Privacy Policy

1. Introduction

This Privacy Policy explains how Yevhen Zakhodiakin, doing business as Botconsole (“Botconsole,” “we,” “us,” or “our”), collects, uses, stores, discloses, and protects Personal Information in connection with:

• the website located at botconsole.net;
• the Botconsole platform, dashboard, APIs, chatbot-building tools, integrations, and related services;
• communications with account owners, prospective customers, and support users; and
• data processed through chatbots, AI agents, and third-party integrations configured by Botconsole customers.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Where the General Data Protection Regulation applies, the term also includes “personal data” as defined by the GDPR.

This Privacy Policy applies to customers who create or manage bots through Botconsole, visitors to our website, and, where relevant, individuals who communicate with a chatbot operated by one of our customers.

This Privacy Policy does not govern the independent privacy practices of Telegram, Google, AI model providers, payment processors, or other third-party services. Those services process information under their own privacy policies and terms.

2. Who Is Responsible for Your Information

The operator of Botconsole is:

3. Our Privacy Roles

3.1 Botconsole as a Controller or Business

Botconsole acts as a data controller under the GDPR, or as a business under the California Consumer Privacy Act, when we determine the purposes and means of processing Personal Information relating to:

• creation and administration of Botconsole accounts;
• website operation and analytics;
• authentication, security, and fraud prevention;
• subscriptions, billing status, and payment administration;
• customer support and service-related communications; and
• compliance with legal obligations.

3.2 Botconsole as a Processor or Service Provider

When a customer uses Botconsole to collect, transmit, store, organize, or otherwise process information through the customer’s chatbots, AI agents, Telegram bots, connected accounts, or integrations, the customer generally determines why and how that information is processed.

In those circumstances:

• the customer acts as the data controller, business, or other party responsible for the Personal Information;
• Botconsole acts as a data processor, service provider, or contractor processing information on the customer’s behalf;
• Botconsole processes the information according to the customer’s instructions, the customer’s configuration of the Service, and the applicable agreement with the customer; and
• Botconsole does not independently determine the customer’s legal basis for collecting Personal Information from the customer’s end users.

Customers are responsible for providing their end users with an appropriate privacy notice, obtaining any required consent, establishing a lawful basis for processing, configuring appropriate retention settings, and responding to privacy requests submitted by their end users.

If you interacted with a chatbot operated by a Botconsole customer and want to exercise a privacy right concerning that interaction, you should first contact the owner or operator of that chatbot. We will provide reasonable assistance to the customer where required by applicable law and our agreement with the customer.

Customers that require a Data Processing Agreement may contact us at privacy@botconsole.net.

4. Personal Information We Collect

4.1 Account and Contact Information

We may collect information that you provide when creating or managing an account, including:

• your name;
• email address;
• account identifier;
• account preferences;
• subscription plan and account status; and
• communications sent to customer support.

4.2 Technical and Usage Information

When you access our website or platform, we may automatically collect:

• IP address;
• browser type and version;
• device type and operating system;
• language and approximate location derived from an IP address;
• login timestamps and activity timestamps;
• pages, features, and interface elements used;
• referring URLs and traffic source information;
• error, security, and diagnostic information;
• cookie identifiers and similar online identifiers; and
• other technical data necessary to operate and secure the Service.

4.3 Information from Telegram

When a customer connects a Telegram bot to Botconsole, we may receive or access information made available through the Telegram Bot API, including:

• Telegram user IDs and chat IDs;
• Telegram usernames and profile names;
• messages sent to or from the connected bot;
• message timestamps and technical metadata;
• information about groups, channels, or chats involving the bot;
• photos, documents, audio, video, voice messages, and other attachments;
• Telegram file identifiers and file-access information; and
• bot credentials, tokens, settings, and permissions supplied by the customer.

Files sent through Telegram are normally stored on Telegram’s servers. Botconsole may access those files through the Telegram Bot API when required to perform the customer’s configured workflow.

Botconsole downloads and stores a copy of a Telegram file on Botconsole infrastructure only when the bot owner or the bot owner’s configured workflow requests that the file be downloaded or processed.

Deleting a file from Botconsole does not necessarily delete the original file or message from Telegram. Telegram’s storage and deletion practices are governed by Telegram’s own terms, settings, APIs, and privacy policy.

4.4 Information from Google Accounts and Other Connected Services

If you connect a Google account or another third-party account, we may receive information and permissions authorized by you, such as:

• account name;
• email address;
• provider account identifier;
• authentication and authorization tokens;
• the list of permissions or scopes granted to Botconsole; and
• information retrieved from the connected service at your direction.

