Two different roles, and why it matters
This policy describes two relationships, and it is worth separating them because your rights differ in each:
- You, the business owner. For your own account details we are the controller — we decide what to collect and why. That is what this policy covers.
- Your customers, who chat with your Bot. For those conversations you are the controller and we act only as your processor, on your instructions. Those obligations are in our Data Processing Agreement. If you are a customer of one of our customers and want your chat deleted, ask that business — they control it, not us.
What we collect from you
Account data
Your phone number, or the name and email address your Google account returns when you choose Google sign-in. We use these to identify your account and to reach you about the Service. If you switch on WhatsApp alerts for a business's orders and bookings, we also send them to that phone number: through Twilio, over WhatsApp, which Meta operates. An alert carries the business's name, the order's or booking's number, how many items, the total and how it is collected — or, for a booking, the service and its time — and a link to the dashboard; never the customer's name, phone number, address or note. We keep a record of each alert (which order, which member, when, and whether it was sent) so the dashboard can show it. We do not use your phone number for marketing.
Business data
The business name, category and profile details you enter — opening hours, address, contact number, payment methods, delivery areas, policies — plus the sources you add and the answers you save. This is the knowledge that makes your Bot work.
If you switch on AI visibility, the questions you choose to track are put to the AI providers below with your business's name, city and country, and their answers are kept for you; nothing about your customers goes with them. The website check reads the address you give it (or your business website) and nothing else.
Conversation data
Messages exchanged between your customers and your Bot, and whether each was answered; any photos or documents a customer attaches, together with the short description our AI writes of each so the Bot can respond; and the details a customer gives your Bot's welcome flow — typically a name, phone number or email address, and answers to the questions you configured. We process these on your behalf, as described above.
Orders and bookings
When a business takes orders or bookings through its Bot, the details a customer gives to place one — their name, phone number, a delivery address or table, and any note — together with what was ordered or booked, the time of a booking and the amounts. We process these on the business's behalf, as described above. The name and phone number given for an order are also shown on that chat in the business's dashboard. The business's alert email for a new order includes the customer's name, phone number, address and note; the alert for a booking includes the name and phone number but never the note. A booking's note is never sent to an AI provider. No payment details pass through the Bot: customers pay the business directly. The chat widget keeps a few things in the customer's own browser: the chat's id (until the browser tab is closed; 24 hours inside the chat screen of a mobile app built with our SDKs), whether they finished the welcome flow (30 days), whether they have opened that business's bot before (so it can greet them as a returning visitor; until the customer clears the site's data), the chats in which they asked for a person (14 days, so the team's reply still reaches them), references to their own orders (30 days) and bookings (until the day after the visit), so that a booking still shows when they return, and — for 24 hours — what they typed at checkout (name, phone number, address), so that they need not type it again. It also keeps a random identifier, created in the browser and meaningless anywhere else, which is sent with each chat so the business can see that separate chats came from the same browser. It is not created when the browser sends Do Not Track or Global Privacy Control, nor inside the chat screen of a mobile app built with our SDKs. The browser keeps it until the customer clears the site's data; the copy stored with each chat is deleted with that chat under the business's retention setting.
Operational data
Usage counts for metering (answers per day per business); for a business with a menu or services list, daily counts of how many chat visitors opened its menu, opened an item and added something to a cart, with nothing about who; and standard server logs including IP address, user agent and timestamps — used to run the Service, prevent abuse and diagnose faults.
We do not collect payment card details. Payments are handled by Razorpay; card data goes to them directly and never reaches our servers. We do keep a record of each payment — the plan, the amount, the currency and Razorpay's reference — so we can show you your receipts and answer a billing question.
Visitors to our website
This part is about anyone who opens telybot.com or the dashboard, whether or not they have an account. We measure our own website ourselves, with our own code on our own servers. No analytics company, advertising network or social platform receives anything about your visit, and none of it is used for advertising.
What we record
- The pages you open, in order, with the time spent on each and how far down you scrolled; which country version of the site you were reading; and how quickly the page loaded in your browser.
- Where you came from — the site or search engine that linked you, any campaign tags in the address, and whether you arrived through the "For Business" link on keyda.in.
- The links and buttons you click that we can name: sign-up, pricing, docs, contact, links to other sites, and code copied from our documentation.
- Your IP address, and the approximate location our server derives from it using an offline database — country, and usually a region and a nearby city. This is not GPS, it asks for no permission, and it is accurate to a city at best.
- Your device and browser as they describe themselves: device type and model, operating system, browser, screen size, language and time zone.
- In the dashboard, which screens you open and the steps of signing up (a code requested, a sign-in, a business created).
How you are recognised
Your browser stores a random identifier that means nothing outside our site; we do not build a profile from your device's characteristics, and nothing we store identifies you by name. Clearing your browser's site data for keyda.in removes it and makes you a new visitor to us. When you sign in, we connect that identifier to your Telybot account, so we can see which visit led to a sign-up. We do not use it to follow you on any other website, and we never sell it.
If your browser asks not to be tracked
If your browser sends Do Not Track or Global Privacy Control, we count the visit but keep nothing that could tie it to you: no identifier is stored between visits, and your IP address is not saved — the server still works out the country from it and then discards it.
Which country's site you see
When you open the international site, our server uses the country it works out from your IP address, with the same offline database, to open the version of the site for your country if there is one. Nothing is stored for this. If you choose a country or the international site yourself, your browser remembers that choice in a cookie named kb_region for a year, and your choice always comes before our guess.
Why
Our legitimate interest in knowing whether our own website works: which pages people read, which countries they come from, where sign-ups come from, and whether the site is fast enough. If you would rather we did not keep this, ask us to erase it — see Your rights — and we will.
Why we are allowed to process it
- To perform our contract with you — running your Bot, metering usage, supporting you.
- Our legitimate interests — keeping the Service secure, preventing abuse, and improving reliability.
- Legal obligation — tax, accounting and lawful requests from authorities.
Who it reaches
We share data with the sub-processors listed in our Data Processing Agreement — AI providers who generate answers, our hosting and database providers, and the provider that delivers your sign-in code and any WhatsApp alerts you switch on. Each acts under contract and only to deliver the Service.
We do not sell your data, and we do not share it for advertising.
The AI providers we use do not retain your content to train their models. A photo a customer attaches is sent once to a provider with image understanding, to be described in text; it is that description, not the photo, that the Bot works from afterwards. Answers are generated on demand.
Who at Telybot can see it
Our operations team can read a business's conversations to investigate abuse or when you ask us for help with a specific chat. Every such access is recorded — what was read, which business, when and from where. That log is itself subject to erasure requests.
How long we keep it
- Visitor conversations: 90 days by default. You can shorten this, extend it up to one year, or turn expiry off entirely, per bot, in your dashboard settings.
- Files, welcome-flow details and AI summaries: stored with the conversation they belong to and deleted with it — on the same window, and immediately when you delete the business.
- Orders and bookings: kept as the business's record of what was sold. The customer's name, phone number, address and notes on them are erased after 180 days; what was ordered and the amounts stay until the business is deleted. The copy of the name and phone number on the chat follows the visitor conversation period above.
- Leads, contact requests and unanswered questions: until the business deletes them, or deletes the business — they do not expire with the conversation.
- Menu counts: 400 days, and deleted with the business. Alert records: until the business is deleted.
- Your sources and saved answers: until you delete them.
- Your account and business: until you delete the business.
- Server logs: a short rolling window for security and diagnostics.
- Website visit records: 400 days, and the IP address on them is erased after 180 days — the approximate location stays, the address does not.
Deleting a source removes its content from your assistant immediately. Deleting your business removes its sources, saved answers, conversations, orders and bookings and the assistant itself, and is not recoverable.
Where it is processed
Our servers and databases are operated on our behalf by the hosting providers named in the sub-processor list. The AI providers that generate answers, Twilio and Meta process data outside India. Where transfers require safeguards, they are made under the terms of our agreements with those providers.
Security
Access to the dashboard requires a signed token bound to your business account; a token issued for one product cannot be used on the other. Sign-in codes are stored only as a hash, never in readable form, expire quickly and are single-use. Administrative access is separately credentialed and logged. See Limits and security for the operational detail.
Your rights
You can ask us to access, correct, export or delete your account data, and to restrict or object to processing. Most of this is immediate in the dashboard; for anything else write to support@telybot.com and we will respond within 30 days.
If you are unhappy with how we handled a request you may complain to your local data protection authority.
Children
Telybot is a tool for businesses and is not directed at children. Do not use your Bot to knowingly collect personal data from children without the consent their law requires.
Changes to this policy
We will update the date at the top when this policy changes, and will tell you by email or in the dashboard when a change materially affects you.
Contact
Privacy questions, or to exercise any right above: support@telybot.com. To raise a grievance about how we handle personal data, write to the same address with the subject "Grievance".