Privacy Policy

Our two roles

We handle personal data in two different roles, and your rights work slightly differently in each.

• For our own customers and website visitors (people who create an account, are invited to a bot, contact support, or browse askmybot.ai), we decide how the data is used. Under India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary; under US state laws we are the "business" or "controller".
• For visitors to a business's bot (people who chat with a bot, leave contact details, place a Kiosk order, or use Live Chat), the business that runs the bot decides why the data is collected. We process it on that business's behalf as its Data Processor or "service provider". See Data we process for businesses.

Information we collect about account holders

Account and team

• Email address, display name and profile photo
• Sign-in details: a password (stored by Firebase Authentication as a protected hash; we never see it) or your Google sign-in profile
• Email addresses of people you invite to help manage a bot, and their role
• Your plan, usage counts and plan history

Content you add

• Documents, images, website pages, text and product catalogs you use to train bots
• Bot settings, business contact details you choose to publish, and appearance choices
• Kiosk settings such as payment links or QR codes, taxes, places and printers

Do not upload other people's sensitive personal data (for example health records, government ID numbers or payment card numbers). See the Acceptable Use Policy.

Support and feedback

• Messages you send us, feedback forms and the email address you use

Security and technical data

• IP address (stored only in hashed form for rate limiting and abuse prevention), browser and device type
• Technical request logs kept by our hosting providers
• Records of important account actions, such as plan changes, bot transfers and deletions

Our website and app do not use advertising cookies, cross-site tracking pixels or third-party analytics tools. Product statistics (such as how many questions a bot answered) are counted inside Ask My Bot. When you search the Marketplace, we count the search and keep the search words if no shop matched, so we can see what people look for. Nothing that identifies you is kept with them, and searches that look like a phone number, email or web address are not kept.

How we use it, and why we are allowed to

• Provide the service you signed up for: create and run your account and bots, process training content, send service emails (sign-in, verification, plan and security notices). Basis: your consent when you sign up, and the contract with you.
• Support: answer your questions and fix problems. Basis: your request.
• Security and fraud prevention: rate limits, abuse checks, investigating incidents. Basis: legitimate use and legal obligations (for example India's CERT-In directions).
• Legal compliance: tax, accounting, responding to lawful requests. Basis: legal obligation.
• Improving reliability: aggregate, non-identifying counts and timings about how features perform.

We do not send marketing emails today. If we start, we will ask first (where the law requires) and every message will include an unsubscribe link.

Data we process for businesses (bot, Kiosk and Live Chat visitors)

When you use a chat, widget, Kiosk or Live Chat run by a business on Ask My Bot, that business is responsible for your personal data, and its own privacy policy applies. We process the data only to provide the service to that business. Depending on how the business sets up its bot, this can include:

• Chat messages and voice questions, sent to our AI provider to produce an answer. Voice recordings are not stored by Ask My Bot.
• Contact details you share (name, email, phone, company) and a short summary of your request, so the business can follow up. The business may see a score showing how likely you are to need follow-up.
• Questions asked, so the business can see what visitors ask and which questions its bot could not answer.
• Kiosk orders: items, the checkout details the business asks for (such as name, phone, email, delivery address, table or room), notes and payment status. Each order also records which version of the Terms of Sale the customer agreed to and when, so the business and Ask My Bot can answer questions about the order, handle complaints and prevent misuse such as fake or refused cash-on-delivery orders.
• Live Chat conversations with the business's staff.
• Visit counts, using a hashed browser and IP fingerprint, not your identity.

When a customer submits information through a merchant's Kiosk, Ask My Bot processes that information to provide the ordering service and shares it with that merchant and its authorized collaborators for order processing and fulfillment.

We do not sell visitor data, use it for our own marketing, or use it to train AI models. To access, correct or delete what a business holds about you, contact that business first. If you cannot reach it, email us at support@askmybot.ai with the bot or business name and the contact details you used, and we will pass your request on and help the business respond.

Cookies and storage on your device

We do not use advertising or tracking cookies. The app stores a few items in your browser so it works:

• Sign-in state (Firebase Authentication)
• On bot chats: a random visitor ID, a session ID and your recent chat history (up to 100 messages) so a conversation continues when you come back. Use Clear chat in the chat menu to remove the history.
• On Kiosk pages: your cart and links to your own receipts. Receipts do not store your name, phone, email or address, and finished orders are forgotten after 30 days.
• On the Marketplace: shops you save with the heart, and a list of your orders from any shop (shop name, order number, status, total and date; no name, contact details or receipt link). They stay in your browser only, are never sent to us, and finished orders are removed after 30 days. Remove a saved shop with its heart, or clear the browser's site data to remove both.
• On the Marketplace: the city you choose under Location (its name only), so shops in that city show first next time. If you tap Use my current location, your browser asks for permission first. Your position is then used only inside your browser, to find the nearest city with shops and show how far each shop is, and it is never sent to us or saved. Reset removes the chosen city.
• Shop pages moved from app.askmybot.ai to www.askmybot.ai. On your first visit to www.askmybot.ai, your browser copies your saved shops, your orders list, receipt links, chosen language and visitor ID from app.askmybot.ai, inside your browser; nothing is sent to us.
• Preferences such as theme or layout

Do Not Track and Global Privacy Control: because we do not track you across websites or sell or share personal data for advertising, there is nothing extra to switch off. We treat a Global Privacy Control signal as a request to opt out of any sale or sharing.

