Privacy Policy

Service Provision & AI Automation

• Delivering our AI-powered automation solutions (Mail2ERP, AutoERP, etc.)
• Processing transactions and managing service subscriptions
• Providing technical support and automation consulting
• Monitoring system performance and bot reliability
• Facilitating ERP integrations and data processing workflows

Communication & Support

Official communications from us are sent only from our verified domains @bots4.me and @tirelessbots.com.

• Sending service updates and important automation notifications
• Responding to inquiries and technical support requests
• Providing automation consulting and implementation guidance
• System maintenance alerts and security notifications
• Product updates, feature announcements, and upgrade opportunities for existing customers (including free-tier), based on our legitimate interest in informing users about similar services — with opt-out available in every communication
• Broader marketing communications about business solutions, industry insights, and case studies (with explicit opt-in consent via subscription form)

Legal Basis for Processing

We process your data based on the following legal grounds:

• Contract Performance: To deliver AI automation services you’ve purchased and maintain ERP integrations
• Legal Obligation: For accounting, tax compliance, and regulatory requirements
• Legitimate Interest: For system security, fraud prevention, service improvement, business analytics, cookie-free statistics of our own website (including which campaign, website or partner brought a new customer), and communicating with existing customers (including free-tier users) about similar BOTS4.me products and services in accordance with Article 13(2) of the ePrivacy Directive (2002/58/EC). We have conducted a Legitimate Interest Assessment confirming that our interest in informing existing customers about relevant product updates and upgrade opportunities does not override your rights and freedoms, particularly as every communication includes an easy opt-out mechanism.
• Consent: For broader marketing communications (newsletter, case studies, partner content), optional features, and remembering in your browser which campaign or partner link brought you (cookie banner, “Marketing”). Consent is collected separately via our cookie banner and our subscription forms and may be withdrawn at any time without affecting the lawfulness of prior processing or your access to the Service.

AI-Assisted Drafting

• Our sales and support e-mails are drafted with the help of an AI model (currently Anthropic’s Claude) and sent from support@bots4.me. Every such e-mail says that AI helped to write it.
• A person at BOTS4.me reviews and approves the e-mails of every case that needs one (an escalation): a complaint, a low rating, a legal, contract or data-protection question, a price question, or a request to talk to a person.
• To write a relevant e-mail, the AI uses facts about your account: your plan and its dates, which setup steps you have completed (mailbox, ERP connection, first Demo report, first live run), how much of your plan’s allowance you have used (as a percentage), your language and country, how you found us (for example a campaign or a partner), whether you unsubscribed from our e-mails, and our earlier e-mails with you.
• It never uses the content of the e-mails, documents or business data our bots process for you.

Your Sales Timeline and Attention Score

For each company we keep one internal timeline of these facts and of the e-mails we exchanged, and we compute an internal score (0–100) from the likely value of the account and how much attention it needs (for example a setup step that has stalled, an error, or a question that is still open). The score only decides which accounts a person at BOTS4.me looks at first and when a follow-up e-mail is due. This is profiling for follow-up, based on our legitimate interest. It never leads to a decision with legal or similarly significant effects for you: it does not change your prices, your plan, your access or the approval of your account.

Ratings of Our E-mails

Each sales and support e-mail contains a personal link where you can rate it with 1 to 5 stars for speed, clarity, whether it solved your problem and the product overall, and leave an optional comment. The rating is stored with a reference to that e-mail conversation, collected by our support system and then deleted from the website. We use ratings to improve our answers; after a low rating, a person at BOTS4.me takes over the conversation.

Retention, Deletion and Opting Out

• The timeline, the score and the ratings are deleted 400 days after the last event in the timeline, and at once when you delete your account.
• Every sales e-mail contains an unsubscribe link (and a one-click unsubscribe for your e-mail program). Unsubscribing stops these e-mails and our product e-mails; it does not affect the e-mails needed to run your service or your access to BOTS4.me.
• You can object to this follow-up and profiling at any time by writing to privacy@bots4.me (see Your Privacy Rights).

