Privacy Policy
Last updated 6 November 2026. Privacy Terms Subprocessors
- The short version
- Who we are
- 1. What we collect
- 2. How we use it
- 3. Who we share it with
- 4. The AI engines, in more detail
- 4A. Google Analytics data
- 5. Where your data is
- 6. What we ask of you
- 7. How long we keep things
- 8. Payment
- 9. Cookies
- 10. Your rights
- 11. Security
- 12. Children
- 13. Links to other sites
- 14. Changes to this policy
- 15. Contact
The short version
BotSay measures how AI assistants answer questions about your brand.
- We put the questions you wrote to AI engines and record what came back. Those engines are named in this policy.
- We hold very little about people. For a customer, that is a name, a work email address and a role. For a free report, it is the name, email address and company details you gave us.
- We do not scrape consumer AI interfaces. We use official programmatic interfaces and licensed data.
- We never see your card. Payment runs through Stripe's own hosted pages.
- We do not sell personal information. Our marketing site shares visit data with Google for advertising only if you turn on Marketing cookies in its cookie banner.
- When your account ends, we stop measuring, keep your data for 30 days so you can ask for an export, then delete it soon after, always within 60 days.
The rest of this page is the detail.
Who we are
BotSay is a product of Caspio, Inc., a Delaware corporation, 1286 Kifer Road, Suite 107, Sunnyvale, CA 94086, USA.
For anything in this policy, including a request about your own data, contact us through our Contact form at app.botsay.ai/contact. You do not need a BotSay account to use that form.
Under the GDPR we are the controller of the personal data described in section 1, meaning the details of people who use BotSay and people who request a free report. We are a processor of the content a customer puts into their account, including the questions they write. Our Data Processing Addendum governs that processing.
1. What we collect
If you use BotSay as a customer
| What | Where it comes from |
|---|---|
| Your name, work email address and role | Your sign-in, and your account administrator |
| Your company name and business contact details | You, when you subscribe |
| Additional email addresses nominated to receive the weekly summary | Your administrator |
| A record of account settings changes and other notable actions | Your use of the product |
| Billing status and plan | Stripe, when you subscribe |
| The campaign that brought you, and, if you turned on Marketing cookies, the ad's click id | The link you followed to sign up |
| If you start a free month: the results of your card issuer's checks (whether the security code and postcode matched) | Stripe, when you save the card |
| Whether you agreed to hear from us about BotSay | You, at sign-up or when you accept an invite |
If you start signing up and do not finish, we keep your email address for 30 days and send you one reminder.
There is no profile, no behavioural tracking, no page-view history and no device fingerprinting.
What your account contains, which is mostly not about people
The bulk of what we store is measurement data about brands and web pages rather than about people:
- the questions you wrote,
- the brands you track, their alternative names and their domains,
- what the AI engines answered, and what we extracted from those answers, including which brands were named, in what position and how they were described,
- which web pages the engines cited,
- summary figures computed from the above,
- operational records of which measurement runs happened and what failed.
A question is a sentence you typed. If you put a person's name in it, that name goes to the AI engines named in section 3 along with the rest of the question. Section 6 explains what we ask of you.
If you request a free report
The form collects your name, your email address, your brand name, your website domain, and up to three competitor names.
We put a set of questions about your brand and named competitors to the AI engines in section 3, exactly as we would for a paying customer, and send you a link to the result.
Two things worth being plain about. You can request a report about a brand you do not own, and we have no way to check. And a competitor name you type is sent to third-party AI engines as part of a question, so do not put anything confidential in the form.
If you joined the waiting list
The waiting list has closed, and www.botsay.ai no longer has a sign-up form. If you write to us through the Contact form, we hold your message only to reply to you. The rest of this section describes what we hold for people who joined the list before it closed.
The form had one field: your email address.
If you joined the list, we hold your email address, the time you signed up, a confirmed time if you confirmed your address, the campaign that brought you if the link carried one (the campaign name and source, and the host of the site that linked to us, never the full referring web address), and which version of this policy was shown to you when you signed up.
We do not store your IP address. The sign-up form was handled by a Cloudflare Worker, which saw your IP briefly to stop automated abuse of the form and did not keep it.
The waiting list is not a newsletter. We send at most three messages: one confirming your sign-up if confirmation is used, one telling you BotSay has opened, and one earlier message if your turn comes early. Every message carries a one-click unsubscribe. If you unsubscribe, we delete your email address within 30 days.
