Privacy Policy

This Privacy Policy explains how BotBeaver LLC ("BotBeaver", "we", "us") collects, uses, shares, and protects personal information of (a) business customers who engage us and (b) end-users who interact with AI chat or phone agents we operate on a customer's behalf.

It applies to https://botbeaver.ai, related subdomains we operate, demo and contact forms on this marketing site, customer dashboards and APIs once provisioned, and messaging or telephony services we provide for a customer business.

1. Who we are

• Legal entity: BotBeaver LLC (United States)
• State of formation: Delaware
• Registered mailing address: United States — registered mailing address available on request at abbasqureshi@botbeaver.ai
• Website: https://botbeaver.ai
• Privacy contact: privacy@botbeaver.ai
• General contact: abbasqureshi@botbeaver.ai

2. Data we collect

2.1 From business customers (account holders)

• Account and contact data: name, work email, company, job title, phone, vertical, product interest.
• Authentication data: handled by our identity provider where used. We store the resulting user ID and email; passwords are not stored on our servers.
• Billing data: processed by our PCI-DSS-compliant Merchant of Record (MoR), named on your invoice. We store only the last four digits of the payment card, billing country, and subscription or invoice status.
• Contract and order data: statements of work, channel scope, approved scripts, and escalation rules.
• Knowledge and configuration: FAQs, pricing ranges you approve, call flows, CRM field mappings, and integration credentials you provide. Integration secrets and API keys are encrypted at rest and decrypted only when needed to perform an authorized API call.
• Usage and support data: login timestamps, dashboard activity, conversation volume, feature configuration, and support tickets.

2.2 From end-users (your customers and callers)

• Website chat: message content, pages visited before chat, and contact details the end-user chooses to share.
• Phone: call audio, transcripts, caller ID, duration, and metadata when phone agents and recording are enabled.
• Scheduling data: appointment preferences and calendar confirmations written on your instructions.
• CRM write-back: fields your business asks us to store in connected systems.

2.3 Collected automatically

• Marketing site: device type, browser, IP address, approximate location derived from IP, referring URL, and pages viewed.
• Service operations: technical logs, webhook delivery metadata, error reports, and security signals.
• Cookies and similar technologies as described in our Cookie Policy.

3. Purposes and legal bases

For each category below we identify why we process data and the GDPR Article 6 legal basis we rely on where GDPR applies. Other laws may provide parallel grounds.

4. Roles: controller vs processor

For marketing-site visitors and demo form submitters, BotBeaver is generally the controller. For end-user conversations and call data processed for a business customer, that customer is typically the controller and BotBeaver acts as a service provider / processor under our Data Processing Agreement.

5. Messaging, telephony, and platform data

When you connect website chat, SMS, email, social messaging (including Meta Business messaging where configured), or carrier telephony, we process data from those channels solely to provide the services in your order and dashboard configuration.

We do not use conversation or call data to train general-purpose consumer AI models, serve third-party advertisements, or build advertising profiles. We do not sell or share personal information for cross-context behavioral advertising.

• You must obtain and document consent required for outbound SMS, marketing email, and recorded calls in your jurisdictions.
• End-users must be able to opt out of marketing messages (for example STOP for SMS) and you must honor opt-outs promptly.
• Where Meta or other platform policies apply to a connected channel, you are responsible for complying with those policies; we configure agents only within the scopes you authorize.

6. AI disclosure

BotBeaver agents use large-language-model inference and retrieval over your approved materials to produce replies on chat and phone. End-users may interact with an AI rather than a human. Agents are configured to identify as AI when directly asked and to escalate to your team when rules require. You remain responsible for disclosures required by law, industry rules, and carrier or platform policies.

7. Data retention

We retain personal data only as long as needed for the purposes below, then delete or anonymize it unless law requires longer retention.

• Customer account data: for the duration of your active engagement. Deleted within 30 days after account closure, cancellation, or a verified deletion request — whichever comes first, except data we must keep for tax, legal, or dispute resolution.
• End-user conversation and call data: for the duration of your active subscription so agents retain necessary context. Deleted within 30 days after subscription ends or when you instruct deletion, subject to the Data Deletion policy.
• Platform and security logs: up to 90 days, then deleted.
• Encrypted backups: rolling retention up to 30 days, then overwritten.

8. Security

• TLS 1.2+ for data in transit between clients, our systems, and subprocessors.
• Encryption at rest for integration credentials, API keys, and other secrets.
• Role-based access control and least-privilege access for personnel; authentication hardening for administrative access.
• Logical separation between customer environments where architecture supports it.
• Monitoring, logging, and incident response procedures. Report suspected vulnerabilities to privacy@botbeaver.ai.

See our Security Overview for a summary of controls. No method of transmission or storage is completely secure.

9. Sub-processors

We share the minimum personal information necessary with service providers that help us operate BotBeaver. A current named list is available on request at privacy@botbeaver.ai. We notify customers before adding or replacing a sub-processor that materially changes how their data is handled, where contractually required.

10. International transfers

We primarily serve US customers. Personal data may be processed in the United States and other countries where our subprocessors operate. Where GDPR or UK GDPR applies, we rely on Standard Contractual Clauses or equivalent safeguards offered by subprocessors, supplemented by our DPA where executed.

11. Your rights

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of personal information, restrict or object to certain processing, and appeal a denial. Email privacy@botbeaver.ai. We respond within the timeframe required by applicable law (typically 30 days for GDPR requests). We may verify your identity. End-users of a customer business should contact that business first; we assist the customer as processor.

12. California residents (CCPA / CPRA)

California residents may request to know, delete, and correct personal information and to opt out of the "sale" or "sharing" of personal information. BotBeaver does not sell personal information and does not share personal information for cross-context behavioral advertising. To exercise rights, contact privacy@botbeaver.ai.

13. Children

Our services are directed to businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes

We may update this policy. Material changes will be posted on this page with an updated date. Where required, we will provide additional notice to account holders.

15. Contact

Privacy and data subject requests: privacy@botbeaver.ai. General inquiries: abbasqureshi@botbeaver.ai.