Privacy policy

Botpany is a workspace where teams chat with AI bots that use the tools they connect. This policy explains which personal data we process, why, and what your rights are. We follow the General Data Protection Regulation (GDPR).

Who we are

Botpany is a service of vanrossum.dev, Schoolstraat 70, 6721 CS Bennekom, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 66761743. You can reach us at [email protected].

For account, billing, and website data, we are the controller. For the content a team puts into Botpany, such as chats, files, and data from connected tools, the organisation that uses Botpany is the controller and we process that data on its behalf. Business customers can ask us for a data processing agreement.

Personal data we process

• Account data: your name, email address, password (stored as a hash), profile photo, passkeys, and two-factor settings.
• Team data: team names, members, roles, groups, and invitations.
• Content: messages, files you attach, pages, routines, memories, and bot instructions. Speech you dictate is turned into text and not stored. Audio of replies read aloud is kept for 7 days, so playing it again is quick.
• Data from connected tools: when a bot answers, it reads the data it needs from the tools your team connected. Sign-ins and keys for those tools are stored encrypted.
• Usage data: how much AI each person uses, to apply weekly budgets and credits.
• Billing data: your plan, number of seats, and invoices. Payment and billing details are handled by our payment processor. We do not see or store full card numbers.
• Technical data: IP address, browser type, and logs, to keep the service secure and fix errors.

We only use cookies that are needed to sign you in and keep the app secure. We do not use advertising or tracking cookies.

Legal basis

• Contract (Article 6(1)(b)): to provide Botpany to you and your team.
• Legal obligation (Article 6(1)(c)): to keep billing records.
• Legitimate interest (Article 6(1)(f)): to keep the service secure, prevent abuse, and improve it.
• Consent (Article 6(1)(a)): where we ask for it, for example for optional emails. You can withdraw consent at any time.

How we use your data

• To run Botpany: answer questions, run routines, create pages, images, and audio, and connect to your tools.
• To manage accounts, teams, and billing.
• To give support when you ask for it.
• To keep the service secure and prevent abuse.
• To meet legal obligations.

We do not sell personal data, and we do not use your content to train AI models of our own.

Who we share data with

We only share what is needed, with processors that work for us under a written agreement:

• AI providers, to write answers and create images, text from speech, and speech from text.
• Payment processor, to handle subscriptions, invoices, and taxes.
• Cloud hosting, to run the app and store data in the European Union.
• Email delivery, to send account emails and receive emails sent to your bots.

When you connect a tool, data flows between Botpany and that tool on your instruction, under your own agreement with that tool's provider.

Data from Google

When your team connects a Google account, Botpany asks only for the access that the connection needs:

• Google Analytics (read only): to read reports, such as visitors and traffic sources, when you ask a bot about them.
• Google Search Console (read only): to read search performance, such as clicks, search queries, and pages.
• Google Sheets: to read the spreadsheets you point a bot to, and to create new spreadsheets. Botpany can only change spreadsheets that it created itself.

We also receive the name and email address of the Google account, to show which account is connected.

How we use and protect Google data:

• Botpany reads Google data only when a bot needs it to answer a question or run a routine for your team. We do not copy your Google data in bulk.
• What a bot reads can become part of its answer. That answer is stored with the chat until you or your team deletes it.
• The Google sign-in is stored encrypted. When you disconnect the account in Botpany, we delete it. You can also remove access at any time at myaccount.google.com/permissions.
• We send Google data to our AI providers only to write the answer you asked for, under terms that do not let them use it to train their models.
• We do not sell Google data, use it for advertising, or use it to train or improve AI models, of our own or of others.
• People at Botpany do not read your Google data, unless you ask us to for support, or it is needed for security or to meet the law.

Botpany's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

International transfers

Botpany is hosted in the European Union. Some processors, such as AI providers, may process data outside the European Economic Area. In that case we use safeguards that the GDPR allows, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep data

• Account and team data: as long as your account or team exists.
• Content: until you or your team deletes it. Deleting a chat deletes its messages.
• Audio of replies read aloud: 7 days.
• Billing records: 7 years, as Dutch tax law requires.
• Logs: a limited time, to keep the service secure.

When a team is deleted, its chats, bots, pages, and files are deleted. Copies in backups are removed when those backups expire.

Your rights

You have the right to:

• access the personal data we hold about you,
• have incorrect data corrected,
• have your data deleted,
• restrict or object to processing,
• receive your data in a portable format,
• withdraw consent at any time.

Send your request to [email protected]. We answer within one month. If your request is about content of a team, we may forward it to the organisation that controls that team.

Security

We protect data with encryption in transit, encrypted storage of keys and sign-ins, access controls, and sign-in options such as passkeys and two-factor authentication. Each bot only sees the sources it is given, and people only see the chats and pages shared with them.

Complaints

If you think we handle your data incorrectly, please contact us first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Changes to this policy

We may change this policy. For important changes, we tell account owners by email before they take effect.

Contact

Questions about privacy: [email protected].