Privacy Policy

    Last updated: August 15, 2026 · Version 2026-08-15 · Applies under the EU/UK GDPR and India's Digital Personal Data Protection Act, 2023

    1. Who we are

    Botspot AI Technologies Private Limited ("Botspot", "we", "us") operates the Botspot multi-agent AI platform, including Workbench, WorkForce, MyCrew and agents delivered over channels such as WhatsApp.

    For the EU/UK GDPR we are the controller of the personal data described here. Under India's Digital Personal Data Protection Act, 2023 (DPDP) we are the Data Fiduciary, and you are a Data Principal.

    Where a business customer uses Botspot to process personal data of their own customers, that customer is the controller / Data Fiduciary and we act as their processor / Data Processor under our agreement with them.

    2. What we collect

    Account data
    Name, email address, password hash, and the organisation or workspace you belong to.
    Billing data
    Billing name, address, GSTIN/PAN where you supply them for a tax invoice, and payment references. Card and bank details are handled by our payment providers and never reach our servers.
    Content you give to agents
    Messages you send, documents you upload, and data sources you connect. Agents keep conversation memory so they can follow a thread across turns.
    Channel data
    If you message a Botspot-powered agent on WhatsApp, we process your phone number and the content of that conversation in order to reply.
    Usage and technical data
    IP address, browser and device information, pages visited, and records of agent runs (which agent ran, when, how long, how much it cost).

    We do not deliberately collect special-category or sensitive personal data, and ask that you do not put it into agent conversations or uploaded documents.

    3. Why we process it, and on what basis

    Every purpose below has a lawful basis under GDPR Art. 6 and a corresponding ground under DPDP (either your consent under s.6, or a legitimate use under s.7).

    Running the service — contract / DPDP s.7(a)
    Authenticating you, running agents you ask for, storing your documents and conversation memory, and delivering replies over your chosen channel.
    Billing and tax — legal obligation
    Issuing GST-compliant invoices and keeping the statutory records that follow from them.
    Security and abuse prevention — legitimate interests
    Detecting fraud, abuse and unauthorised access. We think this is what any user would expect of a platform holding their data.
    Support — contract / legitimate interests
    Answering the questions and issue reports you send us.
    Analytics — consent
    Understanding how the product is used so we can improve it. Off unless you turn it on, and you can turn it off again at any time.
    Marketing — consent
    Product news and offers. Off unless you turn it on. Every message includes an unsubscribe link.

    4. AI models and your content

    Running an agent means sending your prompt, and whatever context the agent needs, to a third-party AI model provider (see sub-processors below). This is how the product works and it cannot be switched off while still using an agent.

    • We do not sell your content, and we do not use it to train our own models.
    • We use model providers under their API terms, which do not permit them to train their models on data submitted through those APIs.
    • Agent conversation memory is kept so agents stay coherent across turns. You can clear it yourself, and erasing your account destroys it.

    5. Who we share it with

    We do not sell personal data. We share it with the following categories of sub-processor, each only to the extent needed to do their job:

    Cloud infrastructure
    Amazon Web Services (compute, database, object storage, DynamoDB) in the US East (N. Virginia) region.
    AI model providers
    Anthropic, OpenAI and Google, and — for image, video and voice features — Replicate, Runway, Luma, Pika and D-ID. Which provider is used depends on the model the agent is configured with.
    Payments
    Razorpay (India), Stripe (international) and PhonePe. They receive the transaction data needed to take payment; we never see full card details.
    Messaging channels
    Meta Platforms, for agents delivered over the WhatsApp Business Cloud API.
    Support tooling
    Atlassian (Jira), when you report an issue from inside the product.

    We may also disclose data where the law requires it, to protect our rights or someone's safety, or to a successor entity in a merger or acquisition — in which case this notice continues to apply until you are told otherwise.

    6. Where your data goes

    Our infrastructure runs in Amazon Web Services' US East (N. Virginia) region. If you are in India, the EU or the UK, your personal data is therefore transferred to and stored in the United States, and processed by AI providers who may operate in other countries.

