Privacy Policy

Last updated: December 2025

1. Introduction

This Privacy Policy ("Policy") describes how BotBot ("we," "us," or "our") collects, uses, stores, shares, processes, and protects personal data in connection with our website, applications, products, and services (collectively, the "Services"). This Policy applies to all users and visitors of our Services, regardless of location.

We are committed to protecting your personal data and respecting your privacy rights. This Policy is designed to comply with applicable data protection laws, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, "LGPD"), Law No. 13,709/2018, and the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), as well as other applicable U.S. state privacy laws.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. Data Controller and Processor

BotBot, located at Av. Brig. Faria Lima, 1461-1485, Pinheiros, São Paulo, Brazil, is the data controller responsible for processing your personal data. For GDPR purposes, we are the data controller when processing your personal data. For LGPD purposes, we act as the "controller" (controlador) of your personal data.

For inquiries related to data protection, you may contact our Data Protection Officer (DPO) at: [email protected].

3. Categories of Personal Data We Process

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity and Contact Data: Name, email address, postal address, telephone number, and other contact information you provide when registering or contacting us.
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our Services.
• Usage Data: Information about how you interact with our website, products, and services, including browsing patterns, features used, time spent on pages, clicks, scrolls, and items viewed or searched for.
• Cookie and Device Data: Information collected through cookies, web beacons, pixels, and similar technologies, including unique device identifiers.
• Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.

We do not knowingly collect or process Special Categories of Personal Data (as defined under GDPR) or Sensitive Personal Data (as defined under LGPD and CPRA), which include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life, or sexual orientation.

4. Technologies We Use and Their Impact

Our website and services utilize the following technologies that may collect your data:

• Vercel Hosting and Infrastructure: We use Vercel to host our website and provide infrastructure services. Vercel may collect technical information such as IP addresses, browser types, system information, pages visited, and timestamps for security, performance optimization, and service provision purposes. Vercel's Privacy Policy
• Vercel Analytics and Speed Insights: We use Vercel's analytics tools to collect anonymous usage data to improve our website performance and user experience. These tools collect information about page views, device information, navigation paths, and interaction patterns. Data is anonymized and aggregated where possible. Vercel Analytics Documentation
• Google Analytics: We use Google Analytics to understand website usage patterns. Google Analytics collects information such as your IP address, browser type, operating system, the pages you view, time spent on pages, and other browsing information. We use IP anonymization where possible and have configured data retention periods in compliance with applicable laws. Google's Privacy Policy

5. Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies to identify your browser or device and to collect, store, and share certain information. Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie.

We use the following types of cookies and similar technologies:

• Strictly Necessary Cookies: Required for the basic operation of our website, enabling core functionality such as security, network management, and account access. You cannot opt out of these cookies as the website cannot function properly without them.
• Functional Cookies: Enable us to provide enhanced functionality and personalization, such as remembering your preferences and settings. While not strictly necessary, these cookies significantly improve user experience.
• Analytics and Performance Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously. These cookies allow us to count visits and traffic sources to measure and improve the performance of our site.
• Targeting and Advertising Cookies: Record your visit to our website, the pages you have visited, and the links you have followed to deliver more relevant content and advertisements based on your interests. These may also be used to limit the number of times you see an advertisement.

You can control cookies through our cookie consent management tool, which allows you to accept or decline cookies when you first visit our website. You can also modify your cookie preferences at any time by clicking on the "Cookie Settings" link in the footer of our website. www.aboutcookies.org or www.allaboutcookies.org.

Please note that refusing or disabling cookies may impact your experience and the services we can offer, as certain features of our website may not function properly without cookies.

6. Legal Bases for Processing

We process your personal data only when we have a valid legal basis to do so. Depending on the specific processing activity, we rely on the following legal bases:

• Consent: Where you have given us explicit consent to process your personal data for specific purposes, such as sending you marketing communications or placing non-essential cookies.
• Contractual Necessity: Where processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided that your fundamental rights and freedoms do not override those interests.
• Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.

7. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Service Providers: Third-party companies that provide services on our behalf, such as hosting, analytics, customer support, and payment processing. These providers are contractually obligated to protect your data.
• Business Partners: Trusted partners with whom we collaborate to deliver or improve our services, subject to appropriate data protection agreements.
• Legal Requirements: We may disclose your data when required by law, court order, or governmental request, or when we believe disclosure is necessary to protect our rights, safety, or property.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of the transaction.

We do not sell your personal data to third parties.

8. International Data Transfers

Your personal data may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer personal data internationally, we implement appropriate safeguards to ensure your data is protected in accordance with applicable laws, including Standard Contractual Clauses (SCCs) approved by the European Commission and other legally recognized transfer mechanisms.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, and applicable legal requirements.

10. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to Restrict Processing: You have the right to request that we limit the processing of your personal data under certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing or when processing is based on legitimate interests.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within the timeframe required by applicable law.

11. Children's Privacy

Our Services are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information as soon as possible.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

12. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, regular security assessments, and employee training.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this Policy.

We encourage you to review this Policy periodically to stay informed about how we are protecting your data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Data Controller: BotBot
Email: [email protected]
Postal Address: Av. Brig. Faria Lima, 1461-1485, Pinheiros, São Paulo, Brazil