2. How we use it
| What we use | What for | Lawful basis under the GDPR |
|---|---|---|
| Your name, email and role | Signing you in, deciding what you may see, sending the weekly summary | Performance of our contract, Art. 6(1)(b) |
| Your questions and what the engines answered | Producing the measurements you are paying for | Performance of our contract, Art. 6(1)(b) |
| Account and operational records | Diagnosing problems, supporting a disputed figure, managing our costs | Our legitimate interest in running a correct and solvent service, Art. 6(1)(f) |
| Free report details | Producing and sending the report you asked for | Our legitimate interest in providing what you requested, Art. 6(1)(f) |
| The campaign and the ad's click id | Learning which ads bring customers, and telling Google Ads which clicks became customers | Campaign: our legitimate interest in measuring our advertising, Art. 6(1)(f). Click id: your consent, given by turning on Marketing cookies, Art. 6(1)(a) |
| Your email address, if you joined the waiting list | Telling you when BotSay opens, confirming your sign-up if we use confirmation, and telling you if your turn comes early | Consent, Art. 6(1)(a) |
| Card check results, and your email address | Security, preventing abuse, and allowing one free month per business and email address | Our legitimate interest in preventing abuse of a free offer, Art. 6(1)(f) |
| Your email address, company name and account status | Keeping our customer records in HubSpot, and sending you news and offers about BotSay unless you opt out | Our legitimate interest in running our business and marketing a business product to business contacts, Art. 6(1)(f) |
| Your business contact details after a free report, a free month, or after your subscription ends | Sending you information about BotSay, with an unsubscribe link in every message | Our legitimate interest in marketing a business product to business contacts, Art. 6(1)(f) |
We do not use your data to train any AI model. We do not sell personal information. We share it for cross-context behavioural advertising, as California defines that term, only when you turn on Marketing cookies on our marketing site (section 9). That choice also lets us tell Google Ads when your ad click led to a sign-up.
We may create and use aggregated, de-identified data derived from use of the service. It identifies no person, customer, brand or market, and cannot reasonably be used to re-identify any of them.
3. Who we share it with
We use a small number of companies to run BotSay. Each receives only what it needs. The current list is maintained at botsay.ai/subprocessors.
AI engines, which receive the questions you wrote
Each of these receives one question at a time, and in most cases a two-letter country code indicating which market to search from. None of them receives your identity, your users' details or your account information.
| Who | What we send | Why |
|---|---|---|
| OpenAI | Question text and market | Measuring how ChatGPT answers |
| Anthropic | Question text and market, and separately the stored answer text from every engine | Measuring how Claude answers, and extracting brand mentions from every answer |
| Question text | Measuring how Gemini answers | |
| Perplexity | Question text and market | Measuring how Perplexity answers |
| DataForSEO | Question text as a search query, with a location and language | Retrieving Google's AI search surfaces through licensed search infrastructure rather than by scraping |
Anthropic appears twice on purpose. As well as being one of the measured engines, a Claude model reads each stored answer and extracts the brand mentions from it, so Anthropic receives answer text from every engine, not only its own.
Every paid account is measured on the same six engines, whatever its plan: ChatGPT, Claude, Gemini, Perplexity, Google AI Overviews and Google AI Mode. A free month uses four of them: ChatGPT, Perplexity, Google AI Overviews and Google AI Mode. A free report uses the same engines except Gemini.
Everyone else
| Who | What they receive | Why |
|---|---|---|
| Caspio | All customer data, and the waiting list sign-ups described in section 1 | The database holding every BotSay record |
| Railway | Data passing through the running application | Hosting the application and the scheduled worker |
| Railway (buckets) | Compressed copies of measurement records | Storage of measurement history |
| Stripe | Your name, billing address, email and card details, provided by you directly to Stripe | Taking payment. Card details do not pass through our systems |
| Resend | Recipient email addresses and message content | Sending the weekly summary, free reports and service email |
| Cloudflare | Bot-check signals from the free report form. Cloudflare also hosts the marketing site at www.botsay.ai and the confirm and unsubscribe links in waiting-list messages | Preventing automated abuse, and hosting www.botsay.ai |
| Resend | The waiting list email address, and the content of the confirmation, launch and early-turn messages | Sending those messages |
| HubSpot | For every account's administrators, including those invited by a colleague once they accept: email address, company name, and whether the account is a free month, paid, ended or cancelled. The waiting-list addresses, as before | Our customer records and our news and offers email. An unsubscribe in HubSpot stops it |
| Google (Analytics, Tag Manager, Ads) | Marketing site visit data, only after you accept it in the cookie banner described in section 9. If you turned on Marketing cookies and then sign up, the ad's click id, and when and how much you first paid | Understanding how people use www.botsay.ai and, if you turn on Marketing cookies, measuring and improving our advertising. This is separate from Google's role as an AI engine in the table above |
We will also disclose data where the law requires it, and will tell you unless we are forbidden to.
