Privacy policy

What we collect from you

Your email address, your name if you give one, and your password as a bcrypt hash — we cannot read it and cannot tell you what it is.

The websites you point agents at, and the content we crawl from them.

What we collect from your visitors

The messages they send, the page they were on, their browser’s language, and an anonymous id stored in their own browser so a conversation survives a page change.

Their IP address is used to rate-limit abuse and is stored only as a keyed hash. We cannot recover the original address from it.

An email address, only when a visitor types one in to get a reply.

If your website calls BotBuddy.identify(), whatever you pass it — typically a name, email or plan. That is your choice and your responsibility to disclose to your own users.

What we do not do

We do not sell data. We do not use your conversations to train models. We do not run advertising or third-party trackers inside the widget.

The widget runs in an isolated frame that cannot read the page it sits on — it cannot see your visitors’ form fields, cookies or session.

Where it goes

Your content is sent to whichever language-model provider is configured for your account so it can produce an answer. It is sent for that request and is not retained by us beyond the conversation record.

Email is delivered through a transactional email provider. Nothing else leaves our infrastructure.

How long we keep it

Conversations and tickets stay until you delete them or delete your account. Operational logs are pruned after 30 days.

Deleting your account deletes every agent, conversation, ticket and piece of learned knowledge. It is immediate and cannot be reversed — we do not keep a copy to restore from.

Your rights

Export, correction and deletion are available from Settings, or by emailing support@botbuddy.ai. Deletion is self-service and does not require our involvement.