Privacy Policy

Last updated: September 28, 2026

ChatbotReply ("we", "our") provides customer-service chatbot software for online businesses. This policy explains what data we collect, why, and what rights you have. Our security practices are described on the Security page, and our Data Processing Addendum governs how we handle personal data on behalf of business customers.

1. Data we collect

Account data: your name, email address, and business name when you sign up; login credentials (passwords are stored as salted hashes, never in plain text).
Business content: FAQs, knowledge-base entries, website pages you ask us to import, product/order data you sync, and your chatbot settings.
Chat transcripts: conversations between your chatbot and your customers, including messages, feedback ratings, and captured leads — so the bot has context and you get analytics.
Messaging channel data: if you connect WhatsApp, Messenger, or Instagram, we receive the message text and the sender's channel-scoped ID for messages sent to your connected number, Page, or account. We use these solely to generate and deliver the reply.
Technical data: request logs, IP addresses, and device/browser information used for security, rate limiting, and debugging.

2. How we use your data

To operate your chatbot: receiving customer messages, generating replies from your knowledge base, and delivering them on the connected channel.
To provide your admin dashboard, analytics, and account management.
To send transactional emails (verification, password resets, billing notices).
To protect the service against abuse (rate limiting, bot protection via hCaptcha).

We never sell your data or your customers' data. We do not use your content to train shared AI models (see "No training on your data" on our Security page).

3. Messaging (Meta platforms)

When you connect a Facebook Page, WhatsApp number, or Instagram account, Meta delivers incoming messages to our webhook. For Messenger, this uses the pages_messaging permission for exactly two purposes:

Receiving: the message text and the sender's Page-scoped ID, needed to understand the question and route the answer back.
Replying: sending the generated answer back to the same person through the Messenger Send API.

The app only replies to messages a customer sends first. It never initiates conversations and never sends marketing or promotional messages. We do not request or store customers' names, emails, or profiles beyond what is needed to carry the conversation.

4. Sharing and subprocessors

We share data only with the subprocessors needed to run the service — listed on our Security page (hosting, database, payments via Stripe, email delivery, AI reply generation, and any messaging or store channels you connect). They process data only on our instructions. We do not share data for advertising.

5. Data retention and deletion

Chat transcripts and analytics are kept while your account is active so your reports keep working. You can delete individual conversations, leads, and documents from the admin dashboard at any time. Deleting your account (Settings → Danger zone) permanently removes your business data within 30 days; backups age out within 90 days.

6. Your rights

If you are in the EU/UK, you may request access, correction, export, or deletion of personal data we hold about you. Business owners can self-serve most of this in the admin dashboard. For requests, email privacy@chatbotreply.com — we respond within 30 days. End users (shoppers) can request deletion of their conversation data through the same address.

7. Children

ChatbotReply is a business product and is not directed at children under 13. We do not knowingly collect data from children.

8. Changes to this policy

We will update the "Last updated" date above when this policy changes. Material changes will be announced by email to account owners.

9. Contact

Questions about this policy: privacy@chatbotreply.com. Security issues: security@chatbotreply.com.