BestChatBot

Privacy Policy

Last updated: June 2026

1. Introduction

BestChatBot ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and the rights you have under the General Data Protection Regulation (GDPR) and other applicable laws. It applies to bestchatbot.io and all related services. When you deploy a chatbot that interacts with your own customers, you are the data controller and BestChatBot acts as your data processor; those terms are set out in our Data Processing Agreement.

2. What data we collect

We collect two categories of personal data: information about you, the account holder who operates a chatbot, and information your own customers share with the AI assistant you deploy. We collect only what the service needs:

  • Account data: email address, name, and authentication credentials, managed by our authentication provider.
  • Workspace data: the documents, URLs, and content you upload to power your chatbot's Knowledge Base.
  • Billing data: payment method details (processed by Stripe; we never store full card numbers), subscription tier, and invoices.
  • Usage data: anonymized analytics about which pages you visit, collected via Google Analytics 4 only if you accept analytics cookies.
  • Technical data: IP address, browser type, device information, and timestamps, used for security and fraud prevention.
  • End-customer data: when a visitor chats with an assistant you deploy, it may process their name, email address, order details, and shipping address, for example to look up an order status. For this data we act as a processor on your behalf and you remain the controller (see our Data Processing Agreement).

3. How we collect your data

You provide most of your data directly to us when you:

  • Create an account or log in.
  • Upload documents or connect data sources to your workspace.
  • Subscribe to a paid plan.
  • Contact our support team.
  • Browse our website with analytics cookies enabled (we collect anonymous usage data automatically only after consent).

4. How we use your data

We process your personal data for the following purposes:

  • To provide, operate, and maintain the BestChatBot service.
  • To process subscriptions, payments, and refunds via Stripe.
  • To respond to your support requests and communicate service updates.
  • To monitor and improve service performance, security, and reliability.
  • To comply with legal obligations (tax, accounting, regulatory).
  • To operate the AI assistant you deploy on your behalf, including identifying your logged-in customers, looking up their order status, and answering their questions.

5. How we store and secure your data

Security is fundamental to how we operate:

  • Your account, workspace, and conversation data is stored on managed cloud infrastructure located in the United Kingdom and the European Union. Data is encrypted at rest, and all network traffic is encrypted in transit over HTTPS/TLS.
  • Each workspace's data is fully isolated; no data is shared between accounts.
  • Third-party integration credentials and configuration secrets are encrypted at rest; access to production systems is restricted to authorized personnel over encrypted channels.
  • To generate responses, conversation content is processed by AI providers that may operate outside the EU/UK (see section 7).

6. Cookies and tracking technologies

We use a minimal set of cookies. You can manage your preferences at any time via the cookie banner:

  • Strictly necessary: required for authentication, session management, security, and load balancing. These cannot be disabled.
  • Analytics: Google Analytics 4 collects anonymous usage data to help us understand which pages perform best. Disabled by default; activated only with your explicit consent.
  • We do not use advertising or marketing cookies.

7. Third-party services and international transfers

We rely on a number of sub-processors to operate the service. Some of them process the content of conversations (which may include personal data your customers provide, such as names, order numbers, or shipping addresses) in order to generate responses or perform actions you request:

  • AI inference providers: AI language-model inference to generate chatbot responses. Conversation content, which may include end-customer personal data, is sent to these providers; processing may take place in the United States.
  • AI embeddings provider: text embeddings used to index and search your knowledge base.
  • Integration platform: managed connections to business tools (such as Calendly, Cal.com, HubSpot, Zendesk, Freshdesk, and Stripe) when you enable an agentic integration; it forwards the data needed to perform the action you request.
  • Shopify and WooCommerce: read-only access to your store to look up products and order status when you connect them.
  • Cloud database and storage: hosting of your account and workspace data (United Kingdom).
  • Authentication provider: authentication and account management (account holders only).
  • Stripe: subscription billing for account holders.
  • Transactional email provider: transactional email sent to account holders (such as contact replies and usage notifications).
  • Google Analytics 4: anonymous website usage analytics, only with your consent.
  • Slack (optional live handoff): when you connect Slack, a conversation escalated to a human agent is mirrored to a dedicated channel in your Slack workspace so your team can reply there. Personal data sent to Slack this way cannot be guaranteed to be erased on request: messages your agents type directly in Slack are outside our control and are not deletable by us (see section 9).
  • Some of these providers process data outside the EU/UK, including in the United States. Where that happens, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision. A current sub-processor list is maintained in our Data Processing Agreement.

8. Your data protection rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access: request a copy of the personal data we hold about you.
  • Right to rectification: request correction of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"): request deletion of your data when it is no longer necessary.
  • Right to restrict processing: ask us to limit how we use your data.
  • Right to data portability: receive your data in a structured, commonly used, machine-readable format.
  • Right to object: object to processing based on legitimate interests.
  • Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.
  • To exercise any of these rights, email us at contact@bestchatbot.io. We will respond within 30 days.

9. Data retention and deletion

We keep personal data only as long as needed for the purposes described here. Conversations and the end-customer data they contain are automatically deleted after 12 months of inactivity. When you delete a workspace, all associated data (uploaded content, conversation history, contacts, and workspace settings) is permanently removed. Account data is retained for the duration of your subscription and deleted within 30 days of account closure, except where retention is legally required (for example, tax records). When an end customer or a merchant asks us to erase specific personal data (including through Shopify's data-erasure webhooks) we delete it on request. One limitation applies to the optional Slack live handoff: personal data mirrored to your Slack workspace during a handoff cannot be fully deleted by us — in particular, messages your agents typed directly in Slack — and remains subject to Slack's own retention and deletion controls (see section 7). Analytics data in Google Analytics 4 is retained for 14 months.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or a prominent notice on the website at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Contacting the supervisory authority

If you believe we have not handled your personal data in line with the GDPR, you have the right to lodge a complaint with the data protection authority in your country of residence. You can find your local authority via the European Data Protection Board: edpb.europa.eu/about-edpb/members. We would appreciate the chance to address your concerns directly first; please contact us at contact@bestchatbot.io.

Contact

Questions about this Privacy Policy? Contact us at contact@bestchatbot.io