Privacy Policy

This Privacy Policy explains how LetsBot collects, uses, shares and protects personal data, and the rights you have over it.

The controller. LetsBot is operated by BOT FOR DIGITAL SOLUTIONS LIMITED, a company registered in England and Wales under company number 15477940, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("LetsBot", "we", "us"). We are the controller of the personal data described in this policy.

Our affiliate in Egypt. Bot for Digital Solutions LLC («بوت للحلول الرقمية» ش.ذ.م.م), commercial register no. 223572 (Cairo Investment commercial registry office, GAFI), tax registration no. 759-096-287, Tower 22, 3rd floor, Masaken Sidi Abdel Rahim, Seger, Tanta 1st, Gharbia, Egypt, is our affiliate and regional office. It supports our customers and our operations. The people who have access to customer data, such as our support and engineering staff, work mainly in Egypt through this affiliate. Your contract for the LetsBot service is with the UK company.

Who this policy is about.

• Our customers (the businesses that subscribe to LetsBot) and the people who use a LetsBot workspace on their behalf, such as owners, admins and agents.
• Visitors to letsbot.net and people who contact us, sign up for a trial, or receive our marketing.
• People who talk to LetsBot's own support team on WhatsApp, e-mail or web chat.

What this policy does not cover. Our customers use LetsBot to talk to their own customers. For those conversations and contact lists, the business you were talking to decides how your data is used, and we process it only on its instructions (see section 2). Our Data Processing Agreement sets out those terms.

Contact. For privacy questions and requests, write to support@letsbot.net.

Language. This policy is published in English and Arabic. The English version governs; the Arabic version is provided for convenience.

We handle personal data in two different roles, and the rules differ for each.

1. Controller. For our customers' account data, our website visitors, our marketing and our own support conversations, we decide why and how the data is used. This policy covers that data.
2. Processor. When a business uses LetsBot to message its own customers, that business is the controller of its customers' phone numbers, names, messages, media, orders and other contact data. We store and process that data only to provide the service the business has asked for, under our Data Processing Agreement.

If you are a customer of a business that uses LetsBot and want to see, correct or delete your data, please contact that business. If you contact us instead, we will pass your request to the business within 48 hours and help it respond.

The companies that process data on our behalf, and the integrations our customers choose to connect, are listed on our subprocessors page.

Data you give us

• Account and identity: name, e-mail address, mobile number, password (stored only as a one-way hash), company name, and two-factor authentication settings if you turn them on.
• Workspace settings: language, time zone, store type, the channels and integrations you connect, and the team members you invite.
• Billing: plan, invoices, payment status, the card type and last four digits, and bank-transfer records. Full card details are collected and held by Stripe, not by us.
• Support and contact: what you write to us on WhatsApp, e-mail, web chat or the contact form, and any files you send.

Data we collect automatically

• Usage and security logs: sign-ins and failed sign-ins, IP address, browser and device type, two-factor and permission changes, and support-access events.
• Website analytics: pages viewed, clicks, referrer, device and approximate location, collected through the tags described in section 6 according to your cookie choice: outside Europe by default unless you decline them, and in the EU/EEA, the UK and Switzerland only if you accept them.
• Advertising identifiers: Meta browser and click identifiers (fbp, fbc), and the IP address and browser user agent at sign-up, which we use to measure our advertising.
• Mobile app: a push-notification identifier for your device and, for calls on iOS, a VoIP push token. The app has no third-party analytics or crash-reporting SDK.

Data we receive from others

• Sign-in providers: if you sign in with Google, Apple, Facebook or X, we receive your name, e-mail address and account identifier from that provider.
• Meta: when you connect a WhatsApp Business account, Facebook Page or Instagram account, we receive the business account details needed to run the channel.
• E-commerce and CRM platforms: when you connect a store or CRM, we receive the store or account details needed for the integration.
• Stripe: payment confirmations and the billing details needed for invoices.

We do not ask for sensitive data such as health, religion or biometric data, and we ask you not to send it to our support team.

Which data is required. We need your name, e-mail address, mobile number and billing details to create and run your account; without them we cannot provide the service. Everything else is optional.

Some countries use different legal bases. Sections 12 to 15 explain how this works in Saudi Arabia, the EU and UK, Brazil and Egypt.

Where we rely on legitimate interest you can object, and we will stop unless we have compelling grounds that override your interests or need the data for a legal claim. Where we rely on consent you can withdraw it at any time; this does not affect processing that took place before.

Our own AI assistant

LetsBot's support is answered around the clock by LetsBot's AI assistant, which always tells you it is an AI. Human support is available in Arabic and English; just ask for a person. To draft and send these replies, the content of your support conversation is processed by AI providers acting for us (OpenAI and Anthropic, listed on our subprocessors page).

