Legal

Privacy Policy

Last updated: 4 October 2026 · Effective date: 4 October 2026

This Privacy Policy explains how BotNesia ("BotNesia", "we", "us") collects, uses, stores, retains, shares, and deletes information when you use the BotNesia AI workforce platform and website, including when you sign in with Google. It applies to app.botnesia.uk and related BotNesia services.

1. Information we collect

Information from Google Sign-In

When you choose "Continue with Google", Google verifies your identity and returns basic profile information limited to the scopes you approve. We request only the standard OpenID Connect scopes openid, email, and profile, and we receive and store:

• Name — your display name from your Google Account.
• Email address — your Google Account email, which we treat as verified once Google confirms it.
• Google account identifier — the unique Google account subject ID used to recognize your account on future sign-ins.
• Profile information — basic profile details returned by the approved scopes (for example, a profile picture URL). We do not request any Google scope beyond openid, email, and profile.

Account and service data

• Account and workspace details you or your team create, including organization/workspace name, role, and settings.
• Content and data you submit to the service, such as chat messages, knowledge sources, and workflow configuration.

Usage and technical data

• Log data, IP address, browser and device information, and timestamps, used for security, reliability, and abuse prevention.
• A session token stored in your browser's local storage to keep you signed in. This is strictly necessary for authentication.

2. How we use information

• Authentication — to verify your identity and sign you in.
• Account creation and linking — to create a new BotNesia account from a verified email, or to link Google sign-in to an existing account.
• Tenant/workspace authorization — to determine and grant access to the workspace/organization you are authorized to use. Authorization is based on authoritative membership records held by BotNesia, never on values supplied by the browser.
• To operate, maintain, secure, and improve the service, and to detect and prevent fraud or abuse.
• To provide support and send service-related communications.
• To comply with legal obligations and enforce our Terms of Service.

We do not use your data for advertising or profiling, and we do not sell your personal data.

3. Google API Services — data use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Sign-In is used only for authentication. We use the information Google returns only to sign you in, create or link your account, and authorize access to the workspace you belong to.
• Use limited to approved scopes. We use Google user data only for the purposes described in this policy and the consent screen you approve, and only within the scopes you grant (openid, email, profile).
• No unrelated purposes. We do not use Google user data for advertising, profiling, or any purpose that is not clearly described here or in the consent screen.
• No sale or transfer. We do not sell Google user data and do not transfer it to third parties except as needed to provide or improve the service, to comply with law, or as part of a merger/acquisition, and never for advertising.
• No other Google APIs. We do not request or access Gmail, Google Drive, Google Calendar, or other Google APIs for Google Sign-In, and we do not claim to use Google APIs that we do not use.
• No AI training on Google data. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models, unless that use is separately disclosed and you explicitly consent to it.
• No non-consensual intimate imagery. We do not use Google APIs, or any Google user data, to create, generate, facilitate, or process non-consensual intimate imagery (NCII) or other abusive or exploitative content.

4. Google API Services — data retention and deletion

• Retention. Google sign-in data (name, email, Google account identifier, and profile information) is retained while your BotNesia account is active, or as needed to provide the service and meet legal obligations.
• Deletion. When you or your workspace administrator delete your account, we delete or anonymize your Google sign-in data from active systems within 30 days, except for limited records we must keep by law or for security and fraud-prevention purposes.
• Backups. Backups are rotated and overwritten on a periodic schedule, so deleted data is removed as backups expire.
• How to delete. See section 10 for the account/data deletion procedure, or revoke BotNesia's access at any time from your Google Account permissions page (myaccount.google.com/permissions).

5. Artificial intelligence and content safety

BotNesia provides AI agents that help with business tasks such as customer service, sales, finance, analysis, operations, inventory, procurement, and marketing.

• Google user data is not used to create, train, or improve generalized AI models unless that use is separately disclosed to you and you explicitly consent.
• BotNesia does not use Google APIs to create, facilitate, or process non-consensual intimate imagery (NCII), and does not permit using the service to create or distribute such content or other abusive material.
• AI output can be inaccurate or incomplete and is provided for assistance only. You are responsible for reviewing output before relying on it.

6. How we share information

• We do not sell your personal data.
• Service providers (processors). We share information with third parties that help us operate the service — such as hosting, database, infrastructure, email delivery, and payment processing providers — only as needed to provide the service, and under confidentiality and data-protection obligations. We do not share Google user data with these providers beyond what is necessary to authenticate you and operate your account, and never for advertising.
• Legal and safety. We may disclose information if required by law, or to protect the rights, safety, and security of BotNesia, our users, or the public.
• Business transfer. Information may be transferred as part of a merger, acquisition, or sale of assets, subject to this policy.

7. Data retention (general)

We retain information for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. When it is no longer needed, we delete or anonymize it. Section 4 describes retention and deletion specifically for Google sign-in data.

8. How we protect information

• Encryption in transit using HTTPS/TLS for the platform and this website.
• Password hashing and secure session handling for accounts that use password sign-in.
• Tenant-isolated data access with role-based access control, so a user can only reach the workspace they are authorized for.
• Access restrictions, logging, and monitoring of our systems.

9. Your rights

Subject to applicable law, you may:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account or personal data.
• Withdraw consent or object to certain processing, where consent is the basis for processing.

10. Account and data deletion procedure

1. Email [email protected] from the email address registered to your BotNesia account.
2. Use the subject line "Data deletion request" (or "Data access request" / "Data correction request") and describe what you want.
3. We will verify your identity to protect your account, then act on valid requests within 30 days.
4. Deleting your account removes or anonymizes your personal data, including Google sign-in data, from active systems, except for limited records we must keep by law or for security. If you belong to an organization, your organization administrator may also manage your account.
5. You can also revoke BotNesia's access to your Google Account at any time at myaccount.google.com/permissions.

11. Children

BotNesia is a business platform and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can remove it.

12. International transfers

We and our service providers may process and store information in countries other than your own. Where required, we take steps to ensure that information continues to receive appropriate protection.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of BotNesia after an update means you accept the revised policy.

14. Contact us

For questions about this Privacy Policy, or to exercise your data rights: