Privacy Policy

Botivo LLC (“Botivo,” “we,” “us,” or “our”) provides a managed AI automation service: businesses tell us what they need, and our team designs, builds, deploys, and manages the resulting AI system on their behalf — rather than handing customers a do-it-yourself builder. This Privacy Policy explains what information we collect through our website and customer/admin portal at botivoai.com, how we use it, who we share it with, and the choices you have.

This policy applies to visitors of our public website, registered customers using our portal, and anyone whose information a customer submits to us in the course of us building or managing their AI system.

Botivo LLC is a limited liability company formed in Wyoming, United States. You can reach us at help@botivoai.com for any question about this policy or your information. Botivo’s founder can also be found on LinkedIn.

We collect information you provide directly (when you sign up, fill out a form, or configure your account), information generated by using our service (like requests, quotes, and support messages), and, where you choose to connect it, information from your Google account. We do not buy personal information from data brokers, and we do not collect information about you from sources you haven’t interacted with.

When you create a Botivo account, we collect your first and last name, email address, and password (handled by our authentication provider, Supabase — we never see or store your password in plain text). You may optionally add a phone number in your account settings.

To scope and build your AI system, we collect business details you choose to provide: business name, industry, website, job title, company size, a short business description, and location (country, state/province, city). Every one of these fields is optional and only stored once you fill it in — if you haven’t provided a field, we don’t have it, and it isn’t shown anywhere in our admin tools either.

When you submit a request for an AI system, we store what you tell us: the type of system, the capabilities and channels you want, your goals and business requirements, and any documents or files you upload as reference material (stored in our file storage, tied to your account). We also store the resulting quotes, pricing, delivery timelines, and the status of your request as it moves through review, quoting, and development.

Support conversations you have with our team inside the portal are stored so we (and you) can refer back to them. Messages sent through the public contact form on our website (name, email, the reason for contacting us, and your message) are emailed directly to our support inbox — they are not saved in our database.

Like any web application, our hosting infrastructure generates ordinary server logs (such as IP address, browser type, and request timestamps) as a normal part of serving web pages securely. We do not run any analytics, advertising, or tracking service on our website or portal — there is no Google Analytics, ad pixel, or similar tool installed.

Payments are processed entirely by Stripe. When you pay for a quote, your card details are entered directly into Stripe’s secure payment form embedded in our page — we never receive, transmit, or store your full card number, CVV, or bank credentials. We store only the resulting Stripe identifiers (customer, subscription, and payment status) needed to reflect your billing status in your dashboard.

This section specifically addresses data accessed through Google, as required by Google’s API Services User Data Policy.

What the Google connection is for

Inside your Botivo dashboard, under Settings → Integrations, you can optionally connect your Google account to use our Google Sheets integration — useful if you already track leads, inventory, or bookings in a spreadsheet. This is entirely optional and unrelated to logging into Botivo: signing in to your Botivo account always uses your Botivo email and password, never Google.

Exact scopes we request, and why

• https://www.googleapis.com/auth/spreadsheets.readonly — lets us read the contents of the one spreadsheet you choose, so the feature you configured (for example, looking up rows from your lead list) has real data to work with. We never request write access, so Botivo cannot modify or delete anything in your spreadsheets.
• https://www.googleapis.com/auth/drive.metadata.readonly — lets us list the names of your spreadsheets only (not their contents, and not any other file type in your Drive), so you can pick the right one from a dropdown instead of typing a file ID by hand.
• openid and email — the standard, minimal scopes needed to confirm which Google account you connected and show that email address back to you in your settings.

We do not request, and cannot access, your Gmail, Google Calendar, Google Contacts, or any Drive file other than the specific spreadsheet you select. We only request the narrowest set of scopes this one feature needs — we do not request broader access “just in case” for future features.

What we do with it

After you connect your account and choose a spreadsheet and sheet, we read that sheet’s data to display it to you inside the integration settings and to power the spreadsheet-based functionality you’ve configured for your account. We use this data only to provide the feature you enabled — never for advertising, never sold or shared with data brokers, and never used to train general-purpose AI models.

What is stored, and what is not

We store your connected Google account’s email address (so you can see which account is connected), your OAuth access and refresh tokens (used only to make the authorized API calls on your behalf), and a reference to which spreadsheet and sheet you selected. We do not store the contents of your spreadsheet. Every time you view a preview, we fetch the current data directly from Google’s API and show it to you — nothing is copied into our database.

OAuth tokens are stored in a database table that is never exposed to any client application, including your own browser session — only our server can read them, and only to make the specific API calls this feature needs.

Sharing

We do not share, sell, or disclose your Google account data or spreadsheet content to any third party. It is not shared with advertisers, data brokers, or any other Botivo customer, and it is not used to train generalized artificial intelligence or machine learning models. The only “sharing” that occurs is between our own servers and Google’s API, to fetch the data you’ve authorized us to read on your behalf.