AI features you switch on in your workspace

If you turn on AI replies, AI agents, voice-note transcription or AI tools, the messages, conversation history, voice notes, knowledge files and product catalogue needed for that feature are sent to OpenAI to generate the result, together with the contact's name and phone number where the feature needs them. OpenAI keeps the responses it generates under its API data policy. Under OpenAI's API terms, data sent through the API is not used to train its models by default (see OpenAI's business terms), and we have not opted in to any training use. You can switch these features off at any time.

We do not use our customers' data, or their customers' data, to train AI models. When the "learn from history" feature is on, what it learns stays inside that workspace and is used only for that workspace.

Automated decisions

We make one automated decision that can affect you: when you start a free trial, we check protected (hashed) identifiers of the channels you connect to see whether they have already had a free trial. If they have, the new workspace cannot start another free trial, but you can still subscribe. If you think this check is wrong, write to support@letsbot.net and a person will review it.

We do not otherwise make decisions about you based solely on automated processing that produce legal or similarly significant effects.

We use cookies and similar technologies on letsbot.net. Inside the LetsBot panel we use only strictly necessary cookies, except on the checkout pages, where the analytics and advertising tags below load according to your cookie choice (see "Your choice" below).

Your choice. Outside Europe, analytics and advertising cookies are on by default and you can decline them at any time from the banner or Cookie settings. In the EU/EEA, UK and Switzerland they stay off until you accept. We work out whether you are in Europe from your device's time zone and, on our servers, from the country of your connection. Our cookie banner shows "Accept" and "Decline" side by side; declining stops these tags and removes the cookies they set on our domain. We use Google Consent Mode, so Google's tags also respect your choice. You can change or withdraw your choice at any time from the "Cookie settings" link in the footer; we keep your choice in a cookie for up to 12 months. You can also block cookies in your browser and limit ad tracking in your Meta and Google settings.

We do not sell or rent personal data. We share it only as follows:

• Service providers that host, secure, deliver or support the service for us, such as Google Cloud (hosting), Cloudflare (network security and delivery), Stripe (payments), Zoho (e-mail), OneSignal (push notifications), OpenAI and Anthropic (AI). They may use the data only to provide their service to us. The full list, with locations, is on our subprocessors page.
• Our affiliate Bot for Digital Solutions LLC in Egypt, which supports our customers and operations under our instructions.
• Advertising platforms. We share with Meta a SHA-256 hash of the e-mail address and mobile number of our registered users, and an internal LetsBot identifier, so that Meta can match them against its own users. We use this to avoid advertising to existing customers, to reach them again, and to find audiences similar to our customers. Hashing protects the data in transit, but a platform that already holds the same e-mail address or number can match it; that is the purpose of the upload. Our website also reports actions such as sign-ups and purchases to Meta and Google, with the identifiers described in section 3 and the purchase value. To be excluded, write to support@letsbot.net; we will remove you from the next upload and ask the platform to delete the entry we sent earlier.
• Integrations you choose. When you connect Meta (WhatsApp, Messenger, Instagram), an e-commerce platform, a CRM or another tool, data flows to that service under its own terms because you asked for it.
• Authorities and legal claims. When the law, a court order or a binding request from a public authority requires it, or to protect our rights, our customers or the public. Where we can, we tell the affected customer first.
• Business transfers. If LetsBot is sold or merged, personal data may pass to the new owner, who must keep honouring this policy.

We may show your business name and logo in our customer list. Tell support@letsbot.net if you prefer we do not; we will stop using them in new material from that date.

All LetsBot servers and backups are on Google Cloud in the United States (region us-east1, South Carolina). This includes all databases, files, media and backups. We do not offer hosting in any other region.

Our staff who have access to customer data work mainly in Egypt, through our affiliate Bot for Digital Solutions LLC, and access it remotely. Some of our service providers process it in other countries, mainly the United States. Each provider's location is on our subprocessors page.

The United States does not have a general adequacy finding under the laws of the UK, the EU, Saudi Arabia, Brazil or Egypt. We therefore protect these transfers as follows:

• EU and UK: data from the EU comes to us in the UK, which the European Commission recognises as adequate. For onward transfers to providers in the United States we rely on the safeguards in each provider's data processing terms, such as the EU Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement. For our business customers' data, our Data Processing Agreement, which forms part of our Terms, also incorporates the EU Standard Contractual Clauses and the UK Addendum.
• Saudi Arabia: under the Personal Data Protection Law we tell you that your data is processed outside the Kingdom. Our Data Processing Agreement, which forms part of our Terms, incorporates the SDAIA standard contractual clauses (controller to processor); they apply automatically to every business customer from acceptance of the Terms.
• Brazil: our Data Processing Agreement incorporates, in full and unaltered, the ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024); they apply automatically to every business customer from acceptance of the Terms.
• Egypt: transfers from Egypt are subject to Law No. 151 of 2020 and its Executive Regulations. Where they require a licence or permit, we will obtain it before relying on it.

