Privacy Policy

BotMessaging is operated by Sean McGee, a UK sole trader trading as BotMessaging. Contact: [email protected]. Last updated: 11 October 2026 This Privacy Policy explains how BotMessaging handles personal information when you visit our website, contact us, create an account or use our hosted business messaging and automation service. It also explains how information is processed when a business uses BotMessaging to communicate with its customers. 1. Our role and the business you communicate with BotMessaging determines how information is used to operate its website, manage customer accounts and subscriptions, provide support, protect the service and maintain its business records. For those activities, we act as a data controller where that term applies. When a business uses BotMessaging to manage its contacts, messages, knowledge sources, bookings, campaigns or shop, that business generally decides why and how its customer information is used. We process that workspace information on the business's behalf to deliver the features it uses. The business's own privacy notice applies to its relationship with its customers. If you contacted a business through a chatbot, messaging channel, web chat or shop powered by BotMessaging, direct questions about that business's use of your information to that business. You can also contact us through our contact page so that we can identify the relevant account and help route your request. 2. Information we process The information processed depends on the features and connections in use. It can include: Account and team information: names, email addresses, account identifiers, login credentials, business and workspace details, team membership, permissions and preferences. Contact and conversation information: names, phone numbers, email addresses, channel identifiers, profile information, language, contact fields, tags, consent preferences, messages, timestamps, delivery status, attachments, internal notes, assignments and conversation history. AI and knowledge information: chatbot instructions, business information, uploaded documents, website addresses and retrieved website content, extracted text, searchable knowledge representations, prompts, relevant conversation context, generated responses and processing results. Media information: images, audio and voice messages, videos and documents submitted through supported features, together with extracted descriptions, text, transcripts or generated speech. The available processing depends on the channel, file format, model and provider. Business activity: lead information, enquiries, appointment requests, calendar availability and booking references, catalogue and shop content, carts and orders, campaign recipients and results, social posts and publishing activity. Connection information: connected account identifiers, granted permissions, configuration, API credentials and access or refresh tokens needed to operate an integration. Billing and usage information: selected plans, billing periods, payment and subscription identifiers, amounts, currencies, transaction status, invoices, refunds and feature or AI usage records. Support and technical information: contact-form messages, IP addresses, browser and request information, security and audit events, errors and operational records. We receive information from you, your authorised team members, people communicating with your business, connected providers, uploaded or imported material and websites you instruct the service to retrieve. Publicly accessible website information may still contain personal information. 3. How information is used We use information to create and administer accounts; authenticate users; provide shared inboxes and customer records; deliver and receive messages; run requested AI and automation features; retrieve and search knowledge sources; process supported media; manage enquiries, bookings, shops and campaigns; publish authorised social content; provide reports; process subscriptions; answer requests; investigate failures or misuse; and meet applicable legal obligations. Where a law requires a legal basis for our own processing, we rely on the basis appropriate to the activity: performing a contract with you or taking steps you request before a contract; our legitimate interests in operating, supporting and securing the business service and managing relationships with business representatives; complying with legal obligations; or consent where it is required. Where we rely on consent, you can withdraw it without affecting processing that was lawful before withdrawal. The customer business is responsible for identifying the lawful basis for the information it places in its workspace and for the messages, marketing and automated activities it instructs us to perform. Providing information needed for an account, payment or requested feature is necessary for that activity; without it, we may be unable to provide the relevant service. 4. AI, knowledge sources and automated actions When an AI feature is used, the service may send the relevant message, conversation context, instructions, knowledge excerpts or supported media to the AI or speech provider used for that feature. The service can use a provider supplied with the plan or a provider account connected by the customer. Supported integrations include OpenAI, Anthropic and Google Gemini; availability and capabilities vary. Knowledge indexing may use a different provider from the one used for replies. Processing may produce text, descriptions, transcripts, speech, extracted facts or searchable representations of source material. These results and related usage information may be stored in the workspace. Provider processing and retention are also subject to the applicable provider agreement and account settings. AI features can generate replies and support actions configured by the business, such as capturing an enquiry or arranging a booking. AI output can be inaccurate or incomplete. The business controls its configuration and is responsible for appropriate human oversight and for explaining its automated interactions to its customers. 5. Who can receive information Authorised workspace members can access information according to their permissions. Information is also processed by the infrastructure and service providers needed to operate the selected features, such as hosting and storage services, messaging and social platforms, AI and speech providers, email and notification services, calendar providers and payment services. Connecting a service or instructing an action can send relevant information to that provider or to the intended recipient. Subscription payments made through Stripe Checkout are handled by Stripe. The checkout collects payment information directly, and BotMessaging receives information needed to identify, confirm and administer the transaction and subscription. Stripe's handling of payment and related information is described in its Privacy Policy. Information may also be disclosed when necessary to meet a legal obligation, respond to a lawful request, investigate misuse or protect legal rights. A connected provider may act under its own privacy notice for some of its activities. Removing a connection in BotMessaging does not itself delete information that the provider or a message recipient already holds. 