Privacy Policy

What we store

• Account — your identity from our sign-in provider (email address, name and profile image), your plan and billing status, and your time zone.
• Content you create — workflows, agents, knowledge bases, uploaded files, generated images, and chat and agent conversations.
• Credentials — encrypted at rest with AES-256-GCM, never written to logs, and readable only by your own account (see Security).
• Operational records — usage and error events we use to run, bill and debug the service. They carry identifiers, counts, durations, costs, short error messages, and the IP address and browser of each connection. They deliberately do not carry prompts, completions, file contents or credential values.
• Messages you send us — the in-app contact form and support tickets keep your name, email address, phone number if you give one, the message, and the IP address and browser it was sent from.
• Payment details — for the card we charge we keep its brand, last four digits, expiry date, funding type, wallet and issuing country, Stripe's card fingerprint, and your billing country and state. We never see or store full card numbers.

Processors we rely on

Running the product requires sending some data to these third parties:

• Model providers (OpenAI, Anthropic, Google, xAI) — receive the prompts and content you send to them, for the model you choose. On plans that support bring-your-own-key, those calls run on your own provider account.
• Clerk — sign-in, identity and session management.
• Stripe — payments and billing details. Stripe's script runs in the app and sets its own fraud-prevention cookies.
• DigitalOcean — hosting, databases and file storage, in the United States.
• Calendly — its booking widget loads, and sets its own cookies, when you open our schedule page, and receives your details if you book a demo.

What we do not do

• We do not sell your data.
• We do not train models on your content.
• We do not put your prompts, completions or file contents into our operational logs.
• We set no advertising or cross-site tracking cookies. Our own cookies keep you signed in and hold an anonymous demo session; Stripe in the app and Calendly on the schedule page set their own, as described above.
• We do not knowingly collect personal data from children under 13. BusyBot is for adults; if we learn that an account belongs to a child, we close it and delete its data.

How long we keep it

• While your account is open, your content stays until you delete it. Deleting a conversation, workflow or agent removes it from the app at once; the underlying record is kept, marked deleted, until your account is closed. Deleting a knowledge base removes its documents and files from storage straight away, and deleting a credential removes it entirely.
• Generated images are deleted 30 days after they are created.
• Operational records are kept for about 90 days, and error records for about a year. Daily usage totals are kept for billing.
• Workflow run history: step-by-step detail for 90 days, run summaries for about 400 days.
• When you close your account (Settings → General → Delete Account), we stop your running work, cancel your subscriptions and remove your saved cards, and delete your conversations, knowledge bases, credentials, uploaded files and generated images. Your account record is kept with your name, email and profile image removed, and your sign-in identity is deleted. Closing usually completes within a day. Remaining workflow and agent records are permanently deleted about 91 days later.
• We keep payment, credit and invoice records, support tickets and contact-form messages (with the IP address and browser they were sent from) after an account closes, with no set time limit, because accounting, support history and fraud prevention require them.
• Backups: deleted data can remain in database backups until those backups are deleted.

Your rights and choices

Email ben@busybot.net to access, correct, export or delete your personal data; we respond within 30 days. You can also close your account yourself at any time in Settings.

BusyBot is operated from Denver, Colorado, USA. Your data is stored and processed in the United States, by us and by the processors listed above.

Changes to this policy

When our practices change, this page changes with them; the date below is when it last changed.

Contact

Privacy questions and requests: ben@busybot.net, Denver, Colorado, USA.

Last updated 2026-10-29.