Privacy Policy

1. Who we are

This Policy explains how CustBot handles personal data on the CustBot platform. For any privacy question or request, write to [email protected].

2. Data we collect

• Account data: name, email address, company name, and a password stored only as a one-way hash.
• Business data you upload: knowledge base documents, product catalogues and agent settings.
• Conversation data: messages your customers send through connected channels and the replies the agent sends.
• Billing data: subscription status and transaction references from Paddle. We do not receive or store full payment card numbers.
• Technical data: IP address, browser type and usage logs, used for security, abuse prevention and rate limiting.

3. Your customers' data

For conversations between you and your customers, you are the controller of that personal data and CustBot acts as your processor. You are responsible for having a lawful basis for processing it and for giving your customers the notices the law requires.

We process that data only to deliver the Service on your instructions.

4. How we use data

We use data to provide and secure the Service, run your AI agents, process subscriptions and payments, send service emails, prevent abuse, meet legal obligations and keep the platform reliable.

We do not sell personal data.

5. AI model providers

To generate replies and to index your knowledge base, we send the relevant message context and knowledge text to third-party AI model providers. They process that data under their API terms. We choose providers by task and can change them without changing your setup.

We never ask an AI model provider to identify a customer, and we remove nothing from a message you did not choose to send, so avoid putting data in your knowledge base that you do not want processed by these providers.

6. Who we share data with

We share personal data only with service providers that help us run CustBot (hosting and network, AI models, payments, messaging channels, email, and speech services), each bound by contract to protect it. We also share data with authorities when the law requires it, or as part of a business transfer, in which case we will give notice.

A current list of these providers is available on request at [email protected] and to customers who sign our Data Processing Addendum.

7. Retention and deletion

We keep data while your account is active and as long as needed for the purposes above.

Account owners can delete the account themselves from Account and data in the dashboard. The account is locked immediately, you can download a ZIP export of your conversations, messages, contacts and knowledge sources, and you can restore the account during a 30-day grace period. After the grace period the data is deleted permanently, except records the law requires us to keep, such as billing records.

To request deletion of other personal data, write to [email protected] from the account email address.

8. Security

Data is encrypted in transit using TLS, passwords are stored as hashes, and access to systems is restricted and logged. No system is perfectly secure. If a personal data breach occurs, we will notify affected parties as the law requires.

9. International transfers

Our service providers may process data outside your country, including in the United States and the European Union, and for certain AI model providers in other regions. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses, with those providers.

10. Your rights

Depending on where you live, including under the GDPR and applicable regional data protection laws, you may request access to, correction, deletion, restriction or portability of your personal data, and you may object to certain processing. Send your request to [email protected]. If you are a customer of one of our customers, contact that business first, because it controls your data.

11. Cookies

We use cookies as described in our Cookie Policy.

12. Children

CustBot is a service for businesses. It is not directed at children under 16.

13. Changes and contact

We may update this Policy and will notify account administrators of material changes. Questions: [email protected].