Privacy Policy

1. Scope

This Policy explains what personal data the operator of Botsay, the service at botsay.net (“Botsay”, “we”), collects, why, who receives it and what your choices are. It applies to the website, the app and our emails. In short: we keep what the Service needs to work, we sell nothing, and no AI model is trained on it

It covers two groups: you as a user of the Service, and your audience — the people who message your connected accounts. For your audience’s data you are the controller and we act on your instructions; see section 4

Questions and requests: support@botsay.net. Operator: Velihosha Yurii Vasylovych, a sole proprietor in Ukraine

2. Data we collect

Depending on the features you use, we keep:

• Account: email, password (our authentication provider keeps it only as a hash), interface language and theme, and — for security — your IP address, browser, time zone and the time you were last active. If you sign in with Google, Google shares your name, email and profile picture with us; we use them only to sign you in
• Payments: order number, amount, currency, status, payment method type and the provider’s transaction reference. Card numbers and wallet keys never reach us
• Connected channels: the account you connect and the authorization you grant through Meta’s official API, your business profile, and the conversations your agent takes part in — the comments and messages it sends and receives, the name and username of the person writing, and the fields, tags and notes you keep about your contacts. This is what your inbox and contact list are made of
• Knowledge: texts, FAQ pairs, files and links you upload and the text we extract from them
• Integrations: your own AI key, if you connect one (encrypted at rest and used only for your requests), and the Telegram chat ID and username you link for notifications
• Technical: ordinary server logs — address, time, page and error — kept to keep the Service secure and working
• First visit: the site you came from, the page you landed on, its UTM tags and the time. We add this record to your account when you sign up

We receive this data when you enter it, when Instagram, Telegram or a payment provider sends it to us through their APIs, or automatically when you use the Service

3. Why we use it

We use the data to:

• provide the Service under our contract with you: run your agent, send and receive messages, keep your contacts and knowledge, bill you;
• keep the Service secure and fair: prevent fraud and abuse, enforce limits, investigate incidents (our legitimate interest);
• send service emails: sign-in, password reset, payment status, changes to the Terms or this Policy;
• comply with the law: accounting records, lawful requests from authorities, defence of our rights;
• improve the Service using aggregated statistics that do not identify anyone;
• see which sites and ads bring us users: first-visit records and the Meta and Google pixels (your consent in Europe, our legitimate interest elsewhere)

We do not sell personal data. Your content and your audience’s messages never go into advertising or AI model training. Where consent is the legal basis, you can withdraw it at any time without affecting earlier processing

4. Your audience’s data

When your agent talks to people, we process their data on your behalf and on your instructions: you are the controller, we are the processor. You are responsible for informing your audience, for having the right to message them and for what you ask them

This section is our data processing agreement. We process audience data only to provide the Service, keep it confidential, apply the security measures in section 8, engage only the subprocessors listed in section 5, help you answer requests from your audience, and delete the data when you delete it or your account. If a member of your audience contacts us directly, we refer them to you

5. Who receives data

Providers that help us run the Service receive only what they need for their task:

• Cloud database and authentication provider — stores your data and handles sign-in; data is kept in the EU
• Hosting provider — runs the application in the EU
• Meta Platforms — Instagram: data flows under your Instagram authorization and Meta’s terms
• AI model providers — the provider whose model answers receives the conversation and the parts of your materials needed to answer, under its API terms. For a flow with an AI trigger, each incoming message goes to a model that decides whether the flow starts. With your own key, the provider you chose processes requests under your contract with it
• Telegram — delivers notifications to the account you link
• Payment providers — the card acquirer and the cryptocurrency payment provider receive the data needed to process your payment
• Bot protection provider — checks the sign-in, sign-up and password reset forms for bots and receives technical data from your browser, such as your IP address
• Email delivery provider — delivers the emails we send you
• Meta and Google — when we measure our ads, their pixels on our website receive the pages you open, technical data from your browser and their cookie ids, and process them under their own privacy policies

We also disclose data when the law requires it, to defend our rights, to our professional advisers, and to a successor if the business is transferred. Some providers are outside your country and the EEA, including in the United States; where the law requires, we rely on standard contractual clauses or equivalent safeguards. The current list of providers is available on request at support@botsay.net

6. Instagram data

We receive Instagram data only through Meta’s official API after you authorize the connection, and use it solely to run your agent inside your account. We do not sell it, share it for advertising or use it for any other purpose

Turning an account off in the app stops the agent on it; deleting the account removes its flows, contacts and conversations at once. You can also revoke the connection in your Instagram settings under Apps and websites. Of a deleted account we keep only its Instagram id and the date, so that one Instagram account gets one free trial

7. Retention

We keep data only as long as needed:

• account, knowledge, channels, conversations and contacts — while your account exists, or until you delete them in the app;
• after account deletion — removed within 30 days; copies in backups are overwritten within a further 30 days;
• payment records — for the period required by accounting and tax law;
• technical logs — for a short period needed for security and debugging

8. Security

Data travels over encrypted connections. Access to stored data is restricted per account. Keys, tokens and other secrets are encrypted at rest. Payments are handled by the providers on their pages; we never store card data

No system is completely secure. Keep your password unique and do not share your account. If a breach affects you, we notify you as the law requires

9. Cookies and local storage

If you are in the EU, EEA, UK or Switzerland, the first-visit record from section 2 and the Meta and Google pixels start only with your consent; elsewhere they start at once. Change your choice at any time: a refusal removes them from your browser. Your browser also keeps your session, theme, language and other app settings; clearing its storage signs you out

10. Your rights

You can access your data, correct it, receive a copy, delete it, restrict or object to its processing, and complain to a data protection authority. Email, password, language and theme you change in Settings; contacts, knowledge and channels you delete in the app. For everything else, including deleting the account, write to support@botsay.net from your account email

We may ask you to confirm your identity and answer within 30 days. We can refuse requests that are unfounded, excessive or would breach the rights of others or the law

11. Changes

We may update this Policy. The current version at botsay.net/privacy applies from the date shown at the top. We announce material changes by email or in the app; continued use after that means you have read the updated Policy