Privacy
How Botwat handles your data and your customers’ data.
Draft, pending legal review. This page describes how Botwat is built to work. It is not yet a binding legal document and will change before launch.
Last updated: draft, not yet effective.
Who is responsible
When you use Botwat for your business, you are the controller of the personal data of your customers (reviewers, chat and WhatsApp contacts), and Botwat acts as your processor (in India’s DPDP Act, you are the data fiduciary). For California law, Botwat acts as a service provider: we do not sell or share personal information. One data processing agreement covers every market, and for GDPR and UK GDPR it includes the standard contractual clauses, with the UK addendum, for transfers to the United States.
What we collect
- Account details: your name, email, phone number and business details.
- Your Google Business Profile data, which you let us access, including profile details, reviews and performance numbers.
- Content you give us: photos, documents, FAQs and answers you confirm.
- Conversations and messages between your customers and the Botwat assistant, and private feedback sent through the Review QR page.
- Usage and billing records, and technical logs that carry IDs, counts and costs but no message text or personal data.
How we use it
To provide Botwat: audit your profile, draft and publish content you approve, reply to customers, build your website and report results. AI models receive only the data needed for the task. Review QR helper answers and drafts are never stored. We do not use your customers’ data to advertise to them.
How long we keep it
| Data | Kept |
|---|---|
| Google Business Profile data, reviews and reply state | Cached for up to 28 days, then deleted automatically |
| Private report bodies containing Google data | 28 days |
| Botwat reports (score, checklist) | For the life of your account |
| Conversations, messages and private feedback | 12 months by default; the owner can change this |
| Business knowledge you confirm (facts, FAQs) | While your business is active; deleted with the business or workspace |
| Documents you upload | Until you delete them |
| Review QR helper answers and drafts | Not stored; they exist only in the request and the customer’s browser |
Security
- Each workspace is a separate tenant; access is checked on the server on every request.
- Google access tokens are encrypted and handled by one isolated service.
- Public chat and Review QR pages use bot checks, signed short-lived sessions, rate limits and spend caps.
- Crawled web text is treated as untrusted and can never trigger a post, reply, message or profile change.
- Heavy background tasks run on separate workers. Those that handle web pages hold no credentials.
Where data is stored
Customer data is stored and processed in the United States. EU data residency is planned for a later release.
Sub-processors
These companies process data on our behalf. We will update this list, and tell customers, before adding another.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google (Google Cloud, Firebase, Business Profile API, Calendar) | Hosting, database, authentication, functions and queues; access to your Google Business Profile and Calendar | United States |
| Amazon Web Services (AWS Lambda) | Heavy background tasks such as report rendering, website crawling and poster rendering. These workers hold no stored customer credentials | United States (us-east-2) |
| OpenAI | AI text and image generation | United States |
| Meta (WhatsApp Business Platform) | WhatsApp approvals, alerts and the customer assistant | Varies by recipient |
| DataForSEO | Local rank scans, competitor data and website audits | Varies |
| Cloudflare | DNS, content delivery, file storage (R2), customer websites and bot protection | Global edge; storage in North America |
| Razorpay | Payments in India (when paid plans open) | India |
| Merchant of record (to be named before paid plans open) | Payments and tax outside India (when paid plans open) | To be confirmed |
Anthropic will be added to this list, and to the data processing agreement, before any Anthropic model is enabled.
Your rights
You can export your workspace data, and ask us to delete it. End customers can ask a business to delete their data, and the business can do it through Botwat. We honour access, deletion and correction requests under GDPR, UK GDPR, CCPA/CPRA and the DPDP Act. Write to privacy@botwat.com. We are preparing a grievance contact and a breach process, including the notice periods each law requires (for example 72 hours to the regulator under GDPR).
Our crawler
BotwatBot reads public websites for businesses that use Botwat. See how it works and how to opt out.
Changes
We will post changes here and tell account owners before material changes take effect.