To request a copy of the safeguards that apply to your data, write to support@letsbot.net.

Deleting your workspace or a conversation

Any account owner can delete the whole workspace from the panel at any time, whether or not they have a paid subscription. Giving a reason is optional. Deleting a workspace also ends its subscription.

Within 30 days of deleting a workspace we remove its data from our live systems, including its stored media, any archived copy of the workspace, the files and stored responses held for AI features at our AI provider, and the messages held by our WhatsApp QR-code connection service. Copies in backups expire within a further 30 days, when each backup is deleted.

Deleting a single conversation erases its messages and media.

We keep only what the law requires us to keep (such as invoices) and a short deletion record (the workspace identifier, the date and the reason, if you gave one), which contains no messages or contacts.

• Connections to letsbot.net and the panel use TLS (HTTPS with HSTS).
• Data at rest is encrypted by Google Cloud with Google-managed keys. Channel access tokens, integration secrets, two-factor secrets and similar credentials are additionally encrypted by the application.
• Passwords are stored only as bcrypt hashes.
• Each workspace has its own separate database.
• Databases and caches are not reachable from the internet; traffic passes through Cloudflare's network protection.
• Two-factor authentication, sign-in IP restrictions and a security activity log are available to every workspace.
• Incoming webhooks from Meta, Salla and Zid are accepted only with a valid signature.
• Our support staff enter a workspace only to provide support, and every entry is recorded in the workspace's security log, which the account owner can review. If you turn on two-factor authentication for your workspace, our staff can enter it only with your explicit approval.
• Media files exchanged in conversations (images, voice notes, videos and documents) are kept in cloud storage that cannot be browsed or listed, and are served through long, random links that are hard to guess. Anyone who has the exact link can open the file. Contact profile pictures use simpler links. We are moving media to time-limited signed links.
• Backups and archived workspaces are kept in private storage buckets with public access prevented.
• Our internal error alerts mask phone numbers and e-mail addresses.

Our platform must read message content to deliver it, store it and, if you switch on AI features, process it. Messages are therefore stored in readable form on our servers, protected by the measures above.

LetsBot does not currently hold a security certification such as ISO 27001. Our hosting provider's certifications cover Google's infrastructure, not LetsBot. No system is completely secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

Depending on where you live, you may have the right to:

• know what personal data we hold about you and receive a copy of it in a readable format;
• correct inaccurate or incomplete data;
• have your data deleted or anonymised;
• restrict or object to some uses, including direct marketing at any time;
• receive your data in a portable format, or have it sent to another provider;
• withdraw consent at any time;
• ask for a human review of an automated decision;
• complain to us and to a data protection authority.

How to ask. Write to support@letsbot.net. Account owners can also export their contacts and conversations, and delete contacts, conversations or the whole workspace, from the panel. We may ask you to confirm your identity before we act.

How quickly we answer.

Requests are free of charge, except where the law allows a fee (for example under Egyptian law, or for requests that are clearly unfounded or excessive), and we will tell you before charging anything.

• Legal basis. We process your data with your consent, or without consent where the law allows it: to perform an agreement you are party to, to meet a legal obligation, or for our legitimate interest where your rights do not override it. We do not process sensitive data on the basis of legitimate interest.
• Processing outside the Kingdom. Your data is processed in the United States, where it is hosted, and in Egypt, from where most of our team works. The recipients and their roles are listed on our subprocessors page.
• Your rights. To be informed, to access your data, to obtain a copy in a readable and clear format, to correct it, to have it destroyed when it is no longer needed, and to withdraw consent. We answer within 30 days (see section 11).
• Marketing. We send marketing messages only with your consent, identify ourselves in every message, and make opting out as easy as opting in.
• Complaints. You can complain to us, and to the Saudi Data and AI Authority (SDAIA).

• Controller. BOT FOR DIGITAL SOLUTIONS LIMITED, United Kingdom (details in section 1). We have not appointed an EU representative; EU data subjects may contact us at support@letsbot.net.
• Legal bases are set out in section 4. Where we rely on legitimate interest, you can ask us for the balancing test we carried out.
• Transfers are explained in section 8. You can ask for a copy of the safeguards.
• Complaints. Please contact us first at support@letsbot.net. We acknowledge every complaint within 30 days, look into it, and tell you the outcome. You may also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in the EU country where you live or work.

• Controller: BOT FOR DIGITAL SOLUTIONS LIMITED (section 1).
• Data protection officer (encarregado): our encarregado point of contact is support@letsbot.net.
• Your rights under Article 18 LGPD: confirmation that we process your data; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about who we share it with; information about the possibility of refusing consent and its consequences; withdrawal of consent; and review of decisions made solely by automated processing.
• Transfers: your data is processed in the United States (section 8). A Portuguese summary of how we transfer data internationally is available on request at support@letsbot.net.
• Complaints: you may petition the Autoridade Nacional de Proteção de Dados (ANPD).