We use information from connected accounts only to provide the integration, perform actions requested by the customer, maintain the connection, and protect the security of the Service.

4.5 API Keys and Integration Credentials

Customers may provide their own API keys, access tokens, bot tokens, account credentials, or similar secrets for third-party services, including AI providers.

Botconsole processes these credentials only to authenticate requests, connect the selected service, and perform the workflow configured by the customer. Customers are responsible for ensuring that they are authorized to use the credentials and for revoking or rotating them when necessary.

4.6 Chatbot Messages and Customer Content

Depending on the customer’s configuration, Botconsole may process:

• incoming and outgoing chatbot messages;
• contact details included in messages;
• prompts and system instructions;
• AI-generated responses;
• conversation history and conversation metadata;
• forms and information submitted through a chatbot;
• images, audio, video, voice messages, documents, and other files;
• workflow variables and automation results; and
• other content submitted by customers or their end users.

Customer Content may contain Personal Information or sensitive information depending on what the customer or end user chooses to submit. Customers should not collect or transmit sensitive information unless they have a lawful basis, appropriate notices and consents, and appropriate technical and organizational safeguards.

4.7 AI Request and Response Data

When a customer enables an AI integration, Botconsole may process and transmit some or all of the following information to the selected provider:

• user messages;
• conversation history;
• system prompts and instructions;
• documents and file contents;
• images;
• audio and voice recordings;
• generated responses;
• workflow variables; and
• technical metadata required to complete the request.

4.8 Billing Information

Payments may be processed by Stripe, PayPal, or Paddle. Botconsole does not directly store full payment card numbers, card security codes, or copies of payment card information.

We may receive and store limited billing-related information, including:

• subscription plan;
• subscription status;
• payment status;
• payment provider;
• provider customer or transaction identifier;
• billing currency and amount; and
• information about refunds, failed payments, or cancellations.

Payment providers may independently retain transaction, identity-verification, fraud-prevention, tax, and billing records under their own legal obligations and privacy policies.

4.9 Website Analytics Information

We use Google Analytics and Yandex Metrica to understand website traffic, usage patterns, technical performance, and the effectiveness of our website. These services may process device information, cookie identifiers, IP-derived location, page visits, referral sources, and interactions with website pages.

We use these analytics services for measurement and service improvement. We do not intentionally use them for remarketing, personalized advertising, or cross-context behavioral advertising.

5. Sources of Personal Information

We may collect Personal Information from:

• you directly;
• your use of the website and Service;
• the owner or administrator of a Botconsole account;
• end users interacting with a customer’s chatbot;
• Telegram and the Telegram Bot API;
• Google and other connected account providers;
• AI providers selected and connected by a customer;
• payment processors;
• analytics providers; and
• security and technical systems used to protect the Service.

6. How We Use Personal Information

We may use Personal Information to:

• create, authenticate, and administer accounts;
• provide the Botconsole website and platform;
• connect Telegram bots, Google accounts, AI providers, and other integrations;
• receive, route, store, and deliver chatbot messages;
• execute workflows and automation rules configured by customers;
• transmit AI requests to providers selected by customers;
• return AI-generated outputs to the customer or end user;
• process subscriptions and manage billing status;
• respond to support requests and technical problems;
• monitor availability, performance, and reliability;
• detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents;
• maintain technical logs and backups;
• understand website usage and improve the Service;
• enforce our agreements and policies;
• comply with applicable laws and lawful government requests; and
• establish, exercise, or defend legal claims.

When Botconsole acts as a processor or service provider, we process Customer Data only to provide the Service, follow the customer’s documented instructions, maintain security, prevent abuse, and comply with applicable law.

7. Legal Bases for Processing in the EEA, United Kingdom, and Switzerland

Where the GDPR, UK GDPR, or similar law applies and Botconsole acts as a controller, we rely on one or more of the following legal bases:

• Performance of a contract: processing necessary to create and operate your account, provide the Service, connect integrations, and administer your subscription.
• Legitimate interests: processing necessary to secure, maintain, analyze, and improve the Service, prevent fraud and abuse, communicate with customers, and protect our legal rights, provided those interests are not overridden by your rights and freedoms.
• Consent: processing based on your consent, including the use of non-essential analytics cookies where consent is required.
• Legal obligation: processing necessary to comply with applicable legal, regulatory, tax, accounting, security, or law-enforcement requirements.

Where Botconsole acts as a processor, the customer is responsible for determining the appropriate legal basis for processing Customer Data.

