Privacy Policy

Last updated July 27, 2026

BotDesk ("we", "us") provides AI chat widgets that businesses embed on their websites. This policy explains what we collect and how it's used — both for our direct customers (businesses with a BotDesk account) and for visitors who chat with a BotDesk-powered widget on a business's site.

What we collect from businesses (our customers)

Account details — your name, email address, and sign-in method (Google, GitHub, or email/password via Google Firebase Authentication). We never see or store your password.
Bot configuration — the settings, knowledge, links, and website content you provide or ask us to scan so your chatbot can answer questions about your business.
Team members — names, email addresses, and optional phone numbers of employees you add, used for sign-in, alerts, and (if configured) SMS notifications.
Billing — payments are processed by Stripe. We store your plan and subscription status, but your card details never touch our servers.

What we process for visitors of our customers' websites

Chat messages — conversations with a business's chatbot are stored so the business can read them, receive transcripts, and follow up. We process this data on behalf of the business you were chatting with; contact that business for requests about your conversation.
Contact details you choose to share — if you submit your name, phone number, or email through a chat (for a callback, booking, or quote), it is delivered to that business.
Technical and location data — your IP address, the approximate country and city it resolves to, your device type and browser family, and how you arrived at the site (for example a search engine or a referring link). The business that runs the widget can see this alongside your conversation, and uses it to recognise returning visitors, to route and answer enquiries, and to exclude its own staff's visits from its statistics.
Order status, when a business has connected its store — if you ask "where is my order?", we ask you for the order number and the email address on the order, and use them to look that single order up in the business's own store (Shopify or WooCommerce). We do this live and we do not store any of the order data, including the email you give us. The email is used once, to check it matches the order, so that we never reveal someone else's order to you.
Chat messages are sent to OpenAI to generate the AI's responses. They are not used by us to train AI models.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not use it to build advertising profiles or to make automated decisions that have legal or similarly significant effects on you.

Service providers we rely on

Cloudflare — hosting, storage, and content delivery
Stripe — payment processing
OpenAI — generating chatbot responses
Google Firebase — authentication
Google Analytics — website usage statistics on botdesk.studio (loaded only after cookie consent)
Resend — transactional and notification email
Twilio — SMS alerts, only when a business configures its own Twilio account

Retention & deletion

Account and bot data is kept while your subscription is active. Beyond that we apply specific limits rather than keeping things indefinitely:

Conversations — the most recent 100 per chatbot, up to 120 messages each, and in any case no longer than 12 months after the last message. Older conversations are removed automatically.
Leads — the most recent 100 per chatbot.
After you cancel — conversations and leads are deleted 90 days later.
Backups — a nightly encrypted backup is kept for 30 days on a rolling basis.
Connected store data — never stored at all, as described above. If a business uninstalls our Shopify app, the stored access token and cached product catalogue are deleted.

To delete your account and its data, email hello@botdesk.studio and we'll complete the deletion within 30 days.

Email preferences

Marketing emails include an unsubscribe link and stop immediately when used. Operational email (receipts, alerts you configured, security notices) is sent as part of the service.

Your rights

You can request a copy, correction, or deletion of your personal data at any time by emailing hello@botdesk.studio. If you chatted with a business's widget, direct requests to that business — we'll assist them in fulfilling it.

Changes

We'll update this page when our practices change and revise the date above. Material changes are announced to account holders by email.