Law Enforcement & Authorities Guidelines
Version 1.0 · Effective 22 September 2026 · Last reviewed 22 September 2026
In short
This page tells UK police forces, the National Crime Agency, the courts, Ofcom, the Information Commissioner's Office and authorities abroad how to request information from ChatNow, what we hold and for how long, and how we handle emergencies. Requests go to legal@chatnow.fr from an official domain with the legal basis attached. We hold little: guest content is deleted 24 hours after the guest leaves, connection logs are kept for 12 months, and webcam streams, card details and identity documents never pass through our systems. We notify users of requests unless the law, or a real risk to someone's safety, prevents it.
1. Who may use this page
These guidelines are for UK police forces, the National Crime Agency (NCA), HM courts and tribunals, Ofcom, the Information Commissioner's Office (ICO) and other UK public authorities with statutory powers, and for overseas authorities acting through the channels in section 4. Section 13 covers private parties. All requests concerning users must be addressed to Skyline Online LLC, the operator of ChatNow and the controller of its data. Our hosting providers, Contabo GmbH and Hetzner Online GmbH, have no access to or authority over user data and will refer any request to us.
2. How to send a request
Email legal@chatnow.fr from an official domain (police.uk, gov.uk, nca.gov.uk, ofcom.org.uk, ico.org.uk or equivalent). We do not act on requests made by telephone, from personal email accounts or through social media. A request should include:
- the requesting authority, the officer's name, rank or role, collar or staff number, and a direct contact;
- the legal basis, with the instrument attached (section 3) and the case or crime reference;
- the identifiers you have: username, date and time with time zone (essential, since guest data is deleted after 24 hours), room or conversation, IP address if known;
- the specific categories of data sought and the date range; over-broad requests are returned for narrowing;
- whether the request is urgent and why, and how you wish to receive the response securely.
We acknowledge requests within two working days and respond in writing from legal@chatnow.fr. Postal address for formal service: Skyline Online LLC, 1209 Mountain Road Place NE, Ste N, Albuquerque, NM 87110, USA; please send a copy by email, since post takes longer to reach us.
3. Legal bases we act on
- Court orders: production orders under Schedule 1 to the Police and Criminal Evidence Act 1984, disclosure orders, witness summonses and other orders of a UK court, served in the ordinary way.
- Communications data: notices and authorisations under Part 3 of the Investigatory Powers Act 2016, served through the requesting body's single point of contact.
- Crime-prevention disclosure requests: requests relying on paragraph 2 of Schedule 2 to the Data Protection Act 2018 (prevention or detection of crime, apprehension or prosecution of offenders). Such requests are voluntary on our part: we assess each one for necessity and proportionality, disclose only what is needed, and may ask for a court order instead. We do not disclose the content of private messages on this basis except in an emergency (section 8).
- Regulators: information notices from Ofcom under section 100 of the Online Safety Act 2023 and from the ICO under section 142 of the Data Protection Act 2018, and other statutory requests from UK regulators.
Every disclosure is logged with its legal basis, the data released and the recipient.
4. Requests from outside the United Kingdom
Authorities outside the United Kingdom should proceed by mutual legal assistance through the UK Central Authority at the Home Office, or, where it applies, under the UK–US Data Access Agreement and the Crime (Overseas Production Orders) Act 2019. We do not act on direct requests from overseas authorities except in the emergency circumstances described in section 8, which are open to any bona fide authority.
5. What data exists and for how long
The table summarises what ChatNow holds; the retention section of the Privacy Policy is authoritative. Data past its retention period is deleted and cannot be produced.
| Category | What it contains | Retention |
|---|---|---|
| Guest session and content | Username, gender, age, city; public and private messages, uploaded images, voice notes | Deleted 24 hours after the guest leaves |
| Registered account | Email address, hashed password (not reversible), date of birth, gender, profile bio, photos, contacts list | Until the member deletes it; anonymised within 30 days of account deletion |
| Member content | Public and private messages, uploaded images, voice notes | Until deleted by the member or the account is deleted |
| Connection logs | IP address, connection timestamps, device identifier, session ID | 12 months |
| Moderation records | Reports, decisions, sanctions, evidence snapshots of removed content | 12 months; permanent-ban lists 3 years |
| CSEA reports to the NCA | Report reference; the reported content and associated account and log data | Reference 5 years; content and associated data 12 months (Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026) |
| Age-check result | Yes/no only | Current session only |
| Premium transactions | Transaction ID, amount, currency, plan, date (no card data) | 6 years |
| Support correspondence | Emails and form submissions | 24 months |
6. What we do not hold
- Webcam and voice recordings. Live streams are relayed in real time and are never recorded or stored.