8. AI Providers and Artificial Intelligence Processing

Botconsole allows customers to connect third-party AI providers using API keys controlled and supplied by the customer. Supported providers may include:

• OpenAI;
• Anthropic;
• Google Gemini;
• xAI, including Grok;
• OpenRouter; and
• other AI providers that may be added to the Service.

When a customer selects an AI provider, Botconsole transmits information to that provider as necessary to complete the customer’s request. Depending on the workflow, this may include messages, prompts, system instructions, documents, images, audio, files, conversation history, and other Customer Data.

AI requests made using a customer-supplied API key are associated with the customer’s own account or contractual relationship with the relevant AI provider. The provider’s terms, privacy policy, data-retention settings, model training settings, content restrictions, and geographic processing locations may apply to that request.

Botconsole does not control how a third-party AI provider processes information after it has been transmitted to that provider. Customers are responsible for:

• reviewing the provider’s privacy and data-processing terms;
• selecting appropriate provider retention and training settings;
• determining whether the provider is suitable for the intended data;
• obtaining any required end-user authorization or consent;
• avoiding the transmission of prohibited or unnecessarily sensitive information; and
• providing human review when AI outputs may affect an individual.

OpenRouter may route requests to additional model providers or infrastructure providers selected through the customer’s OpenRouter configuration. Customers should review their OpenRouter routing, logging, and provider settings before transmitting Personal Information.

AI-generated content may be inaccurate, incomplete, or inappropriate. Customers should not rely on AI output as the sole basis for medical, legal, financial, employment, housing, credit, insurance, or other high-impact decisions.

9. Service Providers, Subprocessors, and Other Recipients

We disclose Personal Information only as reasonably necessary to operate, secure, support, and provide the Service, follow customer instructions, process payments, comply with law, or protect our rights.

9.1 Legal Disclosures

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with a subpoena, court order, law, regulation, or lawful government request;
• investigate fraud, abuse, security incidents, or violations of our agreements;
• protect the rights, safety, and property of Botconsole, our customers, end users, or the public;
• establish, exercise, or defend legal claims; or
• respond to an emergency involving a risk of death or serious physical harm.

9.2 Business Transfers

If Botconsole is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of all or part of the business, Personal Information may be disclosed to advisors, potential counterparties, or a successor entity, subject to appropriate confidentiality and data protection obligations.

10. Cookies and Similar Technologies

Botconsole and our service providers may use cookies, local storage, pixels, and similar technologies.

10.1 Strictly Necessary Technologies

These technologies support authentication, session management, security, preferences, load balancing, and core Service functionality. Disabling them may prevent parts of the Service from working.

10.2 Analytics Technologies

Google Analytics and Yandex Metrica may use cookies or similar identifiers to measure visits, page interactions, referral sources, device characteristics, and website performance.

Where required by applicable law, we request consent before using non-essential analytics cookies. You may reject or withdraw consent through the cookie settings made available on the website.

You may also restrict cookies through your browser settings. Restricting cookies may affect website functionality.

10.3 Advertising Technologies

Botconsole does not intentionally use advertising pixels, remarketing cookies, or analytics information for cross-context behavioral advertising.

10.4 Global Privacy Control and Do Not Track

Where required by applicable law, we recognize applicable opt-out preference signals, such as Global Privacy Control, as a request to opt out of the sale or sharing of Personal Information.

Because there is currently no universally accepted technical standard for browser “Do Not Track” signals, we may not respond to Do Not Track signals that are not legally recognized opt-out preference signals.

11. No Sale or Sharing of Personal Information

Botconsole does not sell Personal Information for monetary or other valuable consideration.

Botconsole does not share Personal Information for cross-context behavioral advertising as the terms “sell” and “share” are defined by the California Consumer Privacy Act.

We disclose information to service providers and processors for the business purposes described in this Privacy Policy, including hosting, payment processing, analytics, AI processing requested by customers, and operation of integrations. These disclosures are not intended to constitute a sale or sharing of Personal Information.

We do not have actual knowledge that we sell or share the Personal Information of individuals under 16 years of age.

If our practices change, we will update this Privacy Policy and provide any opt-out mechanism required by applicable law.

Questions or opt-out requests may be sent to privacy@botconsole.net.

12. Sensitive Personal Information

Botconsole does not request sensitive Personal Information for ordinary account registration. However, certain information processed through the Service may qualify as sensitive Personal Information, including:

• account authentication information;
• API keys, access tokens, and integration credentials;
• the contents of private messages or communications;
• precise or approximate location data included in Customer Content;
• health, financial, biometric, or identity-related information voluntarily submitted through a customer’s chatbot; and
• other sensitive information contained in files, images, audio, or messages.

