Privacy Policy

Last updated: 2026-11-02

1. Who we are

chatbot.bd ("we") provides software that lets businesses answer customers on their website, Facebook Messenger, Instagram, WhatsApp and Telegram from one inbox, with automatic replies and AI assistance. This policy explains what information we handle and why.

There are two kinds of people whose data we handle: (1) businesses that sign up for chatbot.bd ("clients"), and (2) the customers of those businesses who send them messages ("end customers"). For end customers, the client decides why and how their data is used and chatbot.bd processes it on the client's behalf. For clients, chatbot.bd is responsible for the account data.

2. Information we collect from clients

Account details: name, email address, a hashed password, workspace name, language and time-zone preferences, team members you invite and their roles.

Connection details: access tokens for the Facebook Pages, Instagram accounts, WhatsApp numbers or Telegram bots you connect. These are stored encrypted and are never shown back to you or sent to your browser.

Billing records: plan, wallet balance, payment method and transaction ID of payments you make. We do not store card numbers; card and mobile-banking payments are handled by the payment provider.

Technical records: sign-in times, IP address and an audit log of important actions in your workspace, used for security.

3. Information handled for end customers

When someone writes to a connected channel we receive and store the message content, the sender's platform ID, and — where the platform provides it — their name and profile picture. If a business collects more through the chat (phone number, address, order details, form answers), that is stored too.

We use this only to run the service for the client: show the conversation in their inbox, send the replies and automations they set up, and keep order and subscriber records.

4. How we use information

To provide and secure the service; to send the messages and automations our clients configure; to process payments and keep billing records; to provide support; and to prevent abuse. We do not sell personal information and we do not use end customers' messages for advertising.

5. Who we share information with

Meta Platforms (Facebook, Instagram, WhatsApp) and Telegram, because messages travel through their services.

Payment providers such as bKash and SSLCommerz when a payment is made.

AI providers (such as Google Gemini or OpenAI) when AI replies are turned on: the customer's question and the relevant business knowledge are sent to produce an answer. A client may use their own AI account.

Our infrastructure providers (cloud hosting and Cloudflare) who store and deliver the service under confidentiality terms, and services a client chooses to connect (their own SMS gateway, mailbox, Google Sheet or webhook).

Authorities, when the law requires it.

6. Retention

We keep client account data while the account is active. Conversation data is kept until the client deletes it or the account is closed. When you ask for deletion we remove the data as described below; copies in routine backups disappear as the backups rotate. Order records may be kept, without personal details, where a business needs them for accounting.

7. Security

Access tokens and credentials are encrypted at rest, traffic is encrypted in transit, passwords are hashed, workspaces are isolated from each other, and we keep audit logs. No system is perfectly secure; if we learn of a breach affecting you we will tell you.

8. Your rights and deleting your data

You can ask to see, correct or delete the personal information we hold about you. Clients can delete conversations and contacts themselves or close their workspace. End customers should first contact the business they wrote to; you can also use our data deletion page (/data-deletion).

If you connected a Facebook Page through Facebook Login and later remove chatbot.bd from your Facebook settings (or ask Facebook to delete your data), we disconnect your pages and destroy the stored access tokens automatically.

9. Children

The service is for businesses and is not directed to children under 13. If you believe a child has given us personal information, tell us and we will remove it.

10. Changes

We may update this policy. The date at the top shows the latest version; for significant changes we will notify clients.

11. Contact

Questions or requests: [email protected].