This policy covers mybotplus.com and the MyBotPlus contact forms our customers share as a link or embed in their own websites. There are two different groups of people involved and the distinction matters, so it is worth stating up front:

Customers — businesses with a MyBotPlus account. We are the data controller for their account data.
People who fill in a form — anyone who submits one of our customers' contact forms. For that submission, the customer is the controller and we are the processor. We handle it on their instructions, not our own.

1. What we collect

From customers

Account details: name, email address, password (hashed, never stored in readable form), phone number and country.
Billing details: your country and the plan you are on. Card details are handled by our payment provider and never reach our servers.
Usage data: how many forms you have built and how many AI messages +Bot has sent, so we can bill accurately and show you your allowance.
Your outgoing mail server details, if you connect one. The password is encrypted at rest and is used for one purpose: sending your own form notifications and invoices from your own address.
Support correspondence, when you write to us.

From people who fill in a customer's form

Whatever that form asks for. Our customers build their own forms, so the fields are theirs, not ours — typically a name, an email address, a phone number and a message.
The page the form was submitted from, so the customer can see which page produced the enquiry.
Technical data: IP address and browser user-agent, used for rate limiting and abuse prevention.

We do not add fields to a customer's form, and we do not collect anything the person filling it in was not shown. There is no tracking pixel, no fingerprint and no advertising identifier in a MyBotPlus form.

2. Why we hold it

Data	Purpose	Lawful basis (UK/EU GDPR)
Account details	Provide the service, authenticate you	Performance of a contract
Billing data	Take payment, meet tax obligations	Contract / legal obligation
Form submissions	Pass the enquiry to the business the person contacted, and let them reply	Consent — the person chose to fill the form in
CRM contacts and notes	Let the customer manage and follow up their own enquiries	Legitimate interests of the customer, as controller
Mail server credentials	Send the customer's own notifications from their own address	Performance of a contract
IP address	Rate limiting, abuse and fraud prevention	Legitimate interests
Contact form messages	Reply to you	Legitimate interests

3. AI processing, stated plainly

Contact form submissions are never sent to an AI model. They are stored, emailed through your own mail server, and filed in your CRM. No model sees them at any point.

One feature does use a model: +Bot, the assistant you type your own instructions into. When you write something it cannot parse with a regular expression — "bill Acme for three days of design work" — that sentence is sent to a third-party large language model provider to be turned into structured invoice data. Typed commands such as E 500 Petrol, Cash, Fuel are read by our own software and are never sent anywhere.

What we can tell you about that:

We do not use your data to train any public model, and we contract with providers on terms that prohibit them from doing so with data we send.
We send the minimum needed: the sentence you typed. Not your account details, not your billing information, not your other contacts' data, and never a form submission.

If you are in a regulated sector and need to know exactly which provider processes your data and where, ask before you sign up rather than after — contact us and we will tell you.

We share data with a short list of processors, each for one job:

Hosting provider — runs the servers the service sits on.
AI model provider — interprets what you type into +Bot, as described above. Never involved in a form submission.
Payment provider — takes payment. They hold card details; we do not.
Email provider — delivers our own transactional email to you, such as a password reset. Your form notifications and invoices do not go through it: they are sent through the mail server you connect, from your own address.

We do not sell personal data. We do not share it with advertisers or data brokers. We will disclose data if we are legally required to, and where we are permitted to tell you about such a request, we will.

5. How long we keep it

Form submissions: until you delete them. They are your business records, and we do not expire them out from under you.
CRM contacts, invoices and ledger entries: until you delete them, or until your account is closed.
Account data: for as long as your account is open, then 90 days after closure, then deleted.
Billing records: as long as tax law requires, typically six to seven years. This we cannot shorten on request.
Rate-limiting logs: 24 hours.
Contact form messages: 24 months.

6. Your rights

Depending on where you live, you may have the right to:

Ask what we hold about you, and get a copy.
Have inaccurate data corrected.
Have data deleted, where we do not have a legal duty to keep it.
Object to, or ask us to restrict, certain processing.
Receive your data in a portable format — submissions, contacts and ledger entries all export as CSV from your dashboard at any time, without asking us.
Withdraw consent where consent is the basis we relied on.

Email info@mybotplus.com and we will respond within 30 days.

If you filled in a form and want your data removed, contact the business whose form it was — they control that data, not us. Every hosted form shows whose it is, and the acknowledgement email comes from their own address. If you cannot reach them, write to us and we will help identify the right controller.

7. Cookies

This marketing website sets no advertising or tracking cookies. A session cookie (mc_sess) is set only when you sign in or submit our own contact form, to protect it against cross-site request forgery. It is strictly necessary and is discarded when you close your browser.

A MyBotPlus contact form sets no cookies at all. Neither the hosted page nor the embed stores anything in the visitor's browser, and the embed script sends no request until the form is submitted. There is nothing to consent to, which is why no form carries a banner.

If MyBotPlus analytics are enabled on this site, they are configured with IP anonymisation. As shipped, no analytics script is loaded at all.

8. Security

All traffic is served over HTTPS.
Passwords are hashed with a modern algorithm and are not recoverable, by us or anyone else.
Mail server passwords are encrypted at rest, and are never displayed back to you once saved.
A form can be locked to the domains you list, so a stolen embed snippet is useless elsewhere.
Access to production data is limited to staff who need it for support.

No system is perfectly secure, and anyone claiming otherwise is selling something. If we suffer a breach affecting your data, we will tell you and the relevant regulator within the timeframes the law requires.

9. International transfers

Our providers may process data outside your country. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children

The service is for businesses and is not directed at children under 16. We do not knowingly collect their data. If you believe we have, tell us and we will delete it.

11. Changes

If we change this policy materially we will email account holders rather than quietly updating the date at the top. The date at the top is updated for every change, however small.

12. Contact

MyBotPlus
Registered entity: [insert registered company name]
Registered address: [insert registered address]
Email: info@mybotplus.com

If you are in the UK or EU and are unhappy with our response, you may complain to your national data protection authority.

Related: Terms of Service · Refund Policy

Privacy Policy