If BotSay is ever sold or merged, your data may transfer with it, and this policy travels with the data until replaced by one that is no less protective.
Changes to this list. We will publish a change to the subprocessor page and give customers at least 30 days' notice before a new company begins processing customer data. The Data Processing Addendum sets out what a customer can do about it.
4. The AI engines, in more detail
BotSay's job is to put questions to third-party AI engines and record the answers, so your question text leaves our systems by design.
What goes to an engine. The text of one question, and usually a two-letter country code. Nothing else. No customer identifier, no user identifier, no account information.
What comes back, and what we keep. We receive the answer, read it to identify which brands were named and how, and store the resulting measurement together with the cited web pages and a short verbatim extract as evidence for each mention.
We do not retain raw provider responses. Once an answer has been processed, the raw response is not kept.
We do not scrape consumer AI interfaces. Every measurement comes from an engine's own programmatic interface or from a licensed search-data provider.
We do not use your data to train models, and we do not permit the engines to train on it where their terms allow us to require that. We cannot control what an engine does with an API request beyond what its own published terms say, and we do not pretend otherwise. The engines are named above so you can read their terms yourself.
4A. Google Analytics data
If you connect Google Analytics to BotSay, we ask Google for read-only access to your Analytics reports and nothing else. We read totals only: visits and key events by day, by the AI assistant that sent them and by landing page, plus your site's visits by channel. We never read data about individual visitors.
We use these figures only to show you, inside your workspace, how many visits AI assistants send to your site. We store them in our database, kept separate for each workspace. The access key Google gives us is encrypted, is never written to our logs, and is deleted as soon as you disconnect.
The figures we have already read stay in your workspace after you disconnect, like the rest of your history, until your workspace is deleted.
We do not sell this data, use it for advertising, or use it to train AI models. We share it with no one except the providers that host BotSay, under contract. Nobody at BotSay reads it, except with your permission, to keep the service secure, or where the law requires it.
You can disconnect at any time in Setup, Website visits, or remove BotSay's access in your Google Account settings.
BotSay's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Where your data is
BotSay data is processed in the United States. Our subprocessors process data in the United States and, in some cases, elsewhere, as their own terms describe.
If you are in the European Economic Area, the United Kingdom or Switzerland, your data will be transferred to the United States. Those transfers are made under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US Data Privacy Framework, and, where that framework does not apply to a transfer, under the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. Our Data Processing Addendum sets out the detail.
6. What we ask of you
You choose what goes into your account, and two of those choices reach third parties.
- Your questions go to the AI engines in section 3. Do not put personal data, confidential information, or anything you are not free to share into a question. A question is meant to be the sort of thing a buyer would ask an assistant.
- You are responsible for the people you give access to, and for removing them when they leave. Removal takes effect on that person's next request.
- You decide what your account is for. Where we process personal data on your instructions rather than on our own account, we do so as your processor under the Data Processing Addendum, and you are the controller.
7. How long we keep things
| What | How long |
|---|---|
| Raw responses from an AI engine | Not retained once the answer has been processed |
| Your questions, answers, brand mentions, citations and summary figures | For as long as your account is open |
| Account, billing and operational records | For as long as your account is open |
| Everything above, after your account ends for any reason | Kept 30 days so you can ask for an export, then deleted soon after, and always within 60 days |
| A free month that did not become a paid plan: the workspace and everything in it | Kept until 30 days after the free month ends, then deleted |
| The email address a free month was started with, and its dates, to allow one free month per business and email address | 12 months after the free month ends, then deleted |
| The sign-in details of someone whose only workspace was an unpaid free month | Deleted with the workspace. Their email address stays only in our marketing contacts, under the marketing row |
| Your choice not to receive news and offers | As long as we hold your email address |
| Your business contact details, for marketing | Up to 24 months after your account ends, or until you unsubscribe |
| Free report details | Up to 24 months, or until you unsubscribe |
| Records we must keep by law, including tax and accounting records | For the period the law requires |
When your account ends, whether by cancellation, non-payment or termination, we stop measuring, keep your data for 30 days so you can ask for an export, then delete it soon after, and always within 60 days. Section 13 of the Data Processing Addendum is the binding version of that promise and sets out the limited exceptions, which are our own billing and cost records, backups taken in the ordinary course, and anything the law requires us to keep.
