Privacy policy

1.Who we are and what this covers

This policy explains how we handle personal data about:

• people who visit our website;
• our customers and their team members who have a ReeBot account; and
• people who chat with, message or call an assistant that one of our customers runs on ReeBot (“end users”), in the limited way described in section 3.

2.Our role: controller and processor

For account, billing and website data, ReeBot is the controller: we decide why and how that data is used.

For the content our customers add and the conversations, leads, bookings, orders, reviews and call transcripts their assistants record, the business running the assistant is the controller and we are its processor. We process that data only on the business's instructions, under our data processing addendum.

3.If you chatted with a business's assistant

The business you contacted decides what its assistant collects and how it is used, and its own privacy notice applies. The chat window links to it when the business has provided one. Please send requests about your data, such as access or deletion, to that business. If you contact us instead, we will pass your request on to them.

What the service records for the business, depending on how it is set up:

• your messages and the assistant's replies, the page of the business's website you were on (without query strings), your browser's language and type, and any rating you give;
• details you choose to share, such as your name, email address, phone number or company, and your answer to whether you want follow-up emails;
• bookings and orders you make, and what you write in them;
• on messaging apps, your app user ID and profile name or phone number; on phone calls, your phone number and a text transcript of what you say (calls are not recorded as audio).

The chat widget stores a random token in your browser so you can continue a conversation, only after you open the chat (see cookies). It doesn't track you across websites. You are always told that you are chatting with an AI.

4.Data we collect about our customers and website visitors

5.How we use it, and our legal basis

6.AI processing

• To write answers, search knowledge and run features such as summaries, lead scoring, follow-up drafts and review replies, the relevant text is sent to the AI providers listed on our sub-processors page. We send only what each task needs: for example, the assistant is told whether contact details are on file, not what they are, and weekly insight reports remove email addresses and phone numbers first.
• We don't use customer content or conversations to train AI models, and we use AI providers under terms that don't allow them to train on data we send.
• Lead scores and summaries help businesses prioritise; they are not used to make decisions with legal or similarly significant effects about anyone. We don't make such decisions ourselves.

7.Who we share data with

• Sub-processors who run parts of the service for us, such as hosting, AI providers, email delivery and Stripe. They are listed, with their locations, on our sub-processors page, and are bound by data protection terms.
• Services you connect, such as WhatsApp, Instagram, Telegram or Twilio, when you link your own account to an assistant.
• Authorities and advisers when the law requires it, or to protect rights and safety, and our professional advisers under confidentiality.
• A buyer or successor if our business is sold or reorganised, under the same protections.

We don't sell personal information, and we don't share it for cross-context behavioural advertising.

8.International transfers

Some sub-processors, including AI providers and Stripe, are based in the United States or elsewhere outside the UK and EU. Where data leaves the UK or the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework and UK extension, where the recipient is certified), or on the European Commission's Standard Contractual Clauses with the UK addendum, plus additional safeguards where needed.

9.How long we keep data

• Account data: while your account exists. When you delete your account, your name, email and password are erased straight away and your sign-in sessions are deleted.
• Workspaces you are the only member of are deleted with your account, including their assistants, knowledge, conversations, leads and uploaded files; any paid subscription is cancelled.
• Customer data inside a workspace: until the business deletes it, its retention settings delete it automatically, or the workspace is deleted.
• Audit log entries: 2 years. Error reports: 90 days. Failed background tasks: 30 days. Payment webhook records: 400 days.
• Billing and tax records: as long as tax and accounting law requires, usually up to 6 to 10 years depending on the country.
• Backups are overwritten on a rolling cycle, so deleted data disappears from them over the following weeks.

10.How we protect data

We use TLS for all traffic, Argon2id password hashing, keyed hashes for every token, AES-256-GCM encryption for provider and channel credentials, strict separation between workspaces, role-based access, rate limits and an append-only audit log. Read more on our security page and in annex 2 of the data processing addendum.

11.Your rights

Depending on where you live, you can ask to:

• access the personal data we hold about you and get a copy in a portable format;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to how we use it, including for direct marketing;
• withdraw consent at any time, where we rely on it.

You can download a copy of your account data and delete your account yourself from Account settings. For anything else, email the contact details below. We will reply within one month and may need to confirm your identity first.

California residents have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We don't sell or share personal information or use sensitive personal information to infer characteristics. You can use an authorised agent to make a request.

If you are unhappy with how we handle your data, please tell us first. You can also complain to your data protection authority, for example the Information Commissioner's Office in the UK or the supervisory authority where you live or work in the EU.

12.Children

ReeBot is a service for businesses and isn't directed at children. Accounts are for people aged 18 or over. Businesses must not use their assistants to collect children's data without the protections the law requires. If you think a child has given us personal data, contact us and we will delete it.

13.Changes to this policy

We will update this page when our practices change and show the new effective date at the top. If a change materially affects you, we will tell you by email or in the dashboard first.

14.Contact

• ReeBot