Data Processing Boundaries

When BOTS4.me processes data on your behalf (including emails, invoices, and other business documents submitted to our automation services), we act strictly as a data processor under GDPR Article 28. This means:

• Data submitted for processing is used exclusively to deliver the requested automation services
• We do not use processed data for marketing, lead generation, profiling, or any purpose unrelated to the service you requested
• Third-party personal data contained within your processed documents (such as contact information of your customers, suppliers, or partners) is never used by BOTS4.me for our own purposes
• We do not contact, profile, or market to any third parties whose data appears in your processed documents
• These boundaries apply to all service tiers, including free-tier accounts
• Processed data is retained only for the duration necessary to deliver the service and is deleted in accordance with our data retention policy

Automation Configuration Data

• Email processing rules and filters for Mail2ERP
• ERP integration mappings and field configurations
• Business workflow automation rules and schedules
• API endpoints and authentication credentials (encrypted)
• Data transformation and validation rules

Processed Business Content

• Email metadata and processing results (not email content)
• Bot execution logs and performance metrics
• Error reports and debugging information
• Data import/export statistics and success rates
• System integration health and monitoring data

Essential Service Providers (Sub-processors)

• Cloud Infrastructure: A tier-1 European Union data-center operator (Czech Republic) hosts both the public bots4.me website (WordPress) and the dynamically-provisioned per-client production processing servers. All customer personal data is stored and processed within the European Union. The specific hosting provider’s identity is available to customers on request under our Data Processing Agreement (DPA).
• Identity Providers: Microsoft Corporation (Microsoft Entra ID / Microsoft Graph) and Google LLC (Google Identity Services) when you use Secure Quick Connect (OAuth) to link a Microsoft 365 or Google account. We never receive your password — these providers issue us a revocable access token scoped to the permissions you approve.
• Cloud Storage Providers: Microsoft OneDrive and Google Drive when you use Mail2CLOUD to back up email attachments. We hold a narrow OAuth token (App Folder / drive.file scope) that can only see files our application created.
• Payment Processors: Stripe Payments Europe Ltd. (Ireland) and other secure payment gateways (payment data only — we never see your card number)
• Email Services: Transactional email providers for system notifications
• Website Statistics: measured by BOTS4.me itself on its own web server, without cookies — no third-party analytics (see Cookies & Tracking below)
• Bot Protection: Google LLC (Google reCAPTCHA) on website forms, to block automated abuse
• Security Services: CloudFlare Inc. for DDoS protection and CDN services in front of the public website
• Push Notification Services: Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service) for the BOTS4.me mobile app — push token and notification text only, see the Mobile App section
• AI Processing: Only when you switch on an AI mode for an app: Mistral AI (EU endpoint), OpenAI (EU endpoint where available), Anthropic and Scaleway (EU). They receive only the text and attachments of the e-mail being processed, never use it to train their models, and we use zero-retention API terms where the provider offers them. Anthropic also helps us draft our own sales and support e-mails (see AI-Assisted E-mails, Follow-up and Ratings above).
• Encrypted Backups: A separate server in the European Union that we control; backups are encrypted (AES-256-GCM) before they leave the processing servers.
• Encryption Architecture: Sensitive customer data stored on the public bots4.me website is encrypted with an RSA-2048 public key. The matching private key is held on a separate isolated server we control and never resides on the same host as the encrypted data. Production processing servers operate on decrypted data only in volatile memory; no decrypted client data is written to disk.
• Email Delivery Services: For sending transactional notifications and product communications to existing customers. Email addresses are shared with our email delivery provider, Websupport, s.r.o. (Bratislava, Slovakia, European Union), solely for message transmission and are not used for any other purpose.

A current sub-processor list is maintained at bots4.me/privacy-policy. We will notify customers of any material change at least 30 days before a new sub-processor begins processing personal data.

