Privacy
How Stirel handles personal data, and what you can ask us to do with yours. Last updated 28 September 2026.
Who we are
Stirel is a service of Prime Frame LLC, 412 W 7th St, Clovis, NM 88101, United States ("we", "us"). Privacy contact: support@stirel.com.
Two different roles
When a business uses Stirel with its own visitors and customers, on its website, its shop or its WhatsApp number, that business decides why and how those conversations are used. It is the controller, and we process the conversations only on its instructions, as its processor. Our commitments to those businesses are in the data processing addendum. If you wrote to one of them, its own privacy policy applies first and it is the best place to send a request; we help it answer.
When you visit stirel.com, write to us, or your business signs up, we decide how that data is used and we are the controller.
What we process
When you write to an assistant run by Stirel
- The messages you send and the replies.
- A contact detail, such as an email or phone number, if you choose to leave one.
- If you speak instead of typing, the audio is transcribed and not kept. Only the text is stored.
- On WhatsApp, the phone number and profile name that WhatsApp provides.
- On a website, a random visitor identifier in a first-party cookie. It is set only once you start using the assistant and lasts up to 180 days.
- The IP address of your connection, in the security logs we use to stop abuse.
- In a shop, the pages and products you looked at and what you asked, stored in that business's own website.
- If an order follows the conversation, its number, amount, currency and status, so the business can see which conversations ended in a sale. Not what was bought, your address or your payment details.
The assistant is not designed to ask for sensitive data, such as health information, and businesses agree not to use it for that.
When you deal with us directly
- Your name, email, phone number, business details and what you write to us.
- For business customers, account, dashboard access and billing details.
- Technical data needed to deliver stirel.com and keep it secure, such as IP address and browser type, in server logs. stirel.com sets no advertising cookies. It uses analytics cookies from a web analytics provider only if you accept them on the notice, to see how the site is used; if you decline, no analytics cookie is set and the provider receives only a basic signal of the visit, without recognising your device between visits. Analytics data is kept for 14 months. You can change your choice by clearing this site's data in your browser.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering the person who writes to a business, and showing that business the conversation | We act on the business's instructions. The business relies on its own basis, usually its legitimate interest in answering, or steps you ask for before a purchase. |
| Providing the service to business customers and billing it | Performance of our contract |
| Keeping the service secure, preventing abuse and spam, fixing faults | Legitimate interest in running a safe, working service |
| Replying to enquiries sent to us | Legitimate interest, or steps you ask for before a contract |
| Meeting legal, tax and accounting obligations | Legal obligation |
Where the law of your country requires consent for something, it is asked for first, and you can withdraw it at any time.
Automated replies
Replies are drafted automatically by language models, using material the business provides. The assistant says so on screen, can make mistakes, and passes the conversation to a person when that material does not cover a question. It does not make decisions that have legal or similarly significant effects on you. We do not use message content to train models.
Who we share it with
We use contracted service providers to run Stirel: hosting and network providers, providers of language models that draft replies, speech services that transcribe voice and read replies aloud, messaging platforms such as WhatsApp when that channel is used, and email providers for service notices. They process data only to provide those services to us, under contract. A current list of providers and where they process data is available to business customers on request.
We also share data with professional advisers under confidentiality, with authorities when the law requires it, and with a buyer or successor if our business is transferred, under the same protections. We do not sell personal data or share it for advertising.
International transfers
Data may be processed outside your country, including in Singapore, China, the United States and the European Union. Some of these countries, China among them, have no adequacy decision from the European Commission or an equivalent recognition under your law. Where data leaves the European Economic Area, the United Kingdom or another country that restricts transfers, we rely on the safeguards that law allows, such as standard contractual clauses or the contractual terms of the provider. A business can ask, before it goes live, for its account to use only providers that do not process data in China.
How long we keep it
- Conversations, and contact details left in them: for the period each business sets, 180 days unless it chooses otherwise. Then they are deleted automatically.
- What a visitor looked at in a shop: the same period, inside that business's website.
- Voice audio: not kept.
- Backups: up to 14 days, then destroyed.
- Security logs, including IP addresses: up to 14 days, then deleted.
- Business customer records: for as long as we work together, and afterwards for as long as tax and accounting law requires.
- Enquiries that do not lead to working together: up to 24 months after the last contact.
How we protect it
Stored conversations are encrypted, each business's data is kept apart from every other business's, and access is limited to authorised people who need it. No method of storage or transmission is completely secure. If a breach affects personal data, we tell the business concerned without undue delay and, where the law requires it, the authorities and the people affected.
Your rights
Depending on where you live, you can ask to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw any consent you gave. Deletion is explained on the data deletion page.
Write to support@stirel.com. A person replies, normally within 30 days, and we may need to confirm it is you. If your data reached us through a business that uses Stirel, we pass the request to that business and help it answer.
Depending on where you live
European Economic Area and United Kingdom
The rights above are those of the GDPR and the UK GDPR. You can complain to the data protection authority where you live or work; in Spain, the Agencia Española de Protección de Datos.
Malaysia
We handle personal data in line with the Personal Data Protection Act 2010, as amended. Requests go to support@stirel.com, and complaints can be made to the Personal Data Protection Commissioner.
Singapore
We handle personal data in line with the Personal Data Protection Act 2012. You can ask for access or correction and withdraw consent by writing to our data protection contact, support@stirel.com. Complaints can be made to the Personal Data Protection Commission.
Mexico
This page is our privacy notice under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. You can exercise your ARCO rights (access, rectification, cancellation and opposition) and revoke consent by writing to support@stirel.com. The authority is the Secretaría Anticorrupción y Buen Gobierno.
United States
We do not sell personal information or share it for cross-context behavioural advertising.
Children
Stirel is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has written to an assistant we run, tell us and we will delete it.
Changes
We update this page when the way we process data changes, and change the date at the top. If a change materially affects business customers, we tell them before it applies.