ChatBotAPP

Privacy Policy

Last updated: October 6, 2026

ChatBotAPP ("we", "us", "our") operates the ChatBotAPP platform accessible at app.chatbotapp.rs and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. Information We Collect

1.1 Account Information

When you register for an account, we collect:

  • Full name and email address
  • Password (stored in encrypted/hashed form)
  • Phone number (optional)
  • Business name, address, and tax identification number
  • Country and preferred language

1.2 Chatbot Configuration Data

When you set up and customize your chatbot, we store:

  • Bot name, logo, and appearance settings
  • AI instructions, persona, and custom prompts
  • Knowledge base content (uploaded documents, FAQs, website data)
  • Integration credentials for Google Calendar, Google Sheets, Google Docs, and social media channels (encrypted)
  • Business type and service-specific settings

1.3 Conversation & Message Data

When end-users interact with chatbots built on our platform, we process:

  • Message content (text sent and received)
  • Conversation metadata (timestamps, duration, channel used)
  • User identifiers provided by the messaging channel (session IDs, phone numbers for WhatsApp/Viber, or social media account IDs)
  • Message feedback ratings (thumbs up/down)

1.4 Voice Data

If voice features are enabled:

  • Voice recordings are processed in real-time for speech-to-text conversion and are not permanently stored by us
  • Voice session metadata (duration, provider used, characters processed)

1.5 Analytics Data

  • Chatbot usage events (opens, closes, button clicks, message counts)
  • Aggregated performance metrics
  • Channel-specific analytics (web, WhatsApp, Viber, Instagram, Messenger)

1.6 Billing Information

  • Subscription plan and usage data
  • Invoice records and payment history
  • Billing address and email

2. How We Use Your Information

We use the collected information to:

  • Provide, operate, and maintain the ChatBotAPP platform
  • Process and deliver AI-powered chatbot responses to end-users
  • Enable integrations with third-party services (Google Calendar, Sheets, Docs, social media channels)
  • Generate analytics and performance reports for your chatbot
  • Process billing, subscriptions, and invoices
  • Send account-related notifications (verification, password resets, billing alerts)
  • Provide customer support via our ticket system
  • Improve and optimize our platform and AI responses
  • Ensure security and prevent fraud or abuse

3. Third-Party Services

To deliver our services, we share data with the following third-party providers:

3.1 AI & Language Processing

  • OpenAI (USA) - Your bot's answers are produced by OpenAI's service, which we use as our data processor through their API. To answer, our server sends OpenAI your customers' messages and the recent conversation history (including replies written by the owner and their team), the bot's name, persona, instructions, greeting and working hours, the business phone and address when a customer asks for them, and the parts of the knowledge base that match the question. OpenAI also receives the full knowledge base text when we prepare it for search. OpenAI processes this data only to provide the service to us, under its terms for business customers and the data processing agreement that is part of those terms, with protection the same as or equal to that described in this policy. The mobile app asks for your permission before sending this data (in the app: Profil, Podaci za OpenAI).
  • OpenAI (reading photographed documents) - When you photograph a document in the mobile app for your bot's knowledge base, the photo is sent to OpenAI so the text can be read from it. We save only the text, not the photo.

3.2 Voice Services

  • OpenAI Realtime API - Used for live voice conversations, per their Privacy Policy.
  • OpenAI (Text-to-Speech, Whisper) - Used for reading answers aloud and for transcribing what the caller says.

3.3 Social Media & Messaging Platforms

  • Meta (Facebook, Instagram, WhatsApp) - When you connect these channels, messages are exchanged via Meta's APIs. Meta's Data Policy applies to data processed on their platforms.
  • Viber - Messages via Viber are processed through Viber's API.

3.4 Google Services

  • Google Calendar API - Used for booking and scheduling features. Calendar data is accessed only with your explicit authorization.
  • Google Sheets API - Used for reading and writing product/service data. Sheet access is limited to the specific spreadsheet you authorize.
  • Google Docs API - Used for reading the documents you add as a source for your bot's knowledge base. Access is read-only, we read only the documents you add, and we read them again periodically so the knowledge stays current.

3.5 Email, SMS and push notifications

  • Email (our own SMTP server) - Transactional emails (verification, notifications, invoices) are sent from our own mail server hosted in the European Union. We do not use an external email marketing provider.
  • Infobip - Used to deliver SMS messages (appointment confirmations and reminders, one-time codes, order updates). The recipient's phone number and the message text are processed by Infobip, per their Privacy Policy.
  • Expo (push notifications) - If you install our mobile app, notification titles and short texts are delivered to your device through Expo and the platform services (Apple APNs, Google FCM). No conversation content beyond the notification preview is sent this way.

