BSP Bot privacy policy

Who we are

BSP Bot is provided by José Luis Villar Bardanca, trading as Xeitotech.

Chamber of Commerce (KvK)

42173282

Address

Wageningseberg 92, 3524 LS Utrecht, the Netherlands

Email

info@xeitotech.com

Our role

When you message a business that uses BSP Bot, that business decides how your messages are used. It is the controller of your data, and we process it on the business's behalf, as its processor, under a data processing agreement. Questions about how a business uses your messages are best put to the business itself.

For the accounts of the businesses that use BSP Bot, such as their staff's sign-in details and their billing, we are the controller.

What we process

• The messages you send to the business on WhatsApp, including voice notes and pictures, and the assistant's replies.
• Your phone number. It is stored encrypted and apart from your messages, which carry a random token in its place.
• Whether you have opted out of messages or asked for your data to be deleted.
• Documents and spreadsheets the business connects so the assistant can answer from them, such as its prices or opening hours.
• For a business's staff: the name and email address they sign in with through Google or Microsoft, their settings, and the business's billing details. Card details are handled by our payment provider and never reach us.
• Technical records of when things happened and what went wrong, kept for a few days to run and secure the service.

Why we process it

For these reasons only. We never sell personal data or use it for advertising.

• To answer customers on the business's behalf, as it instructs us. The business relies on its own legal basis for this, usually that you contacted it.
• To keep the service running, secure and free of abuse, which is our legitimate interest.
• To bill businesses and keep the records the law requires, which our contract with them and our legal obligations make necessary.

AI providers

To write each reply, the assistant sends the conversation to an AI company, such as OpenAI or Google, together with the passages it found in the business's documents. A voice note or a picture is sent as it is, so the AI can understand it.

By default, BSP Bot uses only AI companies we have reviewed, which are paid services that do not use the messages to train their AI. A business can choose others, and its dashboard shows which companies its messages may go to and whether each one trains on them. Ask the business if you want to know.

Some of these companies are in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

Where it is stored

On a server in Nuremberg, Germany, run by Hetzner Online GmbH. The documents the assistant searches are indexed on the same server, so they are not sent anywhere to be indexed.

Who else processes it

• Meta, through WhatsApp, which carries the messages between you and the business.
• The AI companies above, which write the replies.
• Hetzner Online GmbH, Germany, which hosts the server.
• Google and Microsoft, through which staff sign in. Google also holds the Drive files, spreadsheets and calendars a business chooses to connect.
• Mollie B.V., the Netherlands, which takes payments from businesses.
• Brevo, France, which sends email notifications to a business, such as a conversation handed over to its team. These can include the customer's message.
• If a business turns on web search, the searches the assistant writes go to public search engines through our own search server, without your phone number.

How long we keep it

• Conversations are kept while the business uses BSP Bot, so the assistant can follow them, unless you or the business ask for them to be deleted.
• When deletion is asked for, your messages stop being used at once and your phone number is erased, so they can no longer be linked to you. They are erased for good within 30 days.
• The database is backed up every night, and each backup is deleted after 14 days. Data erased from the service is therefore gone from the backups 14 days later.
• When a business closes its account, we delete its conversations, documents and connected accounts. We keep a record, without any message text, of when its conversations took place and of opt-out and consent decisions, and its billing records, which Dutch law requires us to keep for seven years.

Your rights

You can ask to see the data held about you, to correct it, to delete it, to receive a copy, or to object to or restrict its use. If you are a customer of a business, the quickest route is to ask the business. You can also write to us at info@xeitotech.com, and we will work with the business to answer you.

To stop proactive messages from a business, reply STOP in the chat. To have your data deleted, see how to delete your data.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Security

Phone numbers, the credentials of connected accounts and API keys are encrypted. A business's conversations are visible only to its own staff and to our administrators, and every time an administrator reveals a customer's phone number, it is logged.

Changes to this policy

We will publish any change here and update the date at the top. Businesses that use BSP Bot are told about significant changes before they apply.