Disconnecting & deletion

You can disconnect Google at any time from Settings → Integrations. Disconnecting immediately revokes our access with Google and permanently deletes both the connection record and your stored tokens from our database — this happens synchronously, not on a delay. Deleting your Botivo account deletes these the same way.

Botivo’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Some of the AI systems we build for our business customers answer messages and calls on WhatsApp, using the WhatsApp Business Platform provided by Meta Platforms, Inc. When a business connects its WhatsApp Business account to Botivo, or when someone messages a business whose WhatsApp is managed by Botivo, we process the following information:

• Business account details — the business’s WhatsApp Business account, phone number, display name, and the access granted to Botivo through Meta.
• Messages and calls — the content of messages, voice notes, images, and calls sent to and from the business’s WhatsApp number, together with the sender’s name and phone number, and the time they were sent.
• Usage information — how many messages, minutes, and features were used, so we can apply the business’s plan limits and billing.

How we use it

We use this information only to provide the business’s AI system: to read incoming messages, generate and send replies on the business’s behalf, transcribe voice notes, show conversations to the business in its Botivo portal (so its team can follow along or take over), measure usage against its plan, and keep the service secure and working.

Our role

For messages exchanged between a business and its own customers, Botivo acts as a service provider (processor) on behalf of that business. The business decides how its customers’ information is used, and is responsible for having the right to contact its customers and for obtaining any required consent or opt-in.

What we never do

We do not sell WhatsApp or Meta data, we do not use it for advertising, we do not share it with data brokers, and we do not use it to train general-purpose AI models. We share it only with the service providers needed to deliver the service (listed in Section 12) and when required by law. We comply with Meta’s WhatsApp Business Policy and Platform Terms.

Keeping and deleting it

We keep this information while the business’s Botivo account and WhatsApp connection are active. A business can disconnect Botivo from its WhatsApp at any time in its Meta Business settings, and anyone can ask us to delete their data — see our Data deletion instructions.

We work with a small number of service providers to operate Botivo:

• Stripe — payment processing and subscription billing.
• Supabase — our database, authentication, and file storage provider.
• Meta (WhatsApp Business Platform) — sending and receiving WhatsApp messages and calls for businesses that use our WhatsApp AI systems.
• Telnyx — phone numbers and the connection that carries calls and WhatsApp messages for our AI systems.
• OpenAI — AI language and speech models used to generate replies and to turn voice into text (including the voice-typing option in our portal).
• Vapi — the voice platform that runs our AI receptionists’ phone and WhatsApp calls.
• Google — the optional Google Sheets integration described above.
• Hostinger — our web hosting and email provider (our servers, including the automation server that runs our AI systems’ workflows, and the emails we send you).
• Cal.com — scheduling for calls with our team.

Each provider only receives the information it needs to perform its part of the service. Not every AI system uses every provider — for example, a business without WhatsApp never has data sent to Meta through Botivo.

All traffic to our website and portal is encrypted in transit (HTTPS). Passwords are hashed by our authentication provider, never stored in plain text. Access to customer data in our database is restricted by row-level security policies enforced by the database itself — a customer’s session can only read or modify their own records, not another customer’s, regardless of what the application UI shows. Payment card data never touches our servers at all — it goes directly to Stripe.

We keep your account and business information for as long as your account is active, so we can continue managing your AI system and billing. If your account is archived (by you requesting it, or by our team), your records are hidden from active views but retained so the archive can be reversed if it was a mistake, and so we keep accurate financial and support records. Knowledge files you delete yourself are removed immediately, including the underlying stored file — this is a real deletion, not an archive. Google OAuth tokens are deleted immediately on disconnect, as described in Section 10. When a customer closes their account, we keep their data for 30 days (so a mistake can be undone) and then permanently delete it, except payment and invoice records we must keep for legal and tax reasons.

You can delete files you’ve uploaded and disconnect Google directly from your dashboard at any time. To request deletion of your account or other personal information, contact us at help@botivoai.com. We’ll verify your identity and process the request as your account settings allow. Depending on where you live, you may have additional rights to access, correct, or object to the processing of your information — contact us and we’ll do our best to help. Step-by-step instructions, including for WhatsApp data, are on our Data deletion page.

We use a small number of strictly necessary cookies: a session cookie from our authentication provider that keeps you signed in, and a short-lived cookie used only during the Google connection flow to prevent cross-site request forgery. We do not use advertising or cross-site tracking cookies.

Our service providers operate infrastructure in the United States and potentially other countries. By using Botivo, you understand your information may be processed in a country other than the one you live in.

Botivo is a business-to-business service intended for use by adults acting on behalf of a business. We do not knowingly collect personal information from children.

We may update this policy as our product changes. If we make a material change — particularly one affecting how we access, use, or share Google user data — we will update the date at the top of this page and notify registered customers by email before or at the time the change takes effect. Continued use of Botivo after a change means you accept the updated policy.

Questions about this policy or your information can be sent to help@botivoai.com.