Privacy Policy
Last updated:
This policy explains how Chatbot SaaS handles personal data. It is also our personal data processing policy (política de tratamiento de datos personales) under Colombian Law 1581 of 2012 and Decree 1074 of 2015.
1. Who is responsible
Drupal Experience (drupalexperience.com), a business registered with the Chamber of Commerce of Bucaramanga, Colombia (commercial registration no. 669026) · Bucaramanga, Santander, Colombia · [email protected] · phone +57 607 654 9002 · WhatsApp +57 333 279 3371. We are the controller (responsable) of the data described in section 3.
For privacy questions and to exercise your rights, write to [email protected]. Drupal Experience's privacy team attends every question and claim about personal data.
2. Two different roles
- Our own data (we are the controller): data about the people who visit our website, sign up, buy a plan or are invited to an account (customers and their Team Members).
- Data about our customers' website visitors (we are the processor): when someone uses a chatbot on a customer's website, that customer decides what is collected and why; we process it on their behalf under our Terms of Service (section 11). If you were a visitor of one of those websites, please read that website's privacy notice and contact them to exercise your rights; if you write to us, we will pass your request to them.
3. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (stored hashed), company, language, optional display name and photo | Create and secure your account; let you sign in | Contract |
| Two-factor authentication settings | Protect your account | Contract; legitimate interest in security |
| Billing details: plan, invoices, country, Paddle customer and subscription IDs. We never receive your full card number — Paddle handles payment | Bill you, apply your plan, keep accounting records | Contract; legal obligation |
| Your chatbot settings and the content you give it to learn from | Provide the Service | Contract |
| Usage: conversations counted, features used, errors | Apply plan limits, support you, improve the Service | Contract; legitimate interest |
| Messages you send us (contact form, support, email) | Answer you | Legitimate interest; contract |
| Technical data: IP address, browser, device, pages requested, timestamps | Security, abuse prevention, troubleshooting | Legitimate interest |
| Support access records (when our staff signs in to your account to help you) | Accountability and security | Legitimate interest; legal obligation |
| Product and service emails (renewals, limits, security notices) | Run the Service | Contract |
| Marketing emails, only if you opt in | News about Chatbot SaaS | Consent (you can withdraw it at any time) |
By signing up, you authorise us to process your data for these purposes. We do not sell personal data, and we do not use it for advertising profiling.
4. How we use AI
Chatbots answer using AI models provided by third parties (section 6). The texts sent to them are the visitor's question, the relevant parts of the customer's content and the recent conversation. We use these providers under paid terms that do not allow them to use the data to train their models, and we do not use customer content or conversations to train any model shared between customers. AI answers have no legal or similarly significant effect on anyone; we do not make automated decisions of that kind.
5. How long we keep data
| Data | Kept for |
|---|---|
| Account, content and settings | While the account is active, and 30 days after the subscription ends, the trial expires or the account is suspended (with an email warning 7 days before deletion) |
| Conversation memory between a visitor and a chatbot | 24 hours from the last message |
| Live chat messages in the real-time system | 48 hours; the full transcript is kept 12 months in the customer's account |
| Contact requests left by visitors | As long as the customer's account exists, unless the customer deletes them earlier |
| After an account is deleted | A record without personal data: the organisation's name, country and website, its plans, payments, top-ups and number of conversations used — for accounting and billing questions |
| Billing and invoice records | As long as tax and accounting law requires (in Colombia, up to 10 years) |
| Security and access logs | Up to 90 days, longer only when needed to investigate an incident |
| Backups | Overwritten in their normal cycle, at most 35 days |
6. Who receives data
We share data only with providers who need it to run the Service, under contracts that protect it:
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, email delivery (Amazon SES) | United States |
| Cloudflare | Content delivery, protection against attacks, bot checks (Turnstile) | Global network |
| Paddle.com | Merchant of Record: checkout, payments, taxes, invoices, refunds | United Kingdom / global |
| Anthropic | AI models that write chatbot answers | United States |
| Google (Gemini API) | AI models for answers and for searching the knowledge base | United States |
Paddle acts as an independent controller for the payment data it collects; see Paddle's privacy notice. We may also disclose data to our professional advisers (accountants, lawyers) under confidentiality, to authorities when the law requires it, or to a buyer of the business, who would be bound by this policy. We will notify customers 30 days before adding a new provider that processes their visitors' data.
7. International transfers
Our servers are in the United States. When we transfer personal data from Colombia, the EU/EEA, the UK or other countries, we use the safeguards the law requires: for the EU/EEA and UK, the European Commission's Standard Contractual Clauses (and the UK addendum) or the EU–US Data Privacy Framework where the provider is certified; for Colombia, the conditions of Law 1581 and the guidance of the Superintendence of Industry and Commerce (SIC).
8. Your rights
Depending on where you live, you have the right to:
- know, access and get a copy of your data;
- update and correct it;
- delete it, or revoke consent where we rely on it, when there is no legal or contractual duty to keep it;
- object to or restrict certain processing, and port your data to another provider;
- request proof of the authorisation you gave, and be told how your data has been used;
- complain to the data protection authority — in Colombia, the Superintendencia de Industria y Comercio (www.sic.gov.co), after first contacting us; in the EU/EEA or UK, your local authority.
How to exercise them: write to [email protected] from the email address on your account (or proving your identity), saying what you need. We answer questions (consultas) within 10 business days and claims (reclamos) within 15 business days, as Colombian law requires, and within one month for requests under the GDPR; if we need more time, we will tell you why. Some of these you can also do yourself in your account (edit your profile, download live chat transcripts).
9. Security
We protect data with encryption in transit (HTTPS/TLS), passwords stored as hashes, optional and staff-mandatory two-factor authentication, separation of each chatbot's knowledge base, access limited to the people who need it, records of staff access to customer accounts, and monitoring. No system is completely secure; if a breach affects your data, we will tell you and the authorities as the law requires.
10. Cookies and similar technologies
- Our website and panel use strictly necessary cookies: the session cookie that keeps you signed in, and security cookies set by Cloudflare (including Turnstile, used to stop automated sign-ups). The checkout is provided by Paddle, which sets its own cookies to process the payment and prevent fraud.
- The chatbot on our customers' websites stores in the visitor's browser (local storage) an anonymous conversation identifier and the widget's state, only so the conversation continues across pages. It does not track visitors across other websites.
- We do not use advertising cookies. If we add analytics that require consent, we will ask for it first.
11. Children
The Service is for businesses and professionals and is not directed to children. We do not knowingly collect data from people under 18. Customers must not use a chatbot to collect children's data without meeting the legal requirements that apply to them.
12. Changes to this policy
We will publish any change on this page with its new date and, if the change is material, tell customers by email at least 30 days in advance.
13. Validity
This policy is in force from the date of its last update, shown at the top. Data is processed for as long as needed for the purposes in section 3 and the periods in section 5.