Ask for an export before that window closes. Section 10 of the Terms of Service explains how.
8. Payment
Payment is processed by Stripe. When you subscribe, Stripe's own hosted page collects your card details, billing address and any tax identifier. Those details pass from your browser to Stripe. They do not reach our servers, and we never see or store a card number.
What we store is a Stripe customer identifier, a subscription identifier, your plan, the status of the subscription and when the current period ends.
Stripe processes this data as an independent controller under its own privacy policy. Receipts and invoices carry Caspio, Inc. as the legal entity.
9. Cookies
The signed-in product sets only the cookies needed to sign you in and keep you signed in. They are strictly necessary, and they are not used for advertising or analytics. The product loads no third-party scripts.
The marketing site at www.botsay.ai loads nothing from another company until you choose. Its cookie banner offers two kinds of cookies. You can accept all, reject all, or choose:
- Analytics lets us see how people use the site. It loads Google Tag Manager and Google Analytics, and later will load HubSpot's tracking code.
- Marketing loads Google Tag Manager and lets Google's advertising features use cookies to measure and improve our ads. Google may then use your visit for advertising on other sites.
We use Google's Consent Mode, which denies every category until you choose, and keeps each category off unless you turned it on.
Rejecting costs you nothing, and we remember your choice. A "Cookie settings" link in the site's footer reopens the choice at any time.
10. Your rights
Whatever law applies to you, you can ask us to:
- tell you what we hold about you,
- correct it,
- delete it,
- provide a copy in a portable form,
- stop or limit a particular use,
- object to a use based on our legitimate interests,
- withdraw a consent you gave, without affecting what we did before you withdrew it.
We will not treat you worse for asking.
Ask us through the Contact form at app.botsay.ai/contact, or through Help in the app if you are a customer. We will respond within 30 days. If a request is genuinely complex we will tell you within those 30 days and say how much longer we need.
If you are in the EEA, the UK or Switzerland you also have the right to complain to your data protection authority. We would rather you came to us first.
If you are in California you have the rights above under the CCPA as amended, and:
- We have not sold personal information in the preceding 12 months.
- We have not shared personal information for cross-context behavioural advertising in the preceding 12 months, apart from visits to our marketing site, and ad clicks that led to a sign-up, by people who turned on Marketing cookies.
- We do not knowingly collect or sell the personal information of anyone under 16.
- The categories we collect are identifiers and business contact details, and, for customers, commercial information about the subscription. We collect them for the purposes in section 2, from you and from your employer, and disclose them to the service providers in section 3 for business purposes only.
- Global Privacy Control. The signed-in product shows no advertising. On our marketing site, a Global Privacy Control signal turns off Analytics and Marketing cookies unless you turn them on yourself in the cookie banner, and with Marketing cookies off, sign-up keeps no ad click id.
If you work for a BotSay customer and want data removed from that customer's account, ask your own administrator first. They control the account. Where we hold data only on their instructions we will pass your request to them and help them answer it.
11. Security
We maintain appropriate technical and organisational measures to protect personal data, including:
- authorisation checked on every request;
- encryption of data in transit;
- access to production systems restricted to the staff who need it;
- review of changes before they reach production, and automated testing;
- payment handled entirely by Stripe, so no card data enters our systems;
- review of the security posture of the companies listed in section 3 before they process customer data.
No system is perfectly secure and we do not claim to be. We hold no security certification covering BotSay, and we make no certification claim anywhere on this site.
If a breach affects your personal data we will tell you without undue delay after confirming it, and tell you what happened, what was affected and what we are doing about it. Where a customer is the controller, our notice goes to that customer so they can meet their own obligations. The Data Processing Addendum has the detail.
12. Children
BotSay is a business tool intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us through the Contact form and we will delete it.
13. Links to other sites
Our reports name and link to web pages that AI engines cited. Those pages belong to other people and have their own privacy policies. A link is not an endorsement.
14. Changes to this policy
If we make a material change we will update the date at the top and tell customers by email or in the product before it takes effect. Minor corrections we will simply make.
15. Contact
Caspio, Inc.
1286 Kifer Road, Suite 107
Sunnyvale, CA 94086, USA
app.botsay.ai/contact