Privacy Policy
Last updated 22 September 2026. Privacy Terms Subprocessors
- The short version
- Who we are
- 1. What we collect
- 2. How we use it
- 3. Who we share it with
- 4. The AI engines, in more detail
- 5. Where your data is
- 6. What we ask of you
- 7. How long we keep things
- 8. Payment
- 9. Cookies
- 10. Your rights
- 11. Security
- 12. Children
- 13. Links to other sites
- 14. Changes to this policy
- 15. Contact
The short version
BotSay measures how AI assistants answer questions about your brand.
- We put the questions you wrote to AI engines and record what came back. Those engines are named in this policy.
- We hold very little about people. For a customer, that is a name, a work email address and a role. For a free report, it is the name, email address and company details you gave us.
- We do not scrape consumer AI interfaces. We use official programmatic interfaces and licensed data.
- We never see your card. Payment runs through Stripe's own hosted pages.
- We do not sell personal information and we do not share it for cross-context behavioural advertising.
- When your account ends, we delete your data within 60 days.
The rest of this page is the detail.
Who we are
BotSay is a product of Caspio, Inc., a Delaware corporation, 1286 Kifer Road, Suite 107, Sunnyvale, CA 94086, USA.
For anything in this policy, including a request about your own data, contact us through support.botsay.ai. You do not need a BotSay account to use that form.
Under the GDPR we are the controller of the personal data described in section 1, meaning the details of people who use BotSay and people who request a free report. We are a processor of the content a customer puts into their account, including the questions they write. Our Data Processing Addendum governs that processing.
1. What we collect
If you use BotSay as a customer
| What | Where it comes from |
|---|---|
| Your name, work email address and role | Your sign-in, and your account administrator |
| Your company name and business contact details | You, when you subscribe |
| Additional email addresses nominated to receive the weekly summary | Your administrator |
| A record of account settings changes and other notable actions | Your use of the product |
| Billing status and plan | Stripe, when you subscribe |
There is no profile, no behavioural tracking, no page-view history and no device fingerprinting.
What your account contains, which is mostly not about people
The bulk of what we store is measurement data about brands and web pages rather than about people:
- the questions you wrote,
- the brands you track, their alternative names and their domains,
- what the AI engines answered, and what we extracted from those answers, including which brands were named, in what position and how they were described,
- which web pages the engines cited,
- summary figures computed from the above,
- operational records of which measurement runs happened and what failed.
A question is a sentence you typed. If you put a person's name in it, that name goes to the AI engines named in section 3 along with the rest of the question. Section 6 explains what we ask of you.
If you request a free report
The form collects your name, your email address, your brand name, your website domain, and up to three competitor names.
We put a set of questions about your brand and named competitors to the AI engines in section 3, exactly as we would for a paying customer, and send you a link to the result.
Two things worth being plain about. You can request a report about a brand you do not own, and we have no way to check. And a competitor name you type is sent to third-party AI engines as part of a question, so do not put anything confidential in the form.
If you join the waiting list
Right now, the opening-soon page has no sign-up field. It invites you to write to hello@botsay.ai, and we hold your message only to reply to you. The rest of this section describes what happens once the sign-up field is live.
Before BotSay opens, www.botsay.ai shows an "opening soon" page with one field: your email address.
If you join the list we store your email address, the time you signed up, a confirmed time if we ask you to confirm your address, the campaign that brought you if the link carried one (the campaign name and source, and the host of the site that linked to us, never the full referring web address), and which version of this policy was shown to you when you signed up.
We do not store your IP address. The sign-up form is handled by a Cloudflare Worker, which sees your IP briefly to stop automated abuse of the form and does not keep it.
The waiting list is not a newsletter. We send at most three messages: one confirming your sign-up if confirmation is used, one telling you BotSay has opened, and one earlier message if your turn comes early. Every message carries a one-click unsubscribe. If you unsubscribe, we delete your email address within 30 days.
2. How we use it
| What we use | What for | Lawful basis under the GDPR |
|---|---|---|
| Your name, email and role | Signing you in, deciding what you may see, sending the weekly summary | Performance of our contract, Art. 6(1)(b) |
| Your questions and what the engines answered | Producing the measurements you are paying for | Performance of our contract, Art. 6(1)(b) |
| Account and operational records | Diagnosing problems, supporting a disputed figure, managing our costs | Our legitimate interest in running a correct and solvent service, Art. 6(1)(f) |
| Free report details | Producing and sending the report you asked for | Our legitimate interest in providing what you requested, Art. 6(1)(f) |
| Your email address, if you join the waiting list | Telling you when BotSay opens, confirming your sign-up if we use confirmation, and telling you if your turn comes early | Consent, Art. 6(1)(a) |
| Your business contact details after a free report or after your subscription ends | Sending you information about BotSay, with an unsubscribe link in every message | Our legitimate interest in marketing a business product to business contacts, Art. 6(1)(f) |
We do not use your data to train any AI model. We do not sell personal information and we do not share it for cross-context behavioural advertising as California defines that term.