Who we share data with

We do not sell or rent personal data, and we do not share it for targeted advertising. We share it only:

• With service providers that run the service for us, under contracts that limit how they use it. They are listed, with what they receive and where, on our Subprocessors page.
• With the business whose bot you use, and the team members it authorises, as described above.
• Publicly, when you choose: content and business details you publish on a public bot page, widget or the Marketplace.
• With your team: people you invite can see the bots and data you share with them.
• For legal reasons: when required by law, court order or a lawful request from a government authority, or to protect people's safety and our rights.
• In a business transfer: if Ask My Bot is merged or sold, under the same protections as this policy.

AI providers

To answer questions, read documents and extract products, relevant content and chat messages are processed by the Google Gemini API, and indexed knowledge is stored in Pinecone. Google states that, on paid Gemini API services, prompts and responses are not used to improve its products and are kept for a limited time to detect abuse. Private bots restrict who can use them inside Ask My Bot; their content is still processed by these providers to make the bot work.

Address lookup (OpenStreetMap)

When a business owner or admin adds a location pin in Settings, or a customer sets a delivery location at checkout (from a map link or the device's current location), our server sends only the pin's coordinates to Nominatim, a free address-lookup service run by the OpenStreetMap Foundation in the United Kingdom, to fill in the address. No name, contact, order, account or bot details are sent. The location visitors use to find nearby businesses in the Marketplace never leaves their browser. The OpenStreetMap Foundation's own privacy policy applies to its service. The business decides what location it saves and publishes; an approximate pin is rounded to about 1 km before it is saved.

Where data is stored

Ask My Bot's data is stored and processed in the United States: Google Cloud and Firebase (database in the US multi-region, files in us-east1, processing in us-central1), Pinecone on AWS us-east-1, Vercel and Zoho Mail's US data centre. If you use Ask My Bot from India or another country, your data is transferred to the United States. India's DPDP Act allows this unless the Government of India restricts transfers to a country; we will follow any such restriction. Location pins that a business adds, and delivery locations set at checkout, are also sent to the OpenStreetMap Foundation (United Kingdom) for address lookup, as described above.

How long we keep data

• Account data: while your account is open. You can delete your account yourself in Settings → Sign-in & security → Delete account; we then delete it and the bots you own, usually within an hour, except records we must keep by law (such as billing and tax records) and a record that the deletion happened (dates and IDs only), kept for one year.
• Bots and training content: until you delete them. Deleting a bot removes its records, files and indexed knowledge through a background clean-up that retries until it finishes.
• Leads, Kiosk orders and visitor questions: until the business deletes them or deletes the bot.
• Live Chat conversations: 90 days after they are resolved, 30 days if missed, 1 day if abandoned.
• Chat conversation state: 7 days. Rate-limit and visit-counting records: a few days at most. Marketplace search words and counts: 30 days.
• Backups: deleted data can remain in database backups for up to 98 days (daily backups are kept 14 days, weekly backups 98 days, and point-in-time recovery 7 days) before it is overwritten.
• Provider logs: kept by our providers for the periods set in their terms.

How we protect data

• Encryption in transit (HTTPS) and at rest (by our cloud providers)
• Role-based access: bot owners, invited admins and viewers see only what their role allows; leads and orders can only be written by our servers
• Verified email required for password sign-ins, rate limits and abuse checks
• Daily and weekly database backups and point-in-time recovery
• Application logs that leave out chat text, visitor identity and contact details

No online service is perfectly secure. If we learn of a personal data breach that affects you, we will tell you without undue delay, along with what happened, what it means for you and what we are doing about it, and we will notify the authorities the law requires (including the Data Protection Board of India and CERT-In).

Your rights

Everyone

• Access: a summary of the personal data we hold about you, how we use it and who we shared it with
• Correction and update: fix or complete inaccurate data
• Erasure: delete your data, unless we must keep it by law
• Withdraw consent: as easily as you gave it. Withdrawal does not affect processing already done, and some features may stop working.
• Complain: to our Grievance Officer (below), and then to a regulator

India (Digital Personal Data Protection Act, 2023)

• All the rights above, plus the right to nominate another person to use your rights if you die or become unable to act.
• If you are not satisfied with our answer, you can complain to the Data Protection Board of India through its online complaint system.
• You can ask for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India.

United States

Depending on your state (for example California, Virginia, Colorado, Connecticut or Texas), you may have the right to know and access, correct, delete and get a portable copy of your personal data; to opt out of sale, sharing, targeted advertising and certain profiling (we do none of these); to appeal a decision about your request; to use an authorised agent; and not to be treated differently for using your rights.

How to make a request

• Email support@askmybot.ai with the subject "Privacy request", from the email address on your account, and say what you want (access, correction, erasure, nomination or withdrawal).
• We may ask you to confirm it is you. Visitors to a business's bot should include the bot or business name and the email, phone or order number they used.
• We answer within 30 days. Where the law allows a longer period (up to 90 days in India, 45 days plus an extension in some US states), we will tell you if we need it and why.
• Many things you can do yourself in the app: download a copy of your account data (Settings → Sign-in & security → Download my data); delete your whole account (Settings → Sign-in & security → Delete account); edit your profile; delete bots, training sources, leads and Kiosk orders; and export leads and orders as CSV files.

Children

Ask My Bot accounts are for people aged 18 or older. Businesses may not use Ask My Bot for bots aimed at children. We do not knowingly collect personal data from children; if we learn that we have done so without verifiable consent from a parent or guardian, we will delete it. Parents or guardians can contact us at the address below.

Changes to this policy

We will update the date at the top when this policy changes. For material changes we will tell account holders by email or in the app before the change takes effect.

Contact and Grievance Officer

Questions, requests and complaints about personal data go to our Grievance Officer: