessions.

While Natalie is designed to be privacy-aware and does not prompt users to provide personal data, users may choose to disclose personal information during conversations.

Natalie’s outputs are intended to generate aggregated insights based on de-identified data. Natalie is not designed to be used for automated decision-making or for making decisions about individuals.

We do not use your personal data to train any AI models. We share the information with our service providers that support the service, but they do not use it to train their models.

The output of our AI-enabled services may not always be 100% accurate. Customers remain responsible for reviewing AI-generated outputs for accuracy and appropriateness for their use case, including using human review where appropriate, before using them in any organizational context. Where customers choose to use outputs in key decision-making contexts, they remain responsible for ensuring appropriate lawful basis, transparency, human review and fairness safeguards.

For more information about your rights and how to exercise them, please review the “Your rights” section below.

If you use our services, you acknowledge that your use will be within the framework of a contract between us and your organization. We may, at the direction of your organization, share your personal data with your organization. In relation to such shared data, your organization will act as the controller and your organization’s use of that data will be subject to its own privacy policy.

We use third-party suppliers and tools to help us provide our services. We apply data minimization principles and we will only share the information required for those suppliers to perform those services. For example, we use a supplier to redact transcriptions of Natter sessions. Other examples include hosting, data processing, machine learning and other services providers identified on our support pages. We may also use third-party suppliers to help us with marketing our services, including direct marketing.

We have contracts in place with these third-party suppliers requiring them to handle your data securely and only for the purposes specified by Natter.

In certain situations, we may disclose your information:

We may also share aggregated, redacted data with third parties for benchmarking, research and the creation of whitepapers. This data is redacted to reduce the risk of any individuals being identified.

We may share hashed (encrypted) contact details, such as email addresses submitted through our website forms, with Google and LinkedIn to measure the effectiveness of our advertising.

In this Section 10, we provide information about the circumstances in which your personal data may be transferred to a third country under UK data protection law.

We store your personal data in our data centres based in London, UK by default, or in North Virginia, US if your organization opts for US ringfenced hosting.

We may transfer your personal data to third party suppliers that carry out certain functions on our behalf. Most of our suppliers store your data in the UK and/or EEA. For other suppliers, the provision of their services may involve transferring personal data outside the UK and EEA to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by using the following safeguards:

See Our Service Providers & Data Transfer Policy for further details of the locations of our hosting facilities, and the facilities of our other services providers, along with details of the specific safeguards used to protect international transfers of personal data to and by these services providers.

This Section 11 sets out our data retention policies and procedures, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.

When Natter acts as a ‘data processor’: For data processed on behalf of your organization (e.g., User Account Data and Platform Communications Data processed to provide the Natter service), we retain the information for the duration of our contract with your organization, and will delete it sooner if requested by your organization under the terms of our contract with them. In some cases, we will retain the data for a shorter period (for example, we retain audio Platform Communications Data for 7 days before deletion). Retention policies for this data, including deletion requests or access rights, are determined by your organization. If you have questions or would like to access or delete data related to your use of the Natter platform, please contact your organization.

‍When Natter acts as a ‘data controller’: This applies to data we use for our own purposes (e.g., contact details for marketing or other communications). We retain this personal data only for as long as is necessary for its purpose. We will retain your personal data as follows:

If you grant to us a licence to publish any of your personal data, we may agree in that licence that we can retain and publish that personal data for longer than the periods above, subject to your data subject rights. If we cease to publish such personal data after the end of the relevant retention period above, that personal data will be retained for a minimum period of 6 years and a maximum period of 7 years following the date that publication ceases.

We may retain your personal data for longer than the retention periods above where it is necessary for compliance with a legal obligation, or to protect your vital interests or the vital interests of another person.

We process personal data securely by means of appropriate technical and organizational measures. This includes a range of policies and procedures governing our information security and the security of our platform infrastructure.

Where Natter acts as a data processor, it implements appropriate technical and organizational measures as required by its contracts with customers and applicable data protection law, and will act promptly on customer instructions relating to access, deletion or return of personal data.

Our security measures include (among other things):

We are committed to seeking to continuously improve our security posture. We are accredited to the internationally recognized information security standard ISO 27001:2022.

In this Section 13, we have listed the rights that you have under data protection law.

Your principal rights under data protection law are:

These rights are subject to certain limitations and exceptions. You can learn more about the rights of data subjects by visiting the ICO’s website.

How to exercise your rights

‍Data processed on behalf of your organization: Where you have access to the Natter platform via your organization, please send any requests to exercise your rights (such as opting out of processing or correcting inaccuracies) to your organization, which acts as the data controller. We will assist the organization in dealing with your request, where possible.

‍Data controlled by Natter: To exercise your rights in relation to data that Natter controls (for example, for customer contacts, research and marketing), you may exercise your rights by contacting us at team@natter.co. We may need to verify your identity before responding.