We may create and use aggregated, de-identified data derived from use of the service. It identifies no person, customer, brand or market, and cannot reasonably be used to re-identify any of them.
3. Who we share it with
We use a small number of companies to run BotSay. Each receives only what it needs. The current list is maintained at botsay.ai/subprocessors.
AI engines, which receive the questions you wrote
Each of these receives one question at a time, and in most cases a two-letter country code indicating which market to search from. None of them receives your identity, your users' details or your account information.
| Who | What we send | Why |
|---|---|---|
| OpenAI | Question text and market | Measuring how ChatGPT answers |
| Anthropic | Question text and market, and separately the stored answer text from every engine | Measuring how Claude answers, and extracting brand mentions from every answer |
| Question text | Measuring how Gemini answers | |
| Perplexity | Question text and market | Measuring how Perplexity answers |
| DataForSEO | Question text as a search query, with a location and language | Retrieving Google's AI search surfaces through licensed search infrastructure rather than by scraping |
Anthropic appears twice on purpose. As well as being one of the measured engines, a Claude model reads each stored answer and extracts the brand mentions from it, so Anthropic receives answer text from every engine, not only its own.
Which engines apply to you depends on your plan and on which engines you have enabled.
Everyone else
| Who | What they receive | Why |
|---|---|---|
| Caspio | All customer data, and the waiting list sign-ups described in section 1 | The database holding every BotSay record |
| Railway | Data passing through the running application | Hosting the application and the scheduled worker |
| Railway (buckets) | Compressed copies of measurement records | Storage of measurement history |
| Stripe | Your name, billing address, email and card details, provided by you directly to Stripe | Taking payment. Card details do not pass through our systems |
| Resend | Recipient email addresses and message content | Sending the weekly summary, free reports and service email |
| Cloudflare | Bot-check signals from the free report form. Cloudflare also hosts the marketing site at www.botsay.ai and runs the waiting list sign-up form; the sign-up endpoint sees your IP briefly for rate limiting and does not keep it | Preventing automated abuse, and hosting www.botsay.ai |
| Resend | The waiting list email address, and the content of the confirmation, launch and early-turn messages | Sending those messages, from hello@botsay.ai |
| HubSpot | Your email address, if you confirm your place on the waiting list | Our customer relationship management system. An unsubscribe is passed on to HubSpot |
| Google (Analytics, Tag Manager) | Marketing site visit data, only after you accept it in the cookie banner described in section 9 | Understanding how people use www.botsay.ai. This is separate from Google's role as an AI engine in the table above |
We will also disclose data where the law requires it, and will tell you unless we are forbidden to.
If BotSay is ever sold or merged, your data may transfer with it, and this policy travels with the data until replaced by one that is no less protective.
Changes to this list. We will publish a change to the subprocessor page and give customers at least 30 days' notice before a new company begins processing customer data. The Data Processing Addendum sets out what a customer can do about it.
4. The AI engines, in more detail
BotSay's job is to put questions to third-party AI engines and record the answers, so your question text leaves our systems by design.
What goes to an engine. The text of one question, and usually a two-letter country code. Nothing else. No customer identifier, no user identifier, no account information.
What comes back, and what we keep. We receive the answer, read it to identify which brands were named and how, and store the resulting measurement together with the cited web pages and a short verbatim extract as evidence for each mention.
We do not retain raw provider responses. Once an answer has been processed, the raw response is not kept.
We do not scrape consumer AI interfaces. Every measurement comes from an engine's own programmatic interface or from a licensed search-data provider.
We do not use your data to train models, and we do not permit the engines to train on it where their terms allow us to require that. We cannot control what an engine does with an API request beyond what its own published terms say, and we do not pretend otherwise. The engines are named above so you can read their terms yourself.
5. Where your data is
BotSay data is processed in the United States. Our subprocessors process data in the United States and, in some cases, elsewhere, as their own terms describe.
If you are in the European Economic Area, the United Kingdom or Switzerland, your data will be transferred to the United States. Those transfers are made under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US Data Privacy Framework, and, where that framework does not apply to a transfer, under the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. Our Data Processing Addendum sets out the detail.
6. What we ask of you
You choose what goes into your account, and two of those choices reach third parties.
- Your questions go to the AI engines in section 3. Do not put personal data, confidential information, or anything you are not free to share into a question. A question is meant to be the sort of thing a buyer would ask an assistant.
- You are responsible for the people you give access to, and for removing them when they leave. Removal takes effect on that person's next request.