Third-Party Authentication Scopes (OAuth)

When you use Secure Quick Connect to link a Microsoft 365, Google, Microsoft OneDrive or Google Drive account, we request only the minimum OAuth permissions needed for the product features you activate. Below is the complete list of scopes we may request, with the exact reason each one is needed and what we never do with it.

Microsoft (Microsoft Entra ID / Microsoft Graph)

Google (Google Identity / Gmail / Drive)

What we never do with OAuth-granted access

• We never use your email content, contacts, attachments or any Google/Microsoft user data to build, train or improve generalised or third-party AI/ML models. Models are tuned on your account’s own data only, in your account’s own isolated processing context.
• We never sell your data, share it with advertising networks, or use it to serve targeted ads.
• We never read mail or open attachments for human review except where strictly required to deliver a feature you activated, or where you explicitly request support troubleshooting on a specific message.
• We never permanently delete mail, files or folders that we did not create.
• We never transfer OAuth tokens to any party outside our infrastructure, except to the issuing provider (Microsoft or Google) when we exchange or refresh them.

Google API Services User Data Policy — Limited Use Disclosure

BOTS4.me’s use of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

Specifically, BOTS4.me only uses access to read, write or send Gmail messages and Google Drive files to provide or improve user-facing features that are prominent in the requesting application’s user interface. We do not transfer Google user data to a third party except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with the user’s explicit consent. We do not use Google user data for serving advertisements, including retargeted, personalised or interest-based advertising. We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations and only with data that has been aggregated and anonymized.

Business Integration Partners

• ERP Vendors: When you authorize integrations with Odoo, SAP, QuickBooks, etc.
• API Services: Third-party APIs you configure for your automation workflows
• Translation Services: For multi-language support in our AI processing

Legal Requirements

We may disclose data when required by law, such as:

• Court orders or legal proceedings
• Law enforcement requests (with valid legal basis)
• Tax and regulatory compliance obligations
• Protection of our rights, safety, and intellectual property

What the app collects

• Account identity: the email address and display name of the bots4.me account you sign in with. Used to authenticate you and to show your dashboard.
• Device registration: a device identifier generated for your installation, the device platform (Android or iOS) and the app language you choose. Used so notifications can be delivered to, and switched off for, each device separately.
• Push notification token: if you allow notifications, a token issued by Firebase Cloud Messaging (Android and iOS) or Apple Push Notification service (iOS). It is stored with your account and used only to deliver notifications about your own bots.

The app does not collect location, contacts, photos, files, browsing history, advertising identifiers or usage analytics, and it contains no advertising or third-party analytics software. All traffic between the app and bots4.me is encrypted (HTTPS).

Retention and deletion

• Device registrations and push tokens are kept until you unlink the device in the app, turn notifications off, uninstall the app, or delete your account.
• Delete your account from the app: Settings → Delete account. Your request is recorded immediately: the bots keep running until the end of the period you have paid for, and then the account, its device registrations and push tokens, and its automation configurations are erased, subject to the retention periods listed under Data Security for invoices and legal records. When your account is closed, the stored access tokens, passwords and API keys of all its connected accounts (mailboxes, ERP and cloud connections) are deleted from our website and our processing servers within 48 hours, access is revoked at Google, QuickBooks, Xero, Dropbox and Box (Microsoft access tokens are deleted and expire on their own), and the encrypted backups of the account on our backup server are deleted with it; encrypted copies of our website database may hold its encrypted data until they are replaced. When you remove a connected account (a mailbox, ERP or cloud connection), it disappears from your dashboard immediately, and its stored access tokens are deleted from our processing servers within 48 hours (Google access is also revoked at Google).
• You can also request deletion by email to the privacy contact below; the same rules apply.

Sub-processors used by the app

• Google LLC (Firebase Cloud Messaging): delivery of push notifications. Receives the push token and the notification payload (bot name and a short status), never the content of your emails or ERP data.
• Apple Inc. (Apple Push Notification service): delivery of push notifications on iOS, same data as above.

