1. Who we are
This policy explains how Chameleon Mode Ltd, trading as Chameleon Hive ("we", "us", "our"), collects and uses personal data. We are the data controller for the personal data described here. Our registered details are at the end of this policy.
If you have any questions, contact us at support@chameleonhive.com.
2. What data we collect
Account data. When you create an account: your name, email address, and login credentials.
Payment data. When you subscribe, your billing details are handled by our checkout and subscription provider, PayKickstart, which processes payment through its supported gateways. We do not store your full card details ourselves.
Profile data held for your account. So that your profiles are available on any computer you sign into with your licence, your profile information is stored on Amazon Web Services and encrypted. This includes any sign-in details you have saved to a profile for the third-party websites you use in it. It does not include your cookies. This data is kept while your account is active, and for 90 days after cancellation so that you can return without rebuilding your setup, after which it is deleted.
Team sharing transfers. Separately, when you choose to share a profile with a team member, virtual assistant or outsourcer, that transfer passes through our Amazon Web Services infrastructure encrypted. A shared transfer can include the cookies, bookmarks and saved third-party sign-in details belonging to that profile. The data is deleted from our infrastructure once the transfer completes, so no copy of a shared transfer is retained. Sharing is an action you choose, not something that happens automatically.
Your Chameleon Hive account credentials are never shared through this process. A team member works under their own licence, which the account holder creates and manages, rather than signing in as you.
In both cases we do not read, access or analyse the contents of your profiles.
Usage data. Information collected automatically through our analytics tools, Google Analytics and Microsoft Clarity, which may include page views, session and interaction data such as clicks and scrolling, device and browser type, and IP address.
Support data. If you contact support, the content of your messages and your contact details.
Cookie data. See our Cookie Policy for detail.
3. Why we use it, and our legal basis
Under UK GDPR and EU GDPR we must have a lawful basis for each use:
- To provide the product and your account: performance of our contract with you.
- To take payment and manage subscriptions: performance of our contract.
- To sync your profile data across devices, when you choose to use that feature: performance of our contract with you, since it's a feature of the service you've subscribed to.
- To improve and secure the product: our legitimate interests in running and protecting the service.
- To send service messages (billing, security, changes): performance of our contract and legitimate interests.
- To send marketing, where applicable: your consent, which you can withdraw at any time.
- To meet legal obligations: compliance with law.
4. Who we share it with
We share personal data only with:
- Sub-processors who help us run the service: PayKickstart (checkout and subscription billing), Amazon Web Services (encrypted storage of your profile data, and the infrastructure used for team sharing transfers), uPress (website hosting), Google Workspace (email and productivity), Auth0 (account authentication and licence verification), and Google Analytics and Microsoft Clarity (site analytics). Each has a data-processing agreement in place covering their handling of personal data.
- Advertising partners, where you consent to marketing cookies, who receive limited browsing data through conversion tracking pixels used to measure the performance of our advertising. This only happens if you accept marketing cookies. See our Cookie Policy for detail.
- Authorities, where we are legally required to disclose.
- A buyer or successor, if the business is sold or reorganised.
We do not sell your personal data.
5. International transfers
Some of our suppliers are located outside the UK and EEA, or are owned by companies that are, which means your personal data may be processed in or accessed from other countries, including the United States. This includes Amazon Web Services (profile data storage and team sharing transfers), uPress (website hosting), Auth0 (authentication and licensing), Google Workspace, Google Analytics, Microsoft Clarity, and PayKickstart (payments). If you consent to marketing cookies, our advertising partners may also process limited data outside the UK and EEA. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards recognised under UK and EU data protection law, namely the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, as applicable to each provider. You can ask us for more detail about the safeguards that apply to a specific transfer by contacting us at support@chameleonhive.com.
6. How long we keep it
Profile data held for your account is kept while your account is active and for 90 days after cancellation, then deleted. Team sharing transfers are not retained at all, they are deleted from our infrastructure once the transfer completes. Account data follows the same 90-day period as profile data, so you can return within that window without losing your setup. Billing and payment records are retained in accordance with PayKickstart's own data retention terms. Support conversations are handled in real time through live chat rather than kept as a separate ticket archive. If you're on our email list, we keep your details until you opt out.
7. How we protect it
We rely on the security measures built into the infrastructure and service providers we use, including AWS, uPress, Auth0, Google, and PayKickstart, each of whom applies encryption and access controls to the data they process on our behalf. No system is completely secure, but we take reasonable steps to protect your data.
8. Your rights
See our GDPR and Your Data Rights page for the full list and how to exercise them.
9. Children
Chameleon Hive is not intended for anyone under 16. We do not knowingly collect data from children.
10. Changes
We may update this policy. We'll post the new version here with an updated date and, for material changes, notify you by email.
11. Contact
Chameleon Mode Ltd, 2 Hartfield Close, Elstree, Hertfordshire, WD6 3JD, United Kingdom. Email: support@chameleonhive.com. We have not appointed a Data Protection Officer, as we're not required to at our current size and scale.
You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.