Botconsole uses sensitive Personal Information only as reasonably necessary to provide, maintain, secure, and support the Service; authenticate accounts and integrations; process customer instructions; prevent fraud and abuse; and comply with law.

Botconsole does not use sensitive Personal Information to infer characteristics about individuals for advertising purposes.

Customers must not configure bots to collect sensitive information unless such collection is necessary, lawful, clearly disclosed, appropriately secured, and consistent with the customer’s agreement with the end user.

13. Data Retention

We retain Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, to follow customer instructions, maintain the Service, resolve disputes, enforce agreements, and comply with applicable law.

When an account is deleted, associated information is removed from active Botconsole systems and is intended to be permanently deleted. Residual copies may remain in rotating backups for up to seven days before being overwritten or deleted.

Deletion from Botconsole does not automatically delete information independently retained by Telegram, an AI provider, a payment processor, an analytics provider, or another third-party service.

We may retain limited information for a longer period when required by law, necessary to investigate fraud or abuse, needed to protect the security of the Service, or required to establish, exercise, or defend legal claims.

14. International Data Transfers

Botconsole’s primary application servers are hosted by Hetzner in Germany.

Backup data is stored using Cloudflare infrastructure. The precise processing or storage location may vary depending on Cloudflare’s service configuration and infrastructure.

Although primary servers are located in the European Union, Personal Information may be accessed or processed in the United States and other countries because:

• Botconsole is operated from California, United States;
• administrative and support access may occur from the United States;
• AI providers may process requests in the United States or other jurisdictions;
• payment processors operate internationally;
• Telegram processes information through its global infrastructure;
• analytics providers may process data internationally; and
• Cloudflare and other subprocessors may use distributed infrastructure.

Laws in the destination country may differ from the laws in your country. Where required by applicable data protection law, we rely on appropriate transfer mechanisms, which may include:

• European Commission adequacy decisions;
• Standard Contractual Clauses approved by the European Commission;
• the United Kingdom International Data Transfer Agreement or applicable UK addendum;
• contractual data-protection obligations imposed on processors and subprocessors;
• customer instructions and customer-controlled provider accounts; and
• other legally recognized safeguards or derogations.

Customers are responsible for determining whether their use of a particular AI provider, integration, or processing location is lawful for the categories of Customer Data they submit.

15. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Our security practices may include:

• access controls and authentication requirements;
• restricted administrative access;
• encrypted network connections where supported;
• logging and monitoring for security and operational purposes;
• short retention periods for technical logs and temporary files;
• backup rotation;
• separation of customer accounts and workflows; and
• review of suspected security incidents.

No method of internet transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

Customers are responsible for using strong passwords, protecting API keys and bot tokens, limiting permissions granted to integrations, reviewing account access, rotating compromised credentials, and promptly notifying us of suspected unauthorized access.

If you believe your account, API key, token, or Personal Information has been compromised, contact privacy@botconsole.net.

16. California Privacy Rights

This div applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to Botconsole or to the relevant processing activity.

16.1 Categories of Personal Information

The following table describes categories of Personal Information that we may have collected during the preceding 12 months.

16.2 Right to Know and Access

You may request that we disclose:

• the categories of Personal Information we collected about you;
• the categories of sources from which the information was collected;
• the business or commercial purposes for collecting or using the information;
• the categories of third parties to whom we disclosed the information;
• the categories of Personal Information disclosed for a business purpose;
• the categories of Personal Information sold or shared, if any; and
• the specific pieces of Personal Information we maintain about you.

16.3 Right to Delete

You may request deletion of Personal Information that we collected from you, subject to exceptions permitted by law. For example, we may retain information necessary to provide a service requested by you, detect security incidents, prevent fraud, complete a transaction, comply with law, or establish and defend legal claims.

16.4 Right to Correct

You may request correction of inaccurate Personal Information maintained by us.

16.5 Right to Opt Out of Sale or Sharing

You have the right to opt out of the sale of Personal Information and the sharing of Personal Information for cross-context behavioral advertising. Botconsole does not currently sell or share Personal Information for these purposes.

We honor legally recognized opt-out preference signals, including Global Privacy Control, where applicable.

16.6 Right to Limit Use of Sensitive Personal Information

California residents may have the right to limit certain uses and disclosures of sensitive Personal Information.

Botconsole uses sensitive Personal Information only for purposes reasonably necessary to provide and secure the Service, perform customer instructions, authenticate integrations, prevent fraud and abuse, and comply with law. We do not use sensitive Personal Information to infer characteristics for advertising.

