Privacy Policy

3.1 Account and identity data (as controller)

Name, business name, email address, business information you provide, and a password. A phone or WhatsApp number is optional — you may add one during sign-up or later in your profile, and the account works without it; where you do provide one, we store it and may use it for account and service notifications. Passwords are stored only in hashed form and are never accessible in readable form to anyone, including Botvee staff. Date of birth may be collected solely to confirm you meet our minimum age requirement (Section 9).

3.2 Billing data (as controller)

We do not store full payment-card numbers, CVV codes, or bank-account details. Payments are processed by Stripe (PCI-DSS Level 1). We receive limited billing information such as transaction confirmation, amount, billing name, email, and invoice records.

3.3 Technical and usage data (as controller)

IP address, device and browser type, operating system, session identifiers, pages viewed, and referral source, collected when you use botvee.ai and the dashboard.

Approximate location. We derive an approximate country from the IP address. This is country-level only — we do not collect GPS, street address, or any precise location.

Login device recognition. To spot sign-ins from a device you have not used before, we store a device identifier for each login, together with a short description ("Chrome on Windows") and the first and last time it was seen. The identifier is a one-way hash of your browser family and your IP address — the IP itself is not stored in readable form, and the identifier cannot be reversed back into it. You can review and remove your recognised devices in your account security settings.

3.4 Content you upload to train your agent (as processor for the customer)

Documents, FAQs, and website URLs you provide so your agent can answer from your material. To build your agent, Botvee's own crawler fetches and processes the pages you point us to — this runs on Botvee's own infrastructure, and the page content is not handed to a third-party crawling service. This content is used to provide the Service for you and is not shared with unrelated third parties except as needed to provide the Service or to comply with law.

3.5 End-user conversation and interaction data (as processor for the customer)

Messages exchanged between your end-users and your deployed AI agents, interaction timestamps, and session identifiers. Depending on the channels you enable, this may include channel identifiers such as Telegram user IDs, WhatsApp phone numbers, Instagram/Messenger IDs (as those channels become available), and email addresses. Where a visitor sends a voice message, the audio may be transcribed to text using our AI provider. Chat content is processed through our AI provider to generate responses (see Section 4).

3.6 Lead, contact, booking, and order data (as processor for the customer)

Where you enable the relevant features, your agent may collect end-user names, emails, and phone numbers; capture and score leads; store customer notes and tags; book appointments; and — for e-commerce customers — process orders, confirm cash-on-delivery orders, run abandoned-cart, browse-abandonment, back-in-stock, and post-delivery automations, and record courier/delivery tracking details. You control and are responsible for this data as the data controller.

3.7 Behavioural / visitor data (as processor for the customer)

Where you enable visitor tracking and recovery features, the Service may record which pages an end-user viewed, browse sessions, and prior conversation history, so your agent can respond in context and run recovery automations. For each visitor we also record a device category (mobile / tablet / desktop), browser, and operating system, read from the browser's user-agent string, and the approximate country described in Section 3.3.

3.8 Information we derive from conversations (as processor for the customer)

Beyond storing messages, the Service analyses them and keeps what it works out. Where the relevant features are enabled, this includes:

• Remembered facts. Details an end-user states in conversation — such as their name, email address, phone number, or a stated budget — are extracted and stored as persistent facts, so your agent can recall them in a later conversation instead of asking again.
• Conversation triage. Conversations are automatically classified by topic, sentiment (how positive or negative the exchange reads), and priority, so your inbox can be sorted and filtered.
• Lead scoring. An interest or intent score is calculated from the conversation against rules you configure.
• A combined customer profile. Where an end-user can be recognised across visits (usually by email address), their conversations, remembered facts, leads, tickets, orders, bookings, notes, and tags are brought together into a single profile that persists across separate sessions and is shown to your agents in the inbox.

This is profiling. You, as the data controller, decide whether to enable these features and are responsible for telling your end-users about them and for having a lawful basis; the profile is confined to your own workspace and is never combined with another customer's data.

3.9 Integration data (as processor / controller as applicable)

Where you connect a third-party integration (for example, Google, Shopify, WordPress, or a messaging channel), we process the access tokens and the data necessary to operate that integration, which are stored in encrypted form.

Connected mailboxes. If you connect an email account (Gmail or an IMAP/SMTP mailbox) to an agent, Botvee reads the messages arriving in it so they can appear in your inbox and be answered — including sender address, subject, body, and attachments. Only the mailbox you connect is read, you choose which agent it belongs to, and disconnecting it stops the reading.

3.10 Partner Programme data (as controller)

If you apply to the Partner (affiliate) Programme, we collect and store the information you submit — your country, how you intend to promote Botvee, your promotional link or channel, a description of your audience, and your reason for applying — together with your referral code, recorded clicks and sign-ups attributed to it, and your commission balance and payout records.

3.11 Information we do not collect

We do not seek to collect special categories of personal data (such as health, religious, biometric, or racial/ethnic data). Customers must not configure agents to collect such data without a lawful basis and safeguards (see our Acceptable Use Policy). We do not knowingly collect personal data from children (Section 9).

9.1 Ages 14–17 — only with verified parental consent

A person aged 14 to 17 may hold an account only if a parent or legal guardian has given us verifiable consent first. Without that consent the account is not permitted, and we will close it when we find out.

To give consent, the parent or guardian emails privacy@botvee.ai with the subject "Parental Consent — [account email]" and provides:

• their own full name and contact details;
• reasonable proof of identity; and
• reasonable proof that they are the minor's parent or legal guardian.

We aim to review such requests within 14 calendar days. Until consent is verified, the account is treated as not permitted.

A consenting parent or guardian keeps control. At any time they may ask us for a copy of the minor's data, have it corrected, have it deleted, have the account transferred into their own name, or withdraw consent — and withdrawing consent closes the account.

9.2 Tell us about a child's account — we will close it

If you believe an account belongs to a child, tell us and we will act. Email privacy@botvee.ai with whatever you know — the account email is enough, and you do not have to prove anything or explain who you are.

On a credible report we suspend the account immediately, while we look into it. If it turns out to belong to someone under 14, or to someone aged 14–17 with no verified parental consent, the account is closed and the personal data in it is deleted. We do not require the person who reported it to justify the report, and we do not tell the account holder who reported them.

9.3 No marketing or non-essential tracking of minors

We do not knowingly send marketing to anyone we know to be under 18, and we do not knowingly set non-essential technologies for a user we know to be a minor.

9.4 Your own end-users

Where a customer's own end-users are minors, responsibility for handling their data lawfully — including any consent their local law requires — rests with that customer as the data controller, not with Botvee.

How to Make a Request

Email privacy@botvee.ai with subject "Privacy Rights Request — [Jurisdiction] — [Account Email]". We acknowledge within a reasonable time and respond within the period required by applicable law (generally 30 days; 45 days for CCPA; extendable where the law permits for complex or numerous requests, in which case we will inform you). We may verify your identity. No charge applies unless a request is manifestly unfounded, excessive, or repetitive.