Data and privacy
The bot talks to shoppers, and shoppers sometimes type a name, phone number or address into the chat. This page describes which data passes through the service and who is responsible for what. It is not legal advice: have the data flow of your store reviewed by a lawyer.
What the bot sees on your site
Only public pages: those that open without logging in. The robot follows robots.txt, doesn’t enter customer accounts and doesn’t bypass protection. Any site owner can block it, as described on the BotNow robot page.
Which data passes through the service
| Data | Where it goes |
|---|---|
| Content of the store’s pages and catalog | The bot’s knowledge base. This is public information of the store. |
| A shopper’s question in the chat | The language model, together with the found fragments of the catalog and pages, to compose an answer. The store owner sees the conversation history. |
| Name and phone from the lead form | Stored in the service and shown to the store owner. Not sent to the language model. |
| IP address | Used to limit the request rate and to protect against abuse. |
Who is responsible for what
For the personal data of shoppers, the store is the data controller: it decides why and how the data is processed. BotNow acts as a processor on the store’s behalf. The relationship is governed by our terms of service and privacy policy.
What the service does
| Measure | Status |
|---|---|
| A lead form in the chat with a required consent checkbox and a link to the store’s policy | Works |
| The chat answers only on the store’s domain; the bot key is tied to the site | Works |
| Contacts from the form never reach the language model | Works |
| Automatic masking of personal data in a shopper’s message before it is sent to the language model (phones, emails, card numbers and similar). The method is heuristic and not exhaustive, and it is tuned for Russian-language data so far, so it is not a guarantee | Works, limited |
| Demo data entered without registration is deleted after 24 hours | Works |
| Deletion of a specific visitor’s data on the store’s request | Works on request |
| A ban on typing personal data into the chat: contacts are left only in the form | Set by the terms |
What stays on the store’s side
- A privacy policy on your site and consent in the form required by the law that applies to you (for example GDPR in the EU and UK, CCPA/CPRA in California).
- Information to visitors that a chat bot and an external language model are used.
- Understanding that a shopper can write anything in the chat. The bot doesn’t ask for personal data in the conversation and collects contacts with a separate form that has consent.
Questions about data
See the Contact page. How we process the data of visitors to this site is described in the privacy policy.