16.7 Right to Data Portability

Where applicable, you may request that specific Personal Information be provided in a portable and, where technically feasible, readily usable format.

16.8 Right to Non-Discrimination

We will not unlawfully discriminate against you for exercising a privacy right. We will not deny services, charge a different price, or provide a different level of service solely because you exercised a right under the CCPA.

Some information is necessary to provide the Service. Deleting that information may make it impossible to continue providing the affected account, integration, workflow, or feature.

16.9 No Financial Incentives

Botconsole does not currently offer financial incentives or price differences in exchange for the collection, sale, or sharing of Personal Information.

16.10 Submitting a California Privacy Request

You may submit a request by emailing: privacy@botconsole.net.

Please include:

• the email address associated with your Botconsole account;
• the type of request you are making;
• sufficient information to identify the relevant account or interaction; and
• any additional details reasonably necessary to locate the information.

We may need to verify your identity before completing a request. Information requested for verification will be used only to verify and process the request.

We will acknowledge and respond to verified requests within the time required by applicable law. Under the CCPA, this is generally within 45 calendar days, subject to a permitted extension when reasonably necessary.

16.11 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We may require written authorization, verification of the agent’s identity, and direct confirmation that you authorized the request.

16.12 Requests Concerning a Customer’s End Users

When Botconsole holds information solely as a processor or service provider for a customer, the customer is generally responsible for responding to the end user’s request. We may direct the requester to the relevant customer and assist the customer as required by law and contract.

17. Rights of Individuals in the EEA, United Kingdom, and Switzerland

Depending on your location and applicable law, you may have the following rights:

• Right of access: request confirmation of whether we process your Personal Information and obtain a copy.
• Right to rectification: request correction of inaccurate or incomplete information.
• Right to erasure: request deletion of Personal Information in circumstances provided by law.
• Right to restriction: request that we temporarily limit processing in certain circumstances.
• Right to data portability: receive information you provided in a structured, commonly used, machine-readable format where applicable.
• Right to object: object to processing based on legitimate interests or to processing for direct marketing.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent, without affecting processing completed before withdrawal.
• Rights concerning automated decision-making: request appropriate safeguards where a decision producing legal or similarly significant effects is based solely on automated processing.
• Right to complain: lodge a complaint with the data protection authority in your country of residence, place of work, or place of the alleged infringement.

To exercise a right, contact privacy@botconsole.net.

We may request information necessary to verify your identity and locate your information. We generally respond to GDPR requests within one month, subject to lawful extensions for complex or numerous requests.

These rights are not absolute. We may deny or limit a request where permitted by law, including where information is necessary to comply with a legal obligation, protect the rights of another person, maintain security, or establish, exercise, or defend legal claims.

If your information was submitted through a chatbot operated by a Botconsole customer, please contact that customer first. Botconsole will assist the customer in responding where required.

18. Automated Processing and AI Decisions

Botconsole provides tools that allow customers to create automated workflows and use third-party AI models. Botconsole does not use ordinary account or website analytics information to make decisions about individuals that produce legal or similarly significant effects.

A customer may configure its chatbot or workflow to use AI-generated information in its own business process. The customer is responsible for determining whether that use constitutes automated decision-making, providing required notices, implementing human review, and complying with laws applicable to high-impact decisions.

19. Age Restrictions and Children’s Privacy

Botconsole is intended only for individuals who are at least 18 years old. We do not knowingly allow individuals under 18 to create Botconsole accounts.

Customers must not knowingly use Botconsole to collect Personal Information from children in violation of applicable law.

If you believe that a person under 18 has provided Personal Information directly to Botconsole, contact privacy@botconsole.net. We will investigate and delete the information where appropriate.

20. Third-Party Websites and Services

The Service may include links to or integrations with third-party websites, APIs, platforms, and services. Botconsole is not responsible for the independent privacy, security, or data-retention practices of those third parties.

Customers should review the privacy policies and contractual terms of every third-party provider they connect to Botconsole.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our processing practices, third-party providers, or applicable law.

When we update this Privacy Policy, we will revise the “Last updated” date. If a change materially affects your rights or the way we process Personal Information, we may provide additional notice through the website, dashboard, or account email address.

We recommend reviewing this Privacy Policy periodically. Where required by law, we will request new consent before using Personal Information for a materially different purpose.

22. Contact Us

For privacy questions, requests, complaints, or concerns, contact:

Please use the subject line “Privacy Request” and include sufficient information for us to identify your account and understand your request.