- You decide what your account is for. Where we process personal data on your instructions rather than on our own account, we do so as your processor under the Data Processing Addendum, and you are the controller.
7. How long we keep things
| What | How long |
|---|---|
| Raw responses from an AI engine | Not retained once the answer has been processed |
| Your questions, answers, brand mentions, citations and summary figures | For as long as your account is open |
| Account, billing and operational records | For as long as your account is open |
| Everything above, after your account ends for any reason | Deleted within 60 days |
| Your business contact details, for marketing | Up to 24 months after your account ends, or until you unsubscribe |
| Free report details | Up to 24 months, or until you unsubscribe |
| Records we must keep by law, including tax and accounting records | For the period the law requires |
When your account ends, whether by cancellation, non-payment or termination, we delete your data within 60 days. Section 13 of the Data Processing Addendum is the binding version of that promise and sets out the limited exceptions, which are our own billing and cost records, backups taken in the ordinary course, and anything the law requires us to keep.
Ask for an export before that window closes. Section 10 of the Terms of Service explains how.
8. Payment
Payment is processed by Stripe. When you subscribe, Stripe's own hosted page collects your card details, billing address and any tax identifier. Those details pass from your browser to Stripe. They do not reach our servers, and we never see or store a card number.
What we store is a Stripe customer identifier, a subscription identifier, your plan, the status of the subscription and when the current period ends.
Stripe processes this data as an independent controller under its own privacy policy. Receipts and invoices carry Caspio, Inc. as the legal entity.
9. Cookies
The signed-in product sets only the cookies needed to sign you in and keep you signed in. They are strictly necessary, and they are not used for advertising or analytics. The product loads no third-party scripts.
The marketing site at www.botsay.ai loads nothing but the waiting list sign-up form until you choose. If you accept in the cookie banner, it loads Google Tag Manager and Google Analytics, and later will load HubSpot's tracking code. We use Google's Consent Mode, which denies every category until you accept.
Declining costs you nothing, and we remember your choice. A "Cookie settings" link in the site's footer reopens the choice at any time.
10. Your rights
Whatever law applies to you, you can ask us to:
- tell you what we hold about you,
- correct it,
- delete it,
- provide a copy in a portable form,
- stop or limit a particular use,
- object to a use based on our legitimate interests,
- withdraw a consent you gave, without affecting what we did before you withdrew it.
We will not treat you worse for asking.
Ask us through support.botsay.ai. We will respond within 30 days. If a request is genuinely complex we will tell you within those 30 days and say how much longer we need.
If you are in the EEA, the UK or Switzerland you also have the right to complain to your data protection authority. We would rather you came to us first.
If you are in California you have the rights above under the CCPA as amended, and:
- We have not sold personal information in the preceding 12 months.
- We have not shared personal information for cross-context behavioural advertising in the preceding 12 months.
- We do not knowingly collect or sell the personal information of anyone under 16.
- The categories we collect are identifiers and business contact details, and, for customers, commercial information about the subscription. We collect them for the purposes in section 2, from you and from your employer, and disclose them to the service providers in section 3 for business purposes only.
- Global Privacy Control. The signed-in product does no advertising and shares nothing for advertising, so there is nothing to opt out of. Where our marketing site carries any advertising or analytics tag, it honours a Global Privacy Control signal.
If you work for a BotSay customer and want data removed from that customer's account, ask your own administrator first. They control the account. Where we hold data only on their instructions we will pass your request to them and help them answer it.
11. Security
We maintain appropriate technical and organisational measures to protect personal data, including:
- single sign-on against your own identity provider, with authorisation checked on every request;
- encryption of data in transit;
- access to production systems restricted to the staff who need it;
- review of changes before they reach production, and automated testing;
- payment handled entirely by Stripe, so no card data enters our systems;
- review of the security posture of the companies listed in section 3 before they process customer data.
No system is perfectly secure and we do not claim to be. We hold no security certification covering BotSay, and we make no certification claim anywhere on this site.
If a breach affects your personal data we will tell you without undue delay after confirming it, and tell you what happened, what was affected and what we are doing about it. Where a customer is the controller, our notice goes to that customer so they can meet their own obligations. The Data Processing Addendum has the detail.
12. Children
BotSay is a business tool intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us through support.botsay.ai and we will delete it.
13. Links to other sites
Our reports name and link to web pages that AI engines cited. Those pages belong to other people and have their own privacy policies. A link is not an endorsement.
14. Changes to this policy
If we make a material change we will update the date at the top and tell customers by email or in the product before it takes effect. Minor corrections we will simply make.
15. Contact
Caspio, Inc.
1286 Kifer Road, Suite 107
Sunnyvale, CA 94086, USA
support.botsay.ai