Privacy Policy

Controller (for BotBly account, billing, marketing, site analytics): BotBly.
Processor (for your end-user conversations and content handled by your chatbot): BotBly acts on your instructions under a Data Processing Addendum (DPA).

A. Information You Provide (Controller context)

• Account & profile: name, email, SSO identifiers, organization, role.
• Billing: payment method, billing address, tax IDs (processed by our payment provider).
• Support & communications: messages, tickets, survey responses.

B. Information We Process for You (Processor context)

• End-user chat data: prompts, responses, and metadata (timestamps, channel, language).
• Authorized content: website URLs you submit for scraping; files, FAQs, and other materials you upload or integrate.
• Configuration data: bot settings, intents, routing rules.

You must have the right to provide or authorize access to any content or URL you connect.

C. Automatically Collected

• Usage & device data: IP address, device/OS/browser, pages viewed, referring URLs, performance metrics.
• Cookies/SDKs: strictly necessary cookies for auth and security; optional analytics/functional cookies (see Cookies & Tracking).

A. As Controller (our own purposes)

• Provide, secure, and maintain the Services
• Onboarding, authentication, and customer support
• Billing, invoicing, fraud prevention, compliance
• Service analytics and product improvement (aggregate/de-identified where possible)
• Communicating service updates and transactional notices
• Marketing (with consent where required)

Legal bases (EEA/UK): performance of contract, legitimate interests (security, service analytics, product improvement), consent (non-essential cookies/marketing), and legal obligations.

B. As Processor (for your end users)

• Process end-user chats and content strictly per your configuration and instructions
• Generate analytics and reports for you (e.g., unresolved questions, suggested improvements)
• Route data to third-party providers or integrations you enable

We use service providers to operate the Services, such as LLM/AI providers, cloud hosting and storage, payment processors, email delivery/support tools, and analytics/monitoring. Where feasible, we require providers to protect data and use it only to deliver their services to us. Some providers maintain their own terms and privacy notices; data sent to them may be processed in line with those documents. You control which optional integrations you connect.

We use third-party providers (e.g., LLM/AI, hosting, analytics, payment processing). A current list of providers is available upon request.

• End-user conversations (chat logs): retained 30 days by default, then deleted from active systems or anonymized, unless a longer period is necessary for legitimate business or legal purposes.
• Account/billing records: retained as required for accounting, tax, and compliance (commonly 7 years).
• Product analytics/telemetry: typically 12–24 months in aggregate or de-identified form.
• Support tickets: typically 24 months.
• Security logs: typically 12 months.

We may retain minimal information as needed to comply with law, resolve disputes, or enforce agreements.

We may transfer, store, and process data in countries other than where it was collected (including the United States). Where required, we use appropriate safeguards such as Standard Contractual Clauses (SCCs), data processing agreements, and technical/organizational controls.

Depending on your location, you may have rights to:

• Access, correct, or delete personal information
• Port your data
• Object to or restrict certain processing
• Withdraw consent (where we rely on consent)
• Lodge a complaint with a supervisory authority

If you are an end user of a BotBly customer: contact that business first. If we receive a request where we act as Processor, we will forward it to the relevant customer (Controller).

• Strictly necessary: authentication, security, service continuity.
• Functional/analytics: understanding usage and improving performance.
• Marketing: only with consent, if used.

You can control cookies via browser settings and, where available, our cookie banner or preferences center. Disabling certain cookies may affect functionality.

We implement technical and organizational measures designed to protect personal information, including encryption in transit, access controls, least-privilege practices, and monitoring. No method of transmission or storage is completely secure.

The Services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided data, contact support@botbly.com and we will take appropriate action.

• Provide only content and URLs you have the right to use or authorize us to process.
• Configure your chatbot and notices to meet your legal obligations toward your end users (e.g., consent where required, privacy notices).
• Avoid inputting sensitive personal data unless the law allows and appropriate safeguards are in place.

We may update this Policy from time to time. We will post updates here and adjust the “Last updated” date. For material changes, we will provide additional notice as required by law. Continued use of the Services after changes take effect means you accept the updated Policy.

Questions or requests about this Policy can be sent to: