EstelleSecurity & data
Plain English on where your visitors' data goes and how it's handled — no jargon, nothing hidden.
Where everything runs
Estelle is built on Supabase (database and authentication) and hosted on Vercel — both established infrastructure providers used by production applications well beyond this one, rather than anything self-hosted or bespoke. Every connection to the widget, your dashboard, and the admin area is encrypted in transit (HTTPS) end to end.
Your data stays yours
Each agency's data is kept isolated at the database level — one agency can never see another's leads, conversations, or settings. You remain the data controller for your own visitors' enquiries; Estelle simply processes and delivers them on your behalf. Full detail is in our agency privacy policy.
How Claude (the AI) fits in
Visitor messages are sent to Anthropic's Claude API to work out what's being asked and generate a reply — that's the core of how Estelle understands a conversation. Under Anthropic's standard commercial API terms, that data is not used to train their models. It isn't shared with any other AI provider, and Estelle never sends it anywhere beyond what's needed to answer that message and email your team the finished lead.
No selling, no ad trackers
Visitor data collected through the widget is never sold, and never shared with advertisers or data brokers. Lead emails go to your team (and your CRM, if you've connected one) — that's the entire distribution list.
Straight answer on compliance
We haven't gone through a formal certification process like ISO 27001 or SOC 2 — being upfront that this is a young product built by a very small team, not implying an audit that hasn't happened. What's true today is what's written on this page. If a specific compliance question matters for your agency, ask and we'll give you a straight answer.