Bot Factory — Privacy Policy

Last updated: September 24, 2026
Effective: September 24, 2026

This Privacy Policy explains how Tomek Group, trading as Bot Factory (“Bot Factory,” “we,” “us,” or “our”), handles personal information in connection with https://botfactory.to and related services (the “Service”).

Contact: hello@botfactory.to.

This Policy covers two different situations:

1. Our customers (businesses that sign up for Bot Factory) — we are typically the controller of their account and billing data.
2. Our customers’ website visitors (people who speak or chat with a bot on a customer’s site) — our customer is the controller; we act as a processor (service provider) on their behalf. See the short section at the end titled “For our customers’ visitors.”

1. Data we collect from customers (account holders)

When you create an account, try the demo, or subscribe, we may collect:

• Account identifiers: email address, name or company name (if you provide it), website URL you submit, and related profile settings.
• Communications: messages you send to hello@botfactory.to or other support channels, and content of support tickets.
• Uploaded materials: files or text you provide so the bot can learn your business (for example PDFs, Word documents, or notes).
• Usage and product data: logs of how you use the dashboard (for example logins, configuration changes, feature use), device/browser information, IP address, and approximate location derived from IP.
• Billing metadata: subscription plan, status, invoices, and customer IDs managed through Stripe. We do not store full payment card numbers. Card data is handled by Stripe.

Transactional emails and receipts are sent from hello@botfactory.to (or another Bot Factory address we designate). Lead notification emails are sent to the addresses you configure.

2. Data we process on customers’ behalf (visitor conversations and leads)

When a visitor uses a Bot Factory voice (or text) agent on a customer’s website, we process data so the agent can respond and so the customer can follow up. Depending on how the customer configures the bot, this may include:

• Voice and/or text conversation content and transcripts.
• Lead fields the visitor provides (for example name, email, phone, what they asked about).
• Calendar booking details where booking is enabled.
• Technical data needed to run the embed (for example IP address, user agent, timestamps).

The customer is the controller of this visitor data. Bot Factory processes it to provide the Service to that customer. Customers are responsible for their own privacy notices (including telling visitors that the site uses an AI voice assistant and that conversations may be transcribed), for call-recording or consent rules that apply to them, and for having a lawful basis to collect visitor data.

3. Voice, audio, and transcripts

Bot Factory’s primary product is an AI voice agent on the customer’s website (with text chat as a secondary channel). The same audio rules apply on the customer-site embed and on our hosted demo:

• Audio is processed in the visitor’s browser and by xAI (our AI provider). Bot Factory does not store audio.
• Transcripts of voice and text conversations are retained for 90 days, then deleted, except where we must keep limited records longer for security, abuse investigation, or legal reasons.

Customers (controllers) should tell their visitors that the site uses an AI voice assistant and that conversations may be transcribed, and should comply with any applicable recording or consent requirements. See also our Terms of Service.

4. How we use data

We use personal data to:

• Provide, operate, secure, and improve the Service.
• Authenticate you (for example magic-link login) and maintain your account.
• Process subscriptions and send receipts via Stripe and email.
• Send lead notifications and product/transactional messages you request or that are necessary to the Service.
• Detect fraud, abuse, and technical issues.
• Comply with law and enforce our Terms.

We do not sell personal information. We do not use customer conversations (visitor voice or text content, or the site content you supply for the bot) to train AI models. Our AI subprocessors process that content only to operate the Service for you:

• xAI (voice and text inference) states that it does not train on API inputs or outputs without the customer’s explicit permission. By default, xAI retains API requests and responses for 30 days for abuse monitoring, then deletes them. A zero-data-retention option exists on xAI’s platform but is not required for the no-training commitment.
• Venice (search-index embeddings of site content) states that it does not use User Content to train models, and that for normal inference it does not store prompt or response content.

We use conversation and site content only to run your bot, deliver leads, secure the Service, and meet legal obligations.

5. Legal bases (where GDPR or similar laws apply)

Where required, we rely on:

• Contract: to provide the Service you request.
• Legitimate interests: to secure and improve the Service, prevent abuse, and communicate about the product in a proportionate way.
• Consent: where we ask for it (for example certain cookies or marketing), and you may withdraw it.
• Legal obligation: where we must keep records or respond to lawful requests.

For visitor data on customer sites, the customer determines the lawful basis; we process under their instructions and our Terms / this Policy.

6. Retention

7. Subprocessors

We use trusted third parties to run the Service:

We may update this list as the product evolves. Material changes to subprocessors that process personal data will be reflected in an updated Policy.

8. Cookies and analytics

We use cookies and similar technologies that are needed for the Service to work (for example session or authentication cookies for the dashboard).

We have not added third-party marketing analytics scripts (such as common ad pixels) on the public marketing site as of this Policy. If we add analytics later, we will update this section and, where required, provide a consent mechanism.

Customers who embed the bot on their sites are responsible for disclosing any cookies the embed sets on their domain and for complying with cookie laws that apply to them.

9. Security

We use industry-standard measures appropriate to a small SaaS product, including HTTPS, access controls, and reliance on reputable infrastructure providers. No method of transmission or storage is 100% secure. Please use a secure email account for magic-link login and tell us promptly about suspected unauthorized access at hello@botfactory.to.

10. International transfers

We and our subprocessors may process data in the United States and other countries. Where required (for example transfers from the EEA/UK), we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s certified transfer mechanism.

11. Your rights (GDPR / CCPA-style, proportionate)

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete data (subject to legal retention needs).
• Export / portability of data you provided.
• Object to or restrict certain processing.
• Opt out of “sale” or “sharing” if those terms apply under California law — we do not sell personal information for money; if our practices change, we will update this Policy.
• Lodge a complaint with a supervisory authority.

Customers: email hello@botfactory.to with your request. We may need to verify your identity.

Visitors on a customer’s site: please contact the business whose website you used first — they are the controller. We will assist that customer with processor requests as required.

We do not discriminate against you for exercising privacy rights.

12. Children

The Service is directed to businesses and adults. It is not intended for children under 16 (or the higher age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided data, contact hello@botfactory.to and we will take appropriate steps.

13. Changes

We may update this Policy from time to time. We will change the “Last updated” date and, for material changes, provide additional notice when appropriate (email or dashboard notice). Continued use after the effective date means you acknowledge the updated Policy.

14. Contact

Email: hello@botfactory.to
Controller (for customer account data): Tomek Group, trading as Bot Factory
Notices: Legal notices to us must be sent by email to hello@botfactory.to (Tomek Group, Florida). Notices are effective when received.

For our customers’ visitors (short explanation)

If you spoke or chatted with a bot on a business’s website and that bot is powered by Bot Factory:

• That business decided to put the bot on their site. They are responsible for telling you how they use your information (including that the site uses an AI voice assistant and that conversations may be transcribed) and for answering most privacy requests.
• Bot Factory provides the technology that runs the voice and text agent, stores conversation/lead data for that business, and may email the business when you leave contact details.
• We process your information on behalf of that business, not to market Bot Factory to you personally based on your conversation (except as needed to operate and secure the Service). We do not use your conversation content to train AI models.
• Audio is not stored by Bot Factory; it is processed in your browser and by our AI provider (xAI). Transcripts are kept for 90 days, then deleted.
• To exercise privacy rights about a conversation on a specific website, contact that website’s owner. You may also email hello@botfactory.to and we will point you to the right customer when we can identify them.