Privacy Policy for BotBhai

Last Updated: October 26, 2026

1. Introduction

Welcome to BotBhai ("we," "us," or "our"). We provide an AI-powered sales and support agent for businesses that answers customers on Facebook Messenger, Instagram DM and WhatsApp, plus an e-commerce and CRM dashboard. This policy explains how we handle data processed through our integration with Meta platforms and our Artificial Intelligence and infrastructure providers.

2. Information We Collect

Business Account Data: Name, email, and authentication tokens required to manage your account.
Google Sign-In Data: If you choose "Continue with Google", we receive your name, email address, and profile picture from your Google account. We do not receive your Google password or access your Gmail, Drive, contacts, or any other Google data.
Meta Platform Data: Page/Account IDs, names, and access tokens provided via Facebook Login or Instagram Login when you connect a channel.
Customer Interaction Data: Message content, timestamps, and sender profile names from your connected Facebook Pages, Instagram accounts, and WhatsApp Business number.

3. How We Use Your Data

We use your data to facilitate the following automated services:

AI Response Generation: Analyzing message context and generating replies using Large Language Models.
Order & Catalog Automation: Routing data between your connected channels and our database to create orders or update inventory.
Service Delivery: Sending composed replies back to Messenger, Instagram, or WhatsApp.

4. Google User Data

When you sign in with Google, we request only the basic openid, email, and profile scopes. We use this information solely to:

Create your BotBhai account and the business workspace attached to it.
Authenticate you on future logins.
Display your name and picture in the dashboard and send account-related emails (e.g. billing, security, team invitations).

We do not sell Google user data, use it for advertising, share it with third parties (other than our authentication and database provider, Supabase, which stores it on our behalf), or use it to train AI models. BotBhai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve, or train generalized or non-personalized AI/ML models, and is never transferred to anyone for that purpose. We retain it while your account is active and delete it within 30 days of an account deletion request. You can revoke BotBhai's access at any time from your Google Account permissions page and request deletion of your data as described in Section 6.

5. Third-Party Sub-Processors

We transfer data to the following third-party service providers to function. We have Data Processing Agreements (DPAs) in place where applicable.

Provider	Purpose	Data Shared
Google Cloud (Vertex AI)	AI text and image understanding, and reply generation	Message content, product images, conversation context
Supabase	Database, authentication (including Google Sign-In), and file storage	User accounts, chat logs, product data
n8n (self-hosted)	Optional automation backend for the merchant support-chat widget only (not used for customer-facing AI replies)	Merchant support messages

*Data shared with our AI provider is not used to train their public models by default.

6. Data Retention & Deletion

We retain conversation logs, product data, and account information for as long as your account is active, so the AI agent can use conversation history for context.

To request deletion of your data: email alamtanvir2006@gmail.com from the address registered on your account, with the subject line "Data Deletion Request", and the name of the business account to delete.

We confirm receipt within 2 business days.
We permanently delete your account data — including connected channel tokens, conversations, messages, customer records, and product data — within 30 days of confirmation.
Deleting a Facebook Page, Instagram account, or WhatsApp number connection from Meta also removes BotBhai's ability to access new data from that channel; existing stored data is removed per the process above.
Some records may be retained beyond 30 days only where required by law (e.g. billing records for tax purposes).

7. Security

Data is encrypted in transit (HTTPS/TLS). Access tokens for connected channels are stored server-side and never exposed to the browser. Each business's data is isolated from other businesses, and access is limited to the account owner and the team members they invite.

8. Cookies

We use only essential cookies to keep you signed in. We do not use advertising or third-party tracking cookies.

9. Children's Privacy

BotBhai is a business tool and is not directed at children under 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated "Last Updated" date.

11. Contact

Email: alamtanvir2006@gmail.com
Address: Mirpur-13, Dhaka-1216, Bangladesh.