Privacy Policy

• We use your data to run your bots, and for nothing else you wouldn't expect.
• We don't sell your data, and we don't use it to train AI models. No ads, no ad trackers.
• API keys and app logins are encrypted at rest and never shown again.
• Your Claude or ChatGPT login never leaves your computer.
• Meeting notes only listen after you say yes. The audio becomes text and isn't kept.
• You can export everything or delete your account from your Account page.

Your account

Your email address (once you add one), your name if you give it, your time zone, your plan and billing status, and the date you confirmed you're 18 or older.

Your bots

Each bot's name, look, personality, instructions, jobs, brain choice, trust level and rules, routines, and the channels and apps you turn on.

Messages and what your bot remembers

Conversations with your bot on every channel, things you ask it to remember, its notes, the people you've approved it to contact, and approvals you've given or declined.

Receipts

A record of every action your bot took or tried to take, why, and what it cost.

Meetings

If you use meeting notes: the transcript of each meeting you said yes to, the notes your bot writes from it, and a record of when you said yes and whether you shared the heads-up. Lines are labeled by microphone (“You”, “Others” or “Room”), never by recognizing voices. The audio is turned into text as it arrives and isn't stored on our servers. If an upload fails, the desktop app keeps that bit of audio on your own computer until it's sent, then deletes it.

Connection tokens and keys

Tokens that let your bot use the apps you connect, your channel tokens and any API keys you add. These are encrypted as soon as they arrive.

Technical details

Your browser's user agent for each signed-in session, the computers you pair with the Bridge, and monthly usage counts (messages, searches, minutes, texts) for your plan.

• Secrets are encrypted at rest with AES-256-GCM: API keys, app tokens and channel tokens. After you enter a key we only ever show its last few characters, and keys are never written to logs.
• Sign-in is token-based. We store only a fingerprint (hash) of your session and sign-in links, never the tokens themselves.
• Receipts are append-only. The database refuses edits, so the record of what your bot did can't be rewritten.
• Access is locked down. Database row-level security is on, and the app checks that every request belongs to you.
• Subscriptions stay on your computer. When your bot uses your Claude or ChatGPT plan, the Bridge runs your own CLI there. We never collect, store or relay that login.

We use your data to:

• run your bots: send your messages to the brain you chose, use the apps you connected, and deliver replies on your channels;
• keep you and others safe: enforce your trust settings and our hard limits, keep receipts, and follow our crisis protocol;
• run your plan: count usage against your limits and handle billing;
• help you when you ask, and fix problems.

We don't sell your data, share it for advertising, or use it to train AI models, ours or anyone else's.

To answer you, your bot sends your message and the context it needs to the brain you picked: Nebius Token Factory for the included open models, the provider of an API key you added, or your own computer through the Bridge. That provider processes it under its own terms and privacy policy. We only send what's needed for the task at hand.

These services process data for us. Most only see data when you turn on the feature that uses them.

• Vercel
  Hosting and running the app
  Data: Everything passing through the app while it's processed
• Our managed Postgres host
  Storing your account and bots
  Data: Account, bots, messages, receipts (secrets stay encrypted)
• Nebius Token Factory
  The included open models
  Data: Messages and context, when your bot uses an included model
• Your chosen AI provider
  Your own API key, if you add one
  Data: Messages and context, sent to that provider only
• Tavily
  Web search
  Data: Search queries
• Groq, with Together AI as a backup
  Turning meeting audio into text
  Data: Meeting audio, only while it's turned into text
• Browser Use
  Web actions in a cloud browser
  Data: The pages your bot visits and what it types into them
• Composio
  Sign-in and actions for many apps
  Data: App tokens and the actions your bot takes in those apps
• Twilio
  Phone calls and texts
  Data: Phone numbers, texts, call speech and transcripts
• AgentMail and Resend
  Your bot's email address and sign-in emails
  Data: Email addresses and email content
• Telegram, Discord, Slack
  Chat channels you turn on
  Data: Messages in those channels and your account IDs there
• Stripe
  Payments
  Data: Billing details (we never see your full card number)
• Open-Meteo, Frankfurter, Wikipedia, Google News
  Weather, currency rates and public lookups
  Data: Only the search terms, like a city name

Apps you connect (like Gmail or GitHub) receive what your bot sends them under your settings, under their own privacy policies.

• We keep your data while your account is open, so your bots remember what they should.
• Delete a bot and its messages, memories, notes, meetings and receipts go with it. Delete your account and everything goes.
• You can delete individual memories and notes in the app at any time.
• Meeting transcripts are deleted after 90 days, unless you choose 30 days or to keep them. The notes from a meeting stay until you delete them, and you can delete a meeting, or just its transcript, at any time.
• Sign-in sessions expire after 180 days. Sign-in links work once and expire after 20 minutes.
• Deleted data can stay in encrypted backups for a short time before it's overwritten.

• Export: download everything we hold about you as a file from your Account page. Secrets aren't included, since we never show them again.
• Delete: delete your account and all of its data from the same page. Paid plans are canceled when you do.
• Disconnect: remove an app or turn off a channel at any time; your bot loses access right away.
• Your rights: depending on where you live, you may have rights to access, correct, delete or move your data, or to object to some processing. You can use most of them in the app, or contact us for the rest.

We use one cookie: a secure, HTTP-only session cookie that keeps you signed in. No ad trackers, no third-party analytics cookies. Your light or dark theme choice is saved in your browser's local storage, not in a cookie.

Build-a-bot is for adults 18 and over. We don't knowingly collect data from children, and if we learn that we have, we delete the account and its data.

If we change this policy in a meaningful way, we'll tell you in the app or by email before the change takes effect, and update the date at the top of this page.

Questions or requests about your data? Reach us at your Account page.