4. Data Storage & Security

  • All data is stored on secure servers located in the European Union
  • Passwords are hashed using bcrypt with a cost factor of 12
  • Sensitive credentials (API tokens, access tokens) are encrypted using AES-256-CBC before storage
  • Two-factor authentication (2FA) is available for additional account security
  • All connections use HTTPS/TLS encryption in transit
  • We implement access controls and regular security reviews

5. Data Retention

  • Account data: Retained for as long as your account is active. After you request deletion, your bots stop immediately and the account with its data is permanently deleted after 7 days, unless you cancel the request within that period.
  • Support tickets and attachments: Retained for as long as your account is active and deleted together with the account.
  • Conversation data: Retained for as long as your account is active. You may request deletion at any time.
  • Analytics data: Retained for up to 12 months
  • Verification codes: Automatically deleted after 1 hour
  • Two-factor codes: Automatically deleted after 10 minutes
  • Voice recordings: Processed in real-time and not permanently stored
  • Billing records: Retained as required by applicable tax and accounting laws

6. Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

  • Access - Request a copy of the personal data we hold about you
  • Rectification - Request correction of inaccurate data
  • Erasure - Request deletion of your personal data ("right to be forgotten")
  • Restriction - Request restriction of processing in certain circumstances
  • Portability - Request your data in a structured, machine-readable format
  • Objection - Object to processing based on legitimate interests
  • Withdraw consent - Withdraw previously given consent at any time

To exercise any of these rights, contact us using the details in section 13 below.

7. End-User Data (Chatbot Visitors)

ChatBotAPP processes data from end-users (visitors who interact with chatbots built on our platform) on behalf of our clients (chatbot owners). In this capacity:

  • Our clients are the data controllers for end-user data
  • ChatBotAPP acts as a data processor
  • End-users should refer to the chatbot owner's privacy policy for information about how their data is handled
  • We process end-user data only as instructed by our clients and as necessary to provide the service

8. Cookies & Tracking

Our platform uses:

  • Session cookies - Essential for authentication and maintaining your login state
  • CSRF tokens - For security against cross-site request forgery
  • Local storage - The chatbot widget uses browser local storage to maintain conversation history

We do not use third-party advertising or tracking cookies.

9. Children's Privacy

Our platform is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us for immediate removal.

10. International Data Transfers

Some of our third-party service providers (OpenAI, Meta, Infobip, Expo) may process data outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. The "Last updated" date at the top indicates when the policy was last revised.

12. Mobile Application

Our mobile app (ChatBotAPP) is intended for our business customers, not for their end users. It shows the same data as the web panel and adds notifications.

  • Stored on your device: your login token (in the system keychain / keystore), an installation ID, your theme choice and, if your account has more than one bot, which bot you last viewed. Replies you type without a network connection wait on the device and are sent when the connection returns; a reply older than 24 hours is not sent and is removed after 7 days at the latest. When you log out yourself, the login token and any waiting replies are deleted from the device.
  • Login sessions expire after 60 days of inactivity, after which the app asks you to sign in again.
  • Notifications and signed-in devices: to deliver notifications we store a device token issued by Apple or Google, together with the installation ID, the platform and the device name set on your phone (which may contain your name), so you can see and sign out your devices in the app. You can turn notification groups off inside the app, and uninstalling the app or logging out removes the device from our list.
  • App version: the app sends its version and build number with each request, so we can tell you when an update is needed.
  • Face ID, Touch ID or fingerprint: if you enable app lock, the check is performed by your device. We never receive your biometric data; we only receive a yes or no.
  • Camera, photo library and files: used only when you choose to. A document you photograph for your bot's knowledge base is sent to OpenAI to read the text, and only that text is saved, not the photo. Photos and documents (PDF, DOC, DOCX) you attach to a support ticket are stored on our servers with the ticket so our team can see them, and are deleted together with your account.
  • Permission for OpenAI: before sending data to OpenAI (section 3.1), the app asks for your permission, and you can change your choice in the app under Profil, Podaci za OpenAI.
  • Microphone: the app does not use the microphone.
  • Account deletion: you can delete your account directly in the app (Profile, Delete account) or in the web panel. Your bots stop immediately and the account with its data is deleted after 7 days, during which you can cancel. You can also use the contact details below, or see chatbotapp.rs/data-deletion.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

Platform: app.chatbotapp.rs