Privacy policy

The controller of your personal data is BOTOOLS, 47 Rue Vivienne, 75002 Paris, France. For any question or request, write to us at [email protected].

We only collect what the service needs:

• Account: email address, display name, language, profile picture if you add one, password (only stored as a hash, never in plain text), date you accepted the terms.
• Sign-in and security: IP address, device browser and system, approximate country and city derived from the IP address, active sessions, history of sign-ins and failed attempts, known devices.
• Two-factor authentication: encrypted secret and recovery codes stored as hashes.
• Workspaces and teams: workspace name and logo, members, roles, invitations (email address of the invited person).
• Bots: name, platform, bot ID and username, profile picture, encrypted token.
• Billing: invoices, amounts, period, promo code, and payment transaction details sent by our provider (cryptocurrency, network, amount, transaction ID). We never process bank card data.
• Communications: emails we send you and their delivery status, exchanges with our support.
• Activity log: actions taken in workspaces and on accounts (creating a bot, inviting someone, changing a role, etc.).

Each use rests on a specific legal basis:

• Providing the service and managing your account, workspaces and bots: performance of the contract.
• Collecting payments, issuing and keeping invoices: performance of the contract and legal obligation.
• Securing accounts and the service (detecting unusual sign-ins, preventing abuse and fraud, activity log): legitimate interest.
• Sending you service emails (address confirmation, security, invitations, invoices, renewal reminders): performance of the contract.
• Producing overall usage statistics that do not identify you: legitimate interest.

We do not use your data for advertising and we do not sell it.

Your data can be accessed by authorised staff of BOTOOLS, and by members of your workspaces for what concerns those workspaces. We use the following providers, who act on our instructions:

• OVHcloud: hosting of the service and the database, in France;
• Cloudflare: content delivery network and protection of the site against attacks;
• Resend: sending transactional emails;
• 2328: processing crypto payments;
• Telegram and Discord: when you connect a bot, we use their interfaces with the token you provide.

Some providers (notably Cloudflare and Resend) may process data outside the European Union, especially in the United States. These transfers are covered by the safeguards provided by the GDPR, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

We keep your data for the following periods:

• Account, workspaces and bots: as long as your account exists. After a deletion request, you have 30 days to cancel it; your data is then deleted or anonymised.
• Invoices and payment data: 10 years, as required by accounting law.
• Activity log and history of sent emails: 12 months.
• Sessions: until they expire or are revoked, then 30 days.
• Known devices: 12 months after their last use.
• One-time links (email confirmation, password reset, invitation): until they expire, then 30 days.

Passwords are protected with the argon2id algorithm, bot tokens and two-factor secrets are encrypted with AES-256, and all communications go through an encrypted connection (HTTPS). Access to administration is restricted and protected by two-factor authentication. Sessions can be reviewed and revoked at any time from your account.

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to set directives on what happens to it after your death. Most of these actions are available directly from "My account" (editing your profile, deleting your account, revoking sessions).

To exercise your rights, write to us at [email protected]. We reply within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Botools uses no advertising cookies and no audience measurement tools. The only items stored on your device are strictly necessary for the service to work and are therefore exempt from consent:

• bt_rt: keeps your session securely (not readable by scripts), 30 days;
• bt_auth: tells the site a session exists, with no personal data, 30 days;
• bt_rt_admin: only used by administrators while working on an account, for the length of that intervention;
• BT_LOCALE: remembers your language, 1 year;
• browser local storage: light or dark theme, last workspace opened, dismissed announcements, and during sign-in the pending two-factor step;
• Cloudflare may set technical security cookies to protect the site against malicious bots.

We will update this policy if our processing changes. The last update date is shown at the top of this page, and you will be informed by email of any significant change.