    • For EU/UK transfers we rely on the European Commission's Standard Contractual Clauses with our processors.
    • DPDP permits transfer outside India except to countries the Central Government restricts; we monitor that list and will comply with it.

    7. How long we keep it

    Account and content
    For as long as your account exists. Erasing your account destroys your documents, conversation memory and channel history.
    Tax invoices
    Retained for the period Indian tax law requires, even after account erasure — but with the buyer's name, email and address stripped out, leaving only the amounts and tax details we are obliged to keep.
    Usage and run records
    Retained for billing accuracy and platform analytics. On erasure the link to you is removed, leaving anonymous aggregates.
    Consent records
    Retained as evidence that consent was properly obtained, as GDPR Art. 7(1) and DPDP require — anonymised on erasure, so what remains records the decision but not the person.

    8. Your rights

    You can ask us to do all of the following, free of charge. We will respond within 30 days.

    Access
    Get a copy of the personal data we hold about you.
    Correction
    Have inaccurate or incomplete data corrected.
    Erasure
    Have your data deleted. MyCrew users can do this themselves at any time under Account Settings → Delete account; it erases your data across every one of our services.
    Portability
    Receive your data in a machine-readable form.
    Objection and restriction
    Object to processing based on legitimate interests, or ask us to restrict it.
    Withdraw consent
    Turn off analytics or marketing at any time under Account Settings → Privacy. Withdrawal is as easy as consenting, and does not affect processing already carried out.
    Nominate (DPDP s.14)
    Nominate someone to exercise these rights on your behalf in the event of your death or incapacity. Write to the Grievance Officer to do so.

    To exercise any right, write to grievance@botspot.app. We may ask you to verify your identity first, so that nobody else can make a request in your name.

    9. If you messaged an agent without an account

    You do not need a Botspot account to have rights here. If you messaged a Botspot-powered agent on WhatsApp and never signed up, we still hold your phone number and that conversation.

    Write to grievance@botspot.app from — or quoting — that number, and we will erase the conversation, its messages and the agent's memory of it.

    10. Cookies and consent

    Strictly necessary cookies keep you signed in and the service working; they have no on/off switch because without them there is no service. Analytics and marketing cookies are separate, off by default, and asked for individually.

    See our Cookie Policy for the detail, and Account Settings → Privacy to change your answer at any time.

    11. Security

    • Data is encrypted in transit (TLS) and at rest.
    • Third-party credentials you connect are encrypted with AWS KMS and decrypted only at the point of use.
    • Access to production data is limited to staff who need it.

    No system is perfectly secure, and we will not claim otherwise. If something goes wrong, section 12 says what we will do about it.

    12. If there is a data breach

    • We will notify India's Data Protection Board and every affected Data Principal, as DPDP s.8(6) requires.
    • For personal data covered by the GDPR we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the risk to them is high.
    • Our notice will say what happened, what data was involved, what we are doing about it, and what you should do.

    13. Children

    Botspot is not intended for children. Under DPDP s.9 a child in India is anyone under 18, and we do not knowingly process a child's personal data without verifiable parental consent, nor do we track or target advertising at children. Elsewhere we apply the local age of digital consent, which is 16 in most of the EU.

    If you believe a child has given us personal data, write to grievance@botspot.app and we will delete it.

    14. Grievance Officer and complaints

    If you are unhappy with how we have handled your data or your request, contact our Grievance Officer. This is a DPDP s.13 right: you must exhaust it before approaching the Board.

    Grievance Officer
    Giridhar Chandrasekaran
    Phone
    +91 99404 94008
    Post
    Botspot AI Technologies Private Limited, No. 143, Campus-1A, RMZ Millenia Business Park-II, Dr. MGR Main Road, Kodandarama Nagar, Perungudi, Chennai, Tamil Nadu 600096, India
    Response time
    We acknowledge within 7 days and resolve within 30 days.

    If we do not resolve it, you may complain to the Data Protection Board of India. If you are in the EU or the UK, you may instead complain to your local supervisory authority.

    15. Changes to this notice

    This is version 2026-08-15, last updated August 15, 2026. If we change it materially we will ask for your consent choices again rather than assuming the old answer still applies, and we will tell you what changed.