- Card data. Payments are processed by a PCI-DSS certified processor; we never receive card numbers.
- Identity documents, photographs or age estimates. Age assurance is performed by AgeVerif under a double-anonymity design; we receive only a yes/no result and cannot obtain the underlying data.
- Guest contact details. Guests give no email address or telephone number.
- Precise location. We hold the city a user declared and the IP address recorded in the connection log, nothing more.
- Verified real names. We do not verify identity; a profile name is whatever the user typed.
7. Preservation requests
On written request from an authority to legal@chatnow.fr identifying the account or content concerned, we preserve the specified data for 90 days pending receipt of a valid legal instrument, renewable once for a further 90 days. Preservation suspends deletion; it does not disclose anything. We confirm in writing what has been preserved. Because guest data is deleted 24 hours after the guest leaves, a preservation request concerning a guest must reach us within that window.
8. Emergency disclosure
Where there is an imminent risk of death or serious physical harm to any person, including a threat to life, a person at risk of suicide or a child in danger, email safety@chatnow.fr with the subject "EMERGENCY" and copy legal@chatnow.fr. This route is staffed 24 hours a day. State the nature of the emergency, why ChatNow data is needed to address it, the identifiers you have and an officer's direct contact. We disclose the data necessary to address the emergency without waiting for a court order, relying on paragraph 2 of Schedule 2 to the Data Protection Act 2018 and Article 6(1)(d) of the UK GDPR, and ask the requesting authority to confirm the request in writing afterwards. Every emergency disclosure is logged and reviewed by the Head of Trust & Safety.
9. User notification
We tell registered users when their data has been requested, before disclosure where possible and otherwise afterwards, unless:
- notification is prohibited by law or by the order itself;
- the request is an emergency under section 8;
- notification would endanger a person, in particular in child-safety, intimate-image or threat-to-life cases, or would lead to the destruction of evidence;
- the account has been terminated for child sexual exploitation or abuse content.
Where a prohibition is time-limited, we notify the user when it lapses. Guests cannot be notified because we hold no contact details for them.
10. Our proactive reporting
- Child sexual exploitation and abuse. As section 66 of the Online Safety Act 2023 and the 2026 Regulations require, all detected CSEA content is reported to the National Crime Agency through its CSEA Industry Reporting Portal, with the content and associated data preserved as the 2026 Regulations require. Uploaded images are hash-matched against known material through Project Arachnid; matches result in an immediate permanent ban and, where relevant, a report to the Internet Watch Foundation.
- Threats to life. Credible threats of serious violence or of suicide that we identify are referred to the police, with the data needed to locate the person concerned.
- Intimate images. Intimate images shared without consent are removed within 48 hours of a valid report and hash-matched against StopNCII.org hashes; evidence is preserved for any police investigation the victim chooses to pursue.
11. Cooperation with Ofcom and the ICO
The individual accountable for ChatNow's online safety compliance is Gérald A., Head of Trust & Safety. Ofcom may write to legal@chatnow.fr or safety@chatnow.fr; information notices are answered in full within the period they specify. The ICO may contact us at privacy@chatnow.fr or through our UK representative under Article 27 of the UK GDPR, DataRep, 107-111 Fleet Street, London EC4A 2AB, United Kingdom; personal data breaches are notified to the ICO within 72 hours where required. Details of how we meet our duties are in Online Safety at ChatNow.
12. Costs, format and transparency
We do not charge UK authorities for responding to lawful requests in the ordinary course. For exceptionally voluminous or technically demanding requests we may seek reasonable costs where the law permits, and we say so before doing the work. Responses are provided as exported records (plain text, CSV or PDF) by encrypted email or another secure channel you specify; a witness statement can be provided for court use.
We publish the number of requests received, by type and outcome, in our annual Transparency Report. We do not publish details of individual requests.
13. Civil litigants and private parties
We do not disclose information about a user to private individuals, companies, solicitors or insurers without a court order that binds us, such as a disclosure order made by the High Court against a party mixed up in wrongdoing. Applications should be served on legal@chatnow.fr and by post at the address in section 2; we may ask the court to provide for our reasonable costs of compliance. If your concern is a defamatory statement, the procedure in Defamation Complaints may resolve it without a court application; if it is content that breaks our rules, use Report content.