Privacy policy
1. Who we are
This policy covers the website botnow.site, the dashboard, the chat widget and related communication. The operating company is named in the footer of the site and will be listed here with its address and a contact address for data requests.
2. Our two roles
- Controller for the data of our customers (store owners), of visitors to this website, of people who write to us, and of people who try the demo.
- Processor for the data of visitors who talk to a bot on a customer’s store: conversations and leads. The store decides why and how that data is used; we process it on the store’s instructions. If you are a store visitor and want to exercise your rights, contact the store; we will help it respond.
3. Data we process
Customers: email address, a hash of the password (we never store the password itself), registration date and consent records, the site address and bot settings, plan and payment status.
Store visitors (as processor): the text of chat messages and their time; a name, phone number or email if the visitor leaves them in the lead form; a technical chat session identifier stored in the browser on the store’s site; an IP address, used only to limit request rates and prevent abuse.
Visitors to botnow.site: server logs (IP address, browser, time, requested page). We do not run advertising trackers. We use Google Analytics to count visits: pages viewed, source of the visit, approximate location, device and browser type. It is on by default; you can decline in the cookie banner or later with “Cookie settings” in the footer, after which it is no longer loaded and its cookies are removed.
Demo without registration: the address typed in, the result of reading that site’s public pages, messages in the demo chat and the IP address. Demo data is deleted automatically after 24 hours.
We do not knowingly process special categories of personal data or data of children.
4. Why we process it and on what basis
| Purpose | Basis |
|---|---|
| Registering and running your account, providing the service | Performance of a contract |
| Running the bot on your site: answers, leads, handing the chat to an operator | Processing on your instructions (as processor) |
| Service emails about your account and plan | Performance of a contract |
| Replying to your messages | Your request; legitimate interest |
| Security, rate limiting, investigating faults | Legitimate interest |
| Visit statistics with Google Analytics | Legitimate interest; you can object at any time in the cookie banner |
We do not take decisions with legal effect about a person solely by automated means, and we do not sell personal data.
5. Language model provider
To answer a visitor, the service sends the visitor’s question and the found fragments of the store’s pages and catalog to an external language model provider (currently DeepSeek). Personal data in the message is masked first by an automatic filter, which is not exhaustive. Contacts from the lead form are never sent. The provider may process data outside your country.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data (email, settings) | While the account exists; export is available for 30 days after deletion, then it is deleted |
| Conversations and leads | While the contract with the customer lasts, and up to 30 days after it ends; a specific visitor’s data is deleted on the store’s request within 10 business days |
| Demo data | 24 hours |
| Server logs | Up to 30 days |
| Login session (cookie) | 30 days or until log out |
7. Who we share data with
Only service providers that need it for their task: hosting, the language model provider, an email delivery service, Google (Google Analytics; it may process data in the United States and other countries) and (once connected) a payment provider. Authorities receive data only where the law requires it. The final list of providers and their locations will be published before launch.
8. Cookies and browser storage
| Name | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you logged in to the dashboard. Not readable by page scripts and not used for advertising | 30 days or until log out |
| bn_theme (browser storage) | Remembers light or dark theme | Until you clear it |
| Chat session id (browser storage on a store’s site) | Keeps the conversation history when the visitor returns | Until the visitor clears browser data |
| bn_cookie_ga (browser storage) | Remembers your choice in the cookie banner | Until you clear it |
| _ga, ga* (Google Analytics cookies) | Distinguish visitors and sessions for visit statistics. Not set if you decline in the cookie banner | Up to 2 years |
We use no advertising cookies. You can change your choice at any time with “Cookie settings” in the footer.
9. Security
HTTPS everywhere; passwords and session keys stored as hashes; the session cookie is not readable by scripts; requests that change data are protected against forgery from other sites; each customer sees only their own bots, conversations and leads; the widget works only on the store’s domain; request and login attempts are rate-limited; we never receive payment card numbers.
10. Your rights
Depending on where you live (for example under GDPR in the EU and UK), you may ask to access, correct, delete or restrict the use of your data, to object to processing, to receive it in a portable form, to withdraw consent and to complain to your data protection authority. Contact us at the address published on the Contact page, and we will answer within the period required by law. Requests about store conversations are passed to the store.
11. Changes
We may update this policy. The new version applies from publication on this page, and we notify customers by email of material changes.