Privacy Policy

Service Provision & AI Automation

• Delivering our AI-powered automation solutions (Mail2ERP, AutoERP, etc.)
• Processing transactions and managing service subscriptions
• Providing technical support and automation consulting
• Monitoring system performance and bot reliability
• Facilitating ERP integrations and data processing workflows

Communication & Support

Official communications from us are sent only from our verified domains @bots4.me and @tirelessbots.com.

• Sending service updates and important automation notifications
• Responding to inquiries and technical support requests
• Providing automation consulting and implementation guidance
• System maintenance alerts and security notifications
• Product updates, feature announcements, and upgrade opportunities for existing customers (including free-tier), based on our legitimate interest in informing users about similar services — with opt-out available in every communication
• Broader marketing communications about business solutions, industry insights, and case studies (with explicit opt-in consent via subscription form)

Legal Basis for Processing

We process your data based on the following legal grounds:

• Contract Performance: To deliver AI automation services you’ve purchased and maintain ERP integrations
• Legal Obligation: For accounting, tax compliance, and regulatory requirements
• Legitimate Interest: For system security, fraud prevention, service improvement, business analytics, and communicating with existing customers (including free-tier users) about similar BOTS4.me products and services in accordance with Article 13(2) of the ePrivacy Directive (2002/58/EC). We have conducted a Legitimate Interest Assessment confirming that our interest in informing existing customers about relevant product updates and upgrade opportunities does not override your rights and freedoms, particularly as every communication includes an easy opt-out mechanism.
• Consent: For broader marketing communications (newsletter, case studies, partner content), optional features, and advanced analytics. Consent is collected separately via our subscription forms and may be withdrawn at any time without affecting the lawfulness of prior processing or your access to the Service.

Data Processing Boundaries

When BOTS4.me processes data on your behalf (including emails, invoices, and other business documents submitted to our automation services), we act strictly as a data processor under GDPR Article 28. This means:

• Data submitted for processing is used exclusively to deliver the requested automation services
• We do not use processed data for marketing, lead generation, profiling, or any purpose unrelated to the service you requested
• Third-party personal data contained within your processed documents (such as contact information of your customers, suppliers, or partners) is never used by BOTS4.me for our own purposes
• We do not contact, profile, or market to any third parties whose data appears in your processed documents
• These boundaries apply to all service tiers, including free-tier accounts
• Processed data is retained only for the duration necessary to deliver the service and is deleted in accordance with our data retention policy

Automation Configuration Data

• Email processing rules and filters for Mail2ERP
• ERP integration mappings and field configurations
• Business workflow automation rules and schedules
• API endpoints and authentication credentials (encrypted)
• Data transformation and validation rules

Processed Business Content

• Email metadata and processing results (not email content)
• Bot execution logs and performance metrics
• Error reports and debugging information
• Data import/export statistics and success rates
• System integration health and monitoring data

Essential Service Providers (Sub-processors)

• Cloud Infrastructure: A tier-1 European Union data-center operator (Czech Republic) hosts both the public bots4.me website (WordPress) and the dynamically-provisioned per-client production processing servers. All customer personal data is stored and processed within the European Union. The specific hosting provider’s identity is available to customers on request under a signed Data Processing Agreement (DPA).
• Identity Providers: Microsoft Corporation (Microsoft Entra ID / Microsoft Graph) and Google LLC (Google Identity Services) when you use Secure Quick Connect (OAuth) to link a Microsoft 365 or Google account. We never receive your password — these providers issue us a revocable access token scoped to the permissions you approve.
• Cloud Storage Providers: Microsoft OneDrive and Google Drive when you use Mail2CLOUD to back up email attachments. We hold a narrow OAuth token (App Folder / drive.file scope) that can only see files our application created.
• Payment Processors: Stripe Payments Europe Ltd. (Ireland) and other secure payment gateways (payment data only — we never see your card number)
• Email Services: Transactional email providers for system notifications
• Analytics Providers: Google Analytics for service improvement (anonymized data only)
• Security Services: CloudFlare Inc. for DDoS protection and CDN services in front of the public website
• Encryption Architecture: Sensitive customer data stored on the public bots4.me website is encrypted with an RSA-2048 public key. The matching private key is held on a separate isolated server we control and never resides on the same host as the encrypted data. Production processing servers operate on decrypted data only in volatile memory; no decrypted client data is written to disk.
• Email Delivery Services: For sending transactional notifications and product communications to existing customers. Email addresses are shared with our email delivery provider solely for message transmission and are not used for any other purpose.