Technical Safeguards

• Encryption in Transit and at Rest: All data encrypted in transit (TLS 1.2 or higher) and at rest (AES-256)
• Multi-Factor Authentication: Required for all administrative access
• Access Controls: Access limited to the operator, and least privilege on every system
• Network Security: Firewalls, intrusion detection, and DDoS protection
• API Security: OAuth 2.0, rate limiting, and request validation
• Monitoring: Automated monitoring with immediate alerts to the operator

Organizational Measures

• Security practices reviewed regularly by the operator
• No other personnel has access to customer data
• Incident response procedures and breach notification protocols
• Automated vulnerability scanning before releases and an independent annual security assessment (Google CASA)
• Data minimization practices and privacy by design principles
• Secure development lifecycle (SDLC) practices

Data Retention Periods

• Account Data: Retained while your account is active, plus 30 days
• Transaction Records: 10 years for accounting and tax purposes
• Communication Logs: 3 years from last interaction
• Technical Logs: 12 months for security and performance analysis
• Automation Configurations: Retained until account deletion + 90 days
• Support Tickets: 5 years for service improvement and legal compliance
• Sales Timeline, Attention Score and E-mail Ratings: 400 days after the last event, or at once when you delete your account

Essential Cookies

Required for the website and your account to work:

• Sign-in and session management
• Checkout and payment (including fraud prevention by the payment provider)
• Security and bot protection (Cloudflare, Google reCAPTCHA)
• Your language choice and dashboard preferences

Website Statistics (no cookies)

We count visits ourselves, on our own web server, without cookies and without storing anything on your device:

• What is counted: the page you opened, the website or campaign link that sent you, the language version, your country (derived from your IP address) and your device type (phone, tablet or desktop, from the information every browser sends); only if you allow “Statistics” in the cookie banner, also how many seconds a page stayed visible
• Your IP address is never stored; visitors are counted with a pseudonymous code whose secret is replaced every day and then deleted; page views on the day you create an account can be connected to it until they are deleted
• If your browser sends a “Global Privacy Control” or “Do Not Track” signal, or you refuse “Statistics” in the cookie banner, your visit is not counted
• Individual page views are deleted after 60 days; only daily totals are kept
• When you create an account, start Discovery or place an order, we keep with your account which campaign, website or partner brought you; this is removed when you ask us to erase your personal data

Campaign and Partner Links

If you allow “Marketing” in our cookie banner and arrive through a link in one of our e-mail campaigns or from a BOTS4.me partner, your browser remembers that campaign or partner for 90 days (no personal identifier), so a later sign-up can be credited correctly. Without that consent nothing is stored, and withdrawing it removes the memory. Refusing “Marketing” does not change the cookie-free statistics above, which can still note the website or campaign link that brought you when you create an account on the day you arrived (legitimate interest).

How to Exercise Your Rights

To exercise any of these rights:

• Email us: privacy@bots4.me with your request
• Account Dashboard: Manage preferences directly in your automation dashboard
• Support Portal: Submit a ticket through our support system
• Written Request: Send a letter to our registered office address

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with:

• Estonian Data Protection Authority: Our lead supervisory authority
• Your Local DPA: The data protection authority in your EU country
• European Data Protection Board: For cross-border data protection issues

EU Data Processing

• Primary data processing occurs within the European Union
• EU-based servers and infrastructure for customer data
• GDPR compliance for all European customers
• Estonian data protection law compliance

International Customers

• Adequacy Decisions: For countries with adequate data protection (UK, Switzerland, etc.)
• Standard Contractual Clauses: For transfers to countries without adequacy decisions
• Customer Data Residency: Available for enterprise clients with specific requirements
• Regional Processing: Where required by local data protection laws

Postal Address

Business Hours

• Privacy Requests: Processed within 72 hours of receipt
• Technical Support: Monday-Friday, 8:00-12:00 CET
• Emergency Contact: Available 24/7 for data breach notifications