Privacy Policy

    Your privacy matters. This policy explains what data we collect, how we use it, and the choices you have.

    Last updated: February 15, 2026

    Introduction

    SimpleBot AI is a cloud-based platform that helps businesses deploy AI-powered chatbots for sales, lead capture, customer support, and engagement. We take your privacy seriously and are committed to protecting your personal information. This Privacy Policy describes our practices for collecting, using, and safeguarding data. We may update this policy as our services evolve or as privacy laws change.

    Contacting Us

    If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:

    1. Information We Collect

    We collect the following categories of information when you use SimpleBot AI:

    • Account information — name, email address, and password when you create an account.
    • Billing information — payment details collected and processed by our payment provider (Stripe); we do not store full payment card details on our servers.
    • Lead capture data — name, email, phone number, or other details that website visitors voluntarily submit through the chat widget.
    • Chat transcripts — the content of conversations between visitors and the AI chatbot or live chat agents.
    • Usage data — pages visited, browser type, device information, IP address, general location (city/country level), and interaction patterns within the platform.
    • Cookies and similar technologies — see the Cookies and Tracking section below.

    We may also receive limited business-related information about you from third parties (e.g., your employer or industry details via public sources like LinkedIn) to improve service relevance.

    2. How We Use Your Information

    We use the collected information to:

    • Provide, operate, maintain, and improve SimpleBot AI's services.
    • Process transactions and send billing notices.
    • Respond to support requests, questions, and feedback.
    • Analyze anonymized and aggregated usage patterns to enhance features, detect fraud or abuse, and resolve technical issues.
    • Send essential service communications, such as product updates, security alerts, or policy changes.
    • Comply with legal obligations.

    We have a legitimate interest in understanding how users interact with our platform and website to deliver better services and functionality.

    3. Chat Data and AI Processing

    SimpleBot AI uses third-party large language models (e.g., from OpenAI) to generate chatbot responses. Conversation context is temporarily transmitted to these providers solely to produce replies.

    • Chat transcripts and lead data are stored in your account and accessible only to authorized team members.
    • We retain active chat data for 90 days, after which it is automatically archived or deleted unless you choose longer retention.
    • We do not use your chat data or lead data to train third-party AI models. Data sent to AI providers is processed only for real-time response generation and is not retained or used by them for training purposes.
    • You can export, review, or delete chat and lead data at any time via the dashboard.

    We explicitly affirm that data accessed through any integrated APIs (if applicable in the future) will not be used to develop, improve, or train generalized AI or machine learning models.

    4. Information Sharing and Disclosure

    We do not sell your personal data. We share information only as necessary:

    • With service providers — trusted third parties that help operate our platform, including Supabase (database and authentication), Stripe (payments), and OpenAI (AI processing). These providers are bound by contracts to protect your data and use it only for the services they provide to us. A current list of subprocessors is available upon request.
    • For legal reasons — if required by law, regulation, legal process, or to protect rights, property, or safety.
    • Business transfers — in connection with a merger, acquisition, or asset sale.
    • With your consent — when you explicitly authorize sharing.

    We may also share aggregated, anonymized data (that does not identify individuals) for analytics, research, or marketing purposes.

    5. Data Security

    We implement robust, industry-standard measures to protect your data:

    • Encryption — all data is encrypted in transit (TLS/SSL) and at rest (AES-256).
    • Access controls — role-based permissions ensure only authorized personnel access sensitive systems.
    • Infrastructure — hosted on secure cloud providers with primary storage in the European Union/United Kingdom.
    • Monitoring — regular security reviews, vulnerability scanning, and incident response protocols.
    • Rate limiting and domain allowlisting — controls to prevent abuse and restrict widget embedding to approved domains.

    In the event of a data breach, we will notify affected users and authorities as required by applicable laws.

    We are committed to GDPR compliance and maintain appropriate safeguards.

    6. Data Retention

    • Account and billing data — retained while your account is active and for a reasonable period afterward for legal or operational needs.
    • Chat transcripts and session data — retained for 90 days by default, then automatically deleted or archived.
    • Lead data — retained until you delete it or close your account.

    Upon account closure or verified request, we will delete or anonymize your data within 30 days, except where required to retain it by law.

    7. Your Rights and Choices

    Depending on your location and applicable laws (including GDPR, CCPA, and others), you may have rights such as:

    • Right to be informed about how your data is used.
    • Right of access — request a copy of your personal data.
    • Right to rectification — correct inaccurate or incomplete data.
    • Right to erasure ("right to be forgotten") — request deletion, subject to legal exceptions.
    • Right to restrict processing — limit how we use your data in certain cases.
    • Right to data portability — receive your data in a structured, machine-readable format.
    • Right to object — opt out of certain processing, including direct marketing.
    • Rights related to automated decision-making — including profiling (not currently used for decisions with legal effects).

    To exercise these rights, contact privacy@simplebotai.com. We provide reasonable access at no cost and will respond within required timelines. You may also lodge complaints with your local data protection authority.

    You can unsubscribe from communications via email links and manage cookie preferences through your browser.

    8. Cookies and Tracking

    We use cookies and similar technologies on our website and platform:

    • Essential cookies — required for authentication, security, and core functionality (cannot be disabled).
    • Analytics cookies — anonymized data to understand usage and improve the experience.

    For details and management options, see your browser settings or our Cookie Notice (if available on our site).

    9. Children's Privacy

    SimpleBot AI is not intended for children under 13 (or 16 in some jurisdictions). We do not knowingly collect personal information from children. If we learn we have collected such data, we will delete it promptly. Contact us if you believe this has occurred.

    10. International Data Transfers

    SimpleBot AI data is primarily stored and processed in the European Union/United Kingdom. However, certain service providers (e.g., OpenAI and Stripe) are based in the United States or other countries outside the EU/UK. Where data is transferred internationally, we implement appropriate safeguards, including Standard Contractual Clauses approved under GDPR (Article 46) and data processing agreements with our providers, to ensure an adequate level of protection.

    By using our services, you consent to these transfers where required under applicable law.

    11. Changes to This Policy

    We may update this Privacy Policy periodically. Material changes will be reflected by updating the "Last updated" date, with notification via email or in-platform notice where appropriate. Continued use of the service constitutes acceptance of changes. Review this policy regularly.