A current sub-processor list is maintained at bots4.me/privacy-policy. We will notify customers of any material change at least 30 days before a new sub-processor begins processing personal data.

Third-Party Authentication Scopes (OAuth)

When you use Secure Quick Connect to link a Microsoft 365, Google, Microsoft OneDrive or Google Drive account, we request only the minimum OAuth permissions needed for the product features you activate. Below is the complete list of scopes we may request, with the exact reason each one is needed and what we never do with it.

Microsoft (Microsoft Entra ID / Microsoft Graph)

Google (Google Identity / Gmail / Drive)

What we never do with OAuth-granted access

• We never use your email content, contacts, attachments or any Google/Microsoft user data to build, train or improve generalised or third-party AI/ML models. Models are tuned on your account’s own data only, in your account’s own isolated processing context.
• We never sell your data, share it with advertising networks, or use it to serve targeted ads.
• We never read mail or open attachments for human review except where strictly required to deliver a feature you activated, or where you explicitly request support troubleshooting on a specific message.
• We never permanently delete mail, files or folders that we did not create.
• We never transfer OAuth tokens to any party outside our infrastructure, except to the issuing provider (Microsoft or Google) when we exchange or refresh them.

Google API Services User Data Policy — Limited Use Disclosure

BOTS4.me’s use of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

Specifically, BOTS4.me only uses access to read, write or send Gmail messages and Google Drive files to provide or improve user-facing features that are prominent in the requesting application’s user interface. We do not transfer Google user data to a third party except as necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with the user’s explicit consent. We do not use Google user data for serving advertisements, including retargeted, personalised or interest-based advertising. We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for internal operations and only with data that has been aggregated and anonymized.

Business Integration Partners

• ERP Vendors: When you authorize integrations with Odoo, SAP, QuickBooks, etc.
• API Services: Third-party APIs you configure for your automation workflows
• Translation Services: For multi-language support in our AI processing

Legal Requirements

We may disclose data when required by law, such as:

• Court orders or legal proceedings
• Law enforcement requests (with valid legal basis)
• Tax and regulatory compliance obligations
• Protection of our rights, safety, and intellectual property

Technical Safeguards

• End-to-End Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Multi-Factor Authentication: Required for all administrative access
• Access Controls: Role-based permissions and principle of least privilege
• Network Security: Firewalls, intrusion detection, and DDoS protection
• API Security: OAuth 2.0, rate limiting, and request validation
• Monitoring: 24/7 security monitoring and threat detection

Organizational Measures

• Regular security training for all team members
• Background checks for personnel with data access
• Incident response procedures and breach notification protocols
• Regular security assessments and penetration testing
• Data minimization practices and privacy by design principles
• Secure development lifecycle (SDLC) practices

Data Retention Periods

• Account Data: Retained while your account is active, plus 30 days
• Transaction Records: 10 years for accounting and tax purposes
• Communication Logs: 3 years from last interaction
• Technical Logs: 12 months for security and performance analysis
• Automation Configurations: Retained until account deletion + 90 days
• Support Tickets: 5 years for service improvement and legal compliance

Essential Cookies

Required for core automation platform functionality:

• User authentication and session management
• Security protection and fraud prevention
• API access and integration maintenance
• Dashboard preferences and automation settings

Analytics Cookies (Optional)

Help us understand and improve our AI automation services:

• Feature usage and adoption analytics
• Bot performance and efficiency metrics
• User journey optimization data
• Service reliability and error tracking

How to Exercise Your Rights

To exercise any of these rights:

• Email us: [email protected] with your request
• Account Dashboard: Manage preferences directly in your automation dashboard
• Support Portal: Submit a ticket through our support system
• Written Request: Send a letter to our registered office address

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with:

• Estonian Data Protection Authority: Our lead supervisory authority
• Your Local DPA: The data protection authority in your EU country
• European Data Protection Board: For cross-border data protection issues

EU Data Processing

• Primary data processing occurs within the European Union
• EU-based servers and infrastructure for customer data
• GDPR compliance for all European customers
• Estonian data protection law compliance

International Customers

• Adequacy Decisions: For countries with adequate data protection (UK, Switzerland, etc.)
• Standard Contractual Clauses: For transfers to countries without adequacy decisions
• Customer Data Residency: Available for enterprise clients with specific requirements
• Regional Processing: Where required by local data protection laws

Postal Address

Business Hours

• Privacy Requests: Processed within 72 hours of receipt
• Technical Support: Monday-Friday, 9:00-17:00 EET
• Emergency Contact: Available 24/7 for data breach notifications