This section applies to you if you are a resident of a US state with a comprehensive consumer privacy law, such as California. It supplements the rest of this Policy.

Sources of personal information

We collect personal information directly from you (for example, when you contact us, attend our events or complete a survey), automatically from your device when you visit our website (through cookies and similar technologies), from your organization, and from third parties. These third parties include publicly available sources, business contact data and enrichment providers, and marketing tools that help us identify organizations that have visited our website.

Sale and sharing of personal information

We do not sell personal information in exchange for money, and we do not act as a data broker.

However, unless you opt out, we allow certain advertising and marketing partners (Google, LinkedIn, Clay and lempire, the provider of Lemlist) to collect identifiers (such as IP address and cookie identifiers) and internet or network activity information (such as pages visited and interactions with our adverts and emails) through cookies and similar technologies on our website. These partners use this information to measure the effectiveness of our marketing, to identify organizations interested in our services and to show relevant adverts. Under some US state privacy laws, this may be considered a “sale” of personal information, “sharing” for cross-context behavioural advertising, or processing for “targeted advertising”. In the past 12 months, we have shared these categories of personal information for these purposes.

We do not sell or share personal information that we process on behalf of our customers as a data processor (including User Account Data, Platform Communications Data and Transcript Data). We do not use it for advertising, and we only process it in accordance with our contracts with our customers.

We do not knowingly collect, sell or share the personal information of consumers under 16 years of age.

Your right to opt out

You can opt out of the sale or sharing of your personal information, and of targeted advertising, by clicking the “Do Not Sell or Share My Personal Information” link at the bottom of our website or by updating your cookie settings. We also treat Global Privacy Control (GPC) signals as a valid opt-out request for the browser sending the signal.

​

Our website uses cookies and similar technologies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website, keep our website and your account secure, and, where you consent where required under applicable law, understand how our website is used and measure the effectiveness of our advertising.

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored on your device. The identifier is then sent back to the server each time the browser requests a page from the server. We also use similar technologies, such as tags, pixels and scripts, which work alongside cookies to collect information about how you interact with our website. In this policy, we refer to all of these technologies as “cookies”.

Cookies may be either "persistent" cookies or "session" cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless you delete it before then. A session cookie expires at the end of the browsing session.

Cookies may also be either “first-party” or “third-party” cookies. First-party cookies are set by our website. Third-party cookies are set by other organizations, such as the service providers, analytics providers and advertising partners described below, and may allow those organizations to recognise your device across different websites.

We use strictly necessary cookies which are required for the operation and security of our website and services, for example to keep you logged in, protect your account and process payments. Because our website cannot function properly without them, these cookies do not require your consent.

We may also use non-essential cookies such as analytics or marketing cookies. Where non-essential cookies are used, we will provide appropriate information and obtain your consent where required by applicable law through our cookie banner, which is powered by CookieYes, in accordance with applicable law. You may change your preferences at any time as described in the “Choices about cookies” section below.

Cookies may not contain any information that personally identifies a user, but personal data that we store about you may be linked to the information stored in and obtained from cookies.

We and our services providers may use cookies for the following purposes:

We use a range of service providers to power our service (e.g. app.natter.co), where these service providers use cookies to provide services back to us. Below, we have set out a list of service providers who may use cookies in some form as part of providing their service:

Subject to your consent where required by applicable law, using CookieYes Limited (here) for cookie consent management, we use the following third-party analytics and advertising services, which set cookies on your device:

Information collected by these cookies may be transferred to and processed by these providers outside the UK and European Economic Area, including in the United States.

Below are the cookies currently used on the main website trynatter.com:

Regional differences in how we ask for consent

How we ask for your consent to non-essential cookies depends on where you are located. If you are in the UK, the European Economic Area or Switzerland, we will not set analytics or advertising cookies unless you actively accept them through our cookie banner. If you are in the United States, analytics and advertising cookies may be set when you first visit our website, but you can opt out at any time using the banner link at the bottom of our website (“Do Not Sell or Share My Personal Information”) or through our cookie settings. We also recognize Global Privacy Control (GPC) signals sent by your browser as a valid request to opt out. If you are located elsewhere, we will apply the approach required by applicable law in your location.

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:

Blocking all cookies will have a negative impact upon the usability of many websites. If you block cookies, you will not be able to use all the features on our website.

Our legal name is Tenth Chapter Limited. We are registered in England and Wales under registration number 12565130, and our registered office is at The Clubhouse, St James’s, 8 St James’s Square, London, SW1Y 4JU.

You can contact us:

We are registered as a data controller with the UK Information Commissioner's Office (ICO). Our data protection registration number is ZA869456. If you remain dissatisfied, you can make a complaint about the way we process your personal information to the ICO.

Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent. Our nominated EU Representative is:

Last updated: 14 October 2026