Privacy policy

Botployment helps businesses manage customer conversations, appointments and daily operations. This policy explains how Botployment SA, Costa Rica, handles personal information about account holders, business staff, customers and other people whose information is entered into the service.

For privacy questions, contact support@botployment.com.

A business using Botployment chooses the information it collects, the features it enables and which staff can access its records. Its own privacy practices also apply. You can contact that business about its records or contact us for help with your request.

Information we process

We process the following information to provide the service:

• Account details, sign-in identities, sessions and roles: to authenticate users and enforce access permissions.
• Conversations, contact details, supported attachments, voice messages and shared locations: to deliver messages, maintain history, assist staff and provide enabled AI features.
• Appointment details, availability, services and employee assignments: to manage bookings and calendar connections.
• Orders, invoices, transactions, employee records, forms and workflow activity: to provide the operational features a business uses.
• Integration credentials and settings: to operate the services you connect.
• Support requests, technical diagnostics and usage records: to answer questions, investigate problems, manage usage and protect the service.

Session cookies support sign-in. Only provide information about other people when appropriate for the feature you are using.

Who receives information

Authorized business users access records according to their permissions. Customer-facing features share information intended for their recipients.

We use Vercel for hosting, MongoDB Atlas for database storage, and the AI providers described below for their stated purposes. Connected services receive information needed for the features you enable, such as delivering a message or copying an appointment to a calendar. People with access to that calendar may see copied appointments under its sharing settings.

Information may also be disclosed when required by law. The additional restrictions for Google data below apply to its use and onward sharing.

Google sign-in and Calendar

Google sign-in uses your identity and email to authenticate you. Connecting Google Calendar is a separate, optional action. We retain connection credentials and settings to operate the features you select. Calendar names and access permissions help you choose a calendar. Connecting alone does not enable every synchronization feature.

External availability

We read event times and limited information needed to identify busy periods and recognize copies of Botployment appointments. For this check, we do not request external event titles, descriptions, locations or attendee identities.

These event records are processed temporarily to calculate availability rather than saved as imported personal events. Booking features, including AI, can receive the resulting available times.

Linked Botployment appointments

When you enable copying appointments to Google, we send their titles, descriptions and times to the selected calendar. If you also enable updates from Google, supported changes to those fields can update the linked Botployment appointment. We check business ownership and permissions before applying changes. This does not import unrelated personal events.

Google Limited Use

Botployment’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data policy.

We do not sell Google data or use it for advertising. We do not use or permit recipients to use Google Workspace data, including information derived from it, to train generalized AI or machine-learning models.

Transfers are limited to disclosed user-facing purposes with the required consent, necessary security purposes, legal obligations, or a business transfer with the explicit prior consent required by Google’s policy.

People may access Google data only with documented permission to view specific information, when necessary for security or legal compliance, or for internal operations using aggregated and anonymized data as permitted by Google’s policy.

AI features

We have opted out of DeepSeek?s use of our data for model training.

DeepSeek processes conversation text, relevant business context and assistant-tool results to generate replies. It also processes conversation summaries and product-help questions.

Booking-tool results can include available times, appointment identifiers, employee and service information, start and end times, duration and booking outcomes. Available times can be derived from Google data, and linked appointment times can reflect changes made in Google.

The structured appointment results sent to AI exclude Google event titles, descriptions, attendee information and raw Calendar responses. This describes that specific data flow; people may still include personal information in messages or other conversation content processed by AI.

OpenAI converts catalog and search text into numerical representations used to find relevant information. It also transcribes incoming voice messages. Search text may be generated during an AI conversation. Transcription receives channel audio rather than Calendar events.

Conversations, assistant-tool exchanges, summaries and diagnostic context can remain stored in Botployment. Processing a request, retaining records and training a model are different uses. This policy does not promise zero retention by AI providers. The Google-data restrictions above also apply where AI processing involves Google data or information derived from it.

How we protect information

Sign-in and server-side permissions restrict access by user, business, store and customer. Calendar requests use authenticated, encrypted connections, and we limit the information requested for each feature.

Our MongoDB Atlas database uses encrypted connections and encryption at rest. These controls reduce risk but cannot eliminate every possibility of unauthorized access or loss.

Retention and deletion

External calendar records used to calculate availability are processed temporarily rather than retained as imported personal events.

Other records, including appointments, conversations, tool exchanges, diagnostic context and business records, can remain stored. These records do not have a universal automatic expiry. Removal requests require review of the information involved and any applicable operational or legal retention needs.

Backups and copies held by other providers are separate from active records. Removing a connection or clearing conversation history does not erase those copies.

Disconnecting and clearing history

Disconnecting Calendar removes its connection credentials and settings. Your Google sign-in identity link remains. Botployment appointments and synchronization history also remain, and existing copies in Google Calendar are managed separately.

Clearing a conversation hides earlier history from the active conversation and resets its summary. It does not physically erase stored messages, assistant-tool exchanges or diagnostic context.

Your choices and requests

Manage Calendar features or disconnect under Account settings → Connections. You can separately revoke access through your Google account.

To request profile removal or anonymization, use Account settings → Personal profile removal. For other privacy requests, or if you cannot sign in, email support@botployment.com.

Submitting a request starts a review; it does not instantly delete records or close a business. We verify identity and scope before handling the request. Our deletion instructions explain the available steps and the distinctions between retained records:

Public website analytics

We use free Cloudflare Web Analytics only on reviewed public marketing pages to measure aggregate visits and performance. It does not use analytics cookies or visitor fingerprinting. We do not send form contents, custom events, URL queries or fragments. Sign-in, private CRM, checkout, payment and other unmeasured pages do not load the beacon. Some visits with nonpublic referrer paths are omitted to avoid collecting sensitive URLs.