• Who is responsible. The controller is BOT FOR DIGITAL SOLUTIONS LIMITED (UK). Our affiliate in Egypt, Bot for Digital Solutions LLC («بوت للحلول الرقمية» ش.ذ.م.م, commercial register no. 223572, Cairo Investment registry office), Tower 22, 3rd floor, Masaken Sidi Abdel Rahim, Seger, Tanta 1st, Gharbia, Egypt, is our local point of contact.
• Consent. Under Egyptian law we process your data with your explicit consent, unless the law permits processing without it, for example to perform a contract with you or to meet a legal obligation. This includes your consent to the transfer of your data to the countries listed in section 8, which we ask for when you sign up.
• Your rights: to know and access your data; to withdraw consent; to correct, update, add to or delete it; to limit processing to a specific purpose; to be told of a breach affecting your data; and to object to processing.
• Deadline and fees. We answer within six working days. The law allows a fee for some requests, set by the Personal Data Protection Center; we will tell you before charging anything.
• Complaints: you may complain to the Personal Data Protection Center.
• Children: we do not knowingly collect data of children under 15 without the written consent of their guardian.

We apply this policy to everyone, wherever they live. If the law where you live gives you more rights than this policy describes, including in the United Arab Emirates and other GCC countries, we will honour them. Write to support@letsbot.net and tell us where you live so we can apply the right rules.

LetsBot is a service for businesses and is not intended for children. We do not knowingly collect personal data from anyone under 18 for our own purposes. If you believe a child has given us personal data, write to support@letsbot.net and we will delete it.

We will update this policy when our practices or the law change. The "Last updated" date at the top shows the latest version. For a material change we will tell account owners by e-mail or in the panel at least 30 days before it takes effect. Where a change needs your consent, we will ask for it rather than treat your continued use as consent.

• Privacy questions, requests and support: support@letsbot.net
• Post: BOT FOR DIGITAL SOLUTIONS LIMITED, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
• Egypt: Bot for Digital Solutions LLC, Tower 22, 3rd floor, Masaken Sidi Abdel Rahim, Seger, Tanta 1st, Gharbia, Egypt

Related documents: Terms & Conditions · Data Processing Agreement · Subprocessors · Service Level Agreement

1. When a merchant adds the LetsBot chat to their website, the merchant is responsible for their visitors' data and LetsBot processes it on the merchant's behalf and on their instructions.
2. When a visitor opens the chat we collect: the messages and files they send; their name, e-mail and phone only if they type them; the page they are on, the pages of that same site they visited during the visit, the page they came from and campaign (UTM) tags; browser, device and language; and the IP address with the approximate location derived from it (country and city) as provided by our network provider, Cloudflare.
3. We use this data to deliver the conversation to the merchant's team, to help them answer, and to protect the service from spam and abuse (rate limits and blocking). We do not use it for advertising and we do not sell it.
4. Retention: a visitor who never sends a message is deleted after 30 days. The IP address and precise location (city, region, postcode, coordinates) are erased 90 days after the last activity; only the country is kept. Device, pages and referrer data are erased 365 days after the last activity. Messages follow the merchant's own chat retention, and deleting a conversation deletes the visitor data linked to it.
5. Under the GDPR and Brazil's LGPD a visitor may access, correct, delete or port their data, object to its processing, and learn who it is shared with. They can ask the merchant whose website it is, or write to support@letsbot.net; we answer within the time the law requires.
6. Data may be processed on servers outside the visitor's country, including the United States, and is protected by encryption in transit and restricted access.

When you choose to connect a Google service in LetsBot, we ask Google only for the access that feature needs:

• Sign in with Google (name, e-mail address and profile picture): to create your LetsBot account and sign you in.
• Google Calendar (calendar.events): to create, update and cancel the appointments your customers book through LetsBot on the calendar you choose, and to read your events so the same time is not booked twice.
• YouTube (youtube.upload, youtube.readonly): to publish the videos you schedule in LetsBot Social Studio to your channel, and to show your channel name and the status of those videos. By connecting YouTube you also agree to the YouTube Terms of Service; how Google handles your data is described in the Google Privacy Policy.
• Google Business Profile (business.manage): to show your Google reviews in the LetsBot inbox, post your replies, and publish the posts you create to your Business Profile.

We use this data only to provide these features to you. We do not sell it, use it for advertising, or use it to train AI models. Access tokens are stored encrypted and are deleted when you disconnect the service in LetsBot or delete your account. You can also remove LetsBot's access at any time from your Google Account at myaccount.google.com/permissions.

LetsBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.