Privacy policy

1. Who is responsible

The controller of personal data described in this policy is the administrator of the chatbotwidget.ai service (“we”, “us”). You can reach us about any privacy matter at [email protected].

This policy covers data of people who visit chatbotwidget.ai, try the demo, create an account or buy a plan. It also explains our role for the conversations that visitors have with chatbots our customers place on their own websites.

2. Two roles, controller and processor

We are the controller for account data, billing data, demo data and data about visits to chatbotwidget.ai.

We are a processor for conversations, leads and other data collected by a customer's chatbot on the customer's website. In that case the customer (the website owner) is the controller and decides why and how visitor data is used. We process it only on the customer's instructions and under a data processing agreement. If you chatted with a bot on another company's website, please contact that company first. We will pass on any request we receive about such data.

3. What data we collect

• Account data: email address, password (stored only as a hash), name if you give it, workspace name, team members you invite and their roles.
• Billing data: plan, billing period, invoices, billing name and address, tax number if you give one. Card details are entered on the payment processor's page and we never see the full card number.
• Content you connect: the website address, the pages and files the bot reads, bot settings, actions and their configuration.
• Demo data: the website address you type into the demo and the questions you ask the demo bot.
• Technical data: IP address, browser type, pages requested and timestamps in server logs, used for security, rate limits and fixing errors.
• Correspondence: the emails you send to us and our replies.

4. Why we use it and on what legal basis

Purpose	Legal basis (GDPR)
Creating and running your account, building and serving your bots	Performance of a contract, Art. 6(1)(b)
Billing, invoices and accounting records	Legal obligation, Art. 6(1)(c)
Running the demo you request	Performance of a contract or steps before one, Art. 6(1)(b)
Security, abuse prevention, rate limits and error logs	Legitimate interest, Art. 6(1)(f)
Service emails such as sign-in codes, limit notices and billing notices	Performance of a contract, Art. 6(1)(b)
Answering your emails	Legitimate interest, Art. 6(1)(f)
Defending or pursuing legal claims	Legitimate interest, Art. 6(1)(f)

We do not use your data or your connected content to train language models. We do not sell personal data and we do not use it for advertising.

5. Who receives the data

We share data only with service providers who help us run the service, each bound by a data processing agreement and allowed to use the data only for that purpose. By category, they are:

• a hosting provider located in the EU or the US, which stores the service and its database;
• a language model provider, which receives the visitor question and relevant source passages to write a reply, without the right to keep them for training;
• a payment processor, which handles card payments;
• an email delivery provider, which sends sign-in codes and service emails;
• accounting and legal advisers, where needed for our legal obligations.

We may also disclose data to public authorities when the law requires it.

6. Transfers outside the European Economic Area

Some providers may process data outside the EEA, for example in the United States. In that case we rely on an adequacy decision of the European Commission (such as the EU and US Data Privacy Framework) or on the Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the safeguards at the address above.

7. How long we keep it

• Account data and connected content: for as long as the account exists. When you close the workspace, its data is deleted, apart from backups that expire on their normal cycle.
• Conversations and leads from your bots: until you delete them or close the workspace.
• Demo data: deleted automatically after 7 days.
• Invoices and accounting records: for the period required by tax law.
• Server logs: for a short period needed for security and error analysis.

8. Your rights

You have the right to access your data, to have it corrected, to have it deleted, to restrict its processing, to data portability and to object to processing based on legitimate interest. Write to [email protected] from the email address connected to your account. We answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

Giving us your email is needed to create an account. Other data is optional, though without it some features (for example invoices with your company details) will not work.

9. Security

Data is encrypted in transit and at rest, access inside a workspace is limited by roles, and connection secrets for actions are stored encrypted. More detail is on the security page.

10. Cookies

We use only cookies that are needed for the site to work. They are listed in the cookie policy.

11. Automated decisions

We do not make decisions about you that produce legal effects based solely on automated processing. A chatbot reply is information, and every bot offers a way to reach a person.

12. Changes

When this policy changes, we publish the new version here with a new effective date. Material changes are also announced to account holders by email.