6. Cookies, browser storage and communication tracking The website and application use cookies and browser storage for functions such as maintaining a session, protecting requests, remembering preferences and recording cookie choices. Your browser can control or remove cookies and stored information. Blocking necessary storage can affect sign-in and other features. Loading external assets or using a connected feature can cause your browser or the service to communicate with the relevant provider. Customer email campaigns can use tracking images and links to record delivery, opens and clicks, and can include unsubscribe links. Those records are available to the business running the campaign. Contact that business about its marketing practices or use the unsubscribe method in its message. 7. Retention, export and deletion Retention depends on the type of information, the purpose for which it is used, workspace settings, applicable legal requirements and any outstanding security, billing or dispute matter. Cancelling a subscription does not automatically erase workspace information. Workspace administrators can use the available export and privacy controls. Optional retention settings can remove eligible older resolved conversation history and certain locally stored generated audio. These settings do not remove all workspace data: contact identities, leads, commerce records, billing records and aggregate usage have separate purposes and handling. Temporary export downloads have an expiry and are subject to scheduled cleanup. A contact-erasure request is different from an ordinary contact deletion. The privacy controls review linked records and may require administrator attention when processing is still active, records are shared or media ownership needs checking. Removing information from active workspace records does not by itself remove copies in external services, delivered messages, calendar events, operational records, backups, downloaded exports or manually copied material. Those locations require separate assessment and handling. New incoming messages or imports may create new records. Use our contact page for assistance with account closure, data retention, export or deletion, including information outside the scope of the available workspace controls. Information that must be kept to comply with a legal obligation or establish, exercise or defend legal claims may be retained for that purpose. 8. Processing locations and security Processing locations depend on the service infrastructure and the integrations used by the business. Information may be processed in a country different from the country in which you live. Contact us for information about the locations and arrangements applicable to your use of the service. The service uses account authentication, workspace permissions and access controls intended to limit access to authorised users and services. Security also depends on how accounts, connections and devices are managed. Keep credentials private, grant access only to people who need it and tell us promptly if you suspect unauthorised access. No online service can eliminate every security risk. 9. Your choices and rights Depending on applicable law, you may have rights to access, correct, erase or receive a portable copy of personal information, restrict or object to processing, withdraw consent, and challenge certain decisions based solely on automated processing. These rights have conditions and exceptions. You can also complain to the data protection authority competent for your situation. For information we control, send a request through our contact page. Describe the information or account concerned and the right you want to exercise. We may need proportionate information to verify your identity or authority and protect other people's information. Requests are handled within the periods required by applicable law. For customer workspace information, the business responsible for the workspace should normally handle your request. We support that business in responding where we process information on its behalf. A business's decision to retain information does not remove rights you have under applicable law. Google Workspace and YouTube connections Connecting Google is optional. You choose the services and approve their permissions on Google's consent screen. We use your Google email address and account identifier to identify the connection in your workspace. Calendar access supports availability checks, bookings and meeting links. Sheets access reads selected ranges and appends automation rows. Docs access creates templates and generates documents; Drive file access copies or manages files created with or specifically authorised for this app. Forms access reads selected form definitions and responses for your configured workflows. The separate YouTube connection identifies your channel and uploads videos that you choose to publish. We store connection identifiers, granted permissions and encrypted access or refresh credentials to run the features you request. Selected content and action results can be retained in your workspace and automation records. Google data is used only to provide or improve the relevant user-facing features you choose. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Data is shared only as needed to deliver your requested features, with your consent where required, for security, to comply with law, or as otherwise permitted by Google's Limited Use requirements. Human access is limited to your affirmative permission, necessary security or legal purposes, or permitted aggregated internal operations. You can disconnect Google Workspace or a social account in the customer panel and revoke access through your Google Account connections. Disconnecting stops future use of that connection; it does not delete documents, events or videos already created in Google, or records already retained in your workspace. Use the data-rights and contact options in this policy to request deletion of retained information. Google actions also pause when your BotMessaging subscription is inactive. BotMessaging's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. When you connect YouTube, the YouTube Terms of Service and Google Privacy Policy also apply to your use of those services. 10. Changes and contact We may update this policy as the service or its processing changes. The date above identifies the current version. Where required, we will give additional notice of material changes. For privacy questions or requests, use the BotMessaging contact page.