Privacy Policy

1. Introduction

Welcome to BotWright, operated by Ravata Store SRL ("we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our SaaS platform, website, and associated AI and API services.

It is written to satisfy articles 13 and 14 of the GDPR, which means it has to tell you not only what we do, but on what legal basis, for how long, and who else is involved. We have kept it in plain language rather than making it shorter.

2. Who Controls What

Two different relationships run through this platform, and they carry different duties:

• You, our customer. For your account, billing and support data, we are the controller — we decide why and how it is processed, and this policy governs it.
• The people who message your AI agent. For those conversations, the knowledge base you upload and the contacts you collect, you are the controller and we are your processor: we act on your instructions and do not use that content for our own purposes. You are responsible for having a lawful basis to process your own customers' data, and for telling them about it.

If you need a Data Processing Agreement under art. 28 GDPR for the second relationship, write to privacy@botwright.io and we will send one.

3. Information We Collect

We collect only what the service actually needs to run:

• Account information: name, email address, company details, and billing information (processed securely via Stripe — card numbers never reach our servers).
• Integration data: access tokens and page identifiers from the third-party platforms you connect (Meta, WhatsApp, Instagram), used to send and receive messages on your behalf.
• Knowledge base data: documents, text, and URLs you upload to train your AI agents.
• Conversation data: messages exchanged with your agents, and the contact identifier they arrived from (a phone number, a platform ID, or an anonymous web session ID).
• Usage data: system logs, API request volumes, and token consumption per workspace, used for billing and for keeping the service up.

We do not collect precise location, biometric or special-category data, and we do not buy personal data from data brokers. Our server logs record identifiers (workspace, conversation, integration) rather than message bodies, contact names or phone numbers.

4. Why We Are Allowed To (Legal Bases)

• Performance of a contract (art. 6(1)(b)) — running your account, delivering messages, storing your knowledge base, taking payment.
• Legal obligation (art. 6(1)(c)) — keeping invoices and accounting records for the period Romanian tax law requires.
• Legitimate interests (art. 6(1)(f)) — keeping the platform secure, preventing abuse and rate-limiting public endpoints. We balanced this against your rights and limited it to identifiers and counters.
• Consent (art. 6(1)(a)) — the contact form, and loading Meta's SDK when you connect a channel. You can withdraw consent at any time, as easily as you gave it.

6. How We Use AI and Your Data

We utilize Large Language Models (LLMs) to process incoming messages based on the knowledge base you provide. Your private business data, documents, and chat histories are NEVER used to train public AI models. We have zero-data-retention agreements in place with our foundational AI providers.

Answers are generated by a model and can be wrong. Agents are instructed never to invent prices or schedules, and to hand over to a human when they do not know — but you should not treat AI output as professional advice, and you should tell the people who talk to your agent that they are talking to one.

7. Who Else Sees It (Subprocessors)

We do not sell personal data — not to anyone, in any form. We do use a small number of service providers, each under a data processing agreement:

We may also disclose data where a law, a court or a supervisory authority requires it, and to our professional advisers where necessary — never beyond what is asked for.

8. International Transfers

Some of the providers above process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, and where applicable on the provider's certification under the EU–US Data Privacy Framework. You can request a copy of the safeguards in place at privacy@botwright.io.

9. Data Retention & Deletion

We keep data for as long as it is needed, and no longer:

• Account and workspace data — while the account is active, then deleted within 90 days of closure.
• Conversations and contacts — while the account is active, or until you delete them; you control this from your dashboard.
• Knowledge base documents and their vectors — until you remove the source.
• Integration tokens — deleted immediately when you disconnect a channel.
• Invoices and accounting records — 10 years, as Romanian accounting law requires. This one we cannot shorten on request.
• Security and audit logs — 12 months.

You have the right to request the complete deletion of your account and all associated data at any time. Upon deletion, all connected integrations, calendar tokens, and uploaded documents are permanently wiped from our servers.

10. Your Rights

Under the GDPR you can ask us to:

• Access the personal data we hold about you (art. 15);
• Correct it if it is wrong (art. 16);
• Delete it (art. 17);
• Restrict how we use it (art. 18);
• Export it in a machine-readable format (art. 20);
• Object to processing based on legitimate interests (art. 21);
• Withdraw consent at any time, without affecting what came before (art. 7(3)).

The fastest route is the data request form — it works whether or not you have an account with us, because the person who chatted with a bot has the same rights as the business that runs it. You can also email privacy@botwright.io. We answer within one month, as art. 12(3) requires, and we do not charge for it.

If you are not satisfied with our answer you can complain to your national supervisory authority. In Romania that is the ANSPDCP.

11. Children

BotWright is a business tool and is not directed at children. You must be at least 16 to create an account, which is the age Romania has set under art. 8 GDPR for a child to consent to online services on their own. We do not knowingly collect data from anyone below that age; if you believe a child has given us personal data, write to privacy@botwright.io and we will delete it.

If your AI agent may talk to minors, that is your responsibility as controller: you need an appropriate lawful basis and, where the child is under the national age threshold, verifiable parental consent.

12. Security

Every workspace is isolated: queries are scoped to a single workspace at the database level, and every action verifies that the caller owns the row before touching it. Transport is TLS end to end; data at rest is encrypted by our database provider. Passwords are hashed by Supabase Auth and never visible to us. Inbound webhooks are signature-verified.

If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and tell you directly where the risk is high, as art. 33 and 34 require.

13. Changes to This Policy

We update this policy when the product changes. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or in the dashboard before it takes effect, rather than quietly editing this page.

14. Contact Us

For anything in this policy, or to exercise your rights, contact the controller:

See also our Cookie Policy for exactly what is stored in your browser.