Privacy Policy

Last updated 5 October 2026

Who is responsible

[Company legal name], [registered address], is the data controller. Contact: [support email].

What we collect

Account: your email address, a password hash (never the password), when you signed up, whether you confirmed your email, and whether you accepted the Terms. Your bots and conversations: the bots you create and their settings, what you and visitors write to them, files you attach (we keep the extracted text, not the original file), notes, to-dos, contacts, calendar entries, and files bots generate for you. Technical: a random visitor id stored in a cookie so anonymous use works, the referral code you arrived with (if any), and server logs with timestamps, routes, and token counts for cost monitoring.

What we do with it

We use it to run the service: to answer in your bots' conversations, to remember what you taught them, to enforce usage limits, to send you sign-in and confirmation emails, and to understand what the service costs to run. We do not sell your data and we do not use it for advertising.

Who else sees it

Anthropic (AI models): the content of conversations, bot instructions, and attached-file text is sent to Anthropic's API to generate replies, under their API terms, which do not use API data to train models. Resend (email): your address and the emails we send you. Google (if you choose “Continue with Google”): Google tells us your email address, name and a Google account id; we don't get your Google password or anything else from your Google account. Hosting: our servers and database are hosted by [Vercel and Neon / Hetzner], in [region]. Shared links: if you share a bot's link, anyone with it can chat with that bot; if you share a chart or page a bot made, anyone with that link can open it.

Cookies

Three, all first-party and necessary: a visitor id (so anonymous use works), a sign-in cookie (when you sign in), and a referral cookie (for 30 days after you open an invite link). We don't use tracking or advertising cookies. To see how many people visit which pages, we use Vercel Web Analytics, which sets no cookies and doesn't identify you; addresses are stripped of anything personal (links' tokens, which bot you opened) before they are counted.

How long we keep it

As long as your account exists. Delete a bot and its conversations, files, notes, contacts, and calendar go with it. Delete your account and everything under it is removed within 30 days, except what we must keep by law (for example, invoices). Server logs are kept for [30] days.

Your rights

You can see, correct, export, or delete your data, object to processing, and complain to your data-protection authority. Write to [support email]; we answer within a month.

Changes

We will show the date at the top and tell you in the app about material changes.