Privacy Policy

This policy explains what data SiteBot collects, why, how we store and protect it, and the choices you have. It covers three groups: account owners who run SiteBot, the website content they connect, and the end visitors who chat with the widget on a customer's site.

SiteBot ("SiteBot", "we", "us") is operated from India. If you have any questions, contact us at hello@sitebot.in.

1. What SiteBot does

SiteBot turns a website into an AI chatbot. A website owner adds their site; SiteBot crawls the site's pages, extracts the text, and stores that text (broken into chunks and indexed with a full-text search index) so an AI assistant can answer visitors' questions from that content and cite the source pages. The assistant is embedded on the owner's site via a small widget script. We store the extracted text — not copies of the page files themselves.

2. Data we collect

Account & organization data

• Your name and email, and authentication details, handled by our auth provider Clerk (which may include Google sign-in / OAuth if you choose it).
• Organization details — an organization is the billing unit and can contain multiple users; we store organization name, membership, roles, and plan.
• Usage and billing metadata (chat counts, plan, and — when paid plans launch — payment status).

Connected website content

• The text, titles, and URLs of the pages we crawl for each website you add, used to power and cite answers.

End-visitor chat data

• Conversation transcripts — the messages exchanged between a site's visitors and the chatbot.
• Optional visitor name / email if a visitor provides them, and the page URL the chat happened on.
• A persistent visitor ID stored in the visitor's browser localStorage to recognise a returning visitor across sessions.

3. How we use data

• To provide the service — crawl sites, build the knowledge base, and answer visitor questions.
• To authenticate you, manage your organization, and enforce plan limits.
• To send transactional email (e.g. organization invitations, account notices).
• To operate, secure, debug, and improve the service.

We do not sell your data, and we do not use it for advertising.

4. AI processing & your content

To generate an answer, the relevant retrieved content and the visitor's question are sent to an AI model provider for processing. Depending on the website's configuration, that provider is OpenAI, Anthropic, Google (Gemini), or OpenRouter — using either the owner's own API key (see BYOK below) or SiteBot's platform key. These providers process the content solely to return an answer; see Subprocessors below.

5. Your AI API keys (BYOK)

Owners may add their own AI provider keys ("Bring Your Own Key") for OpenAI, Anthropic, Google Gemini, or OpenRouter. These keys are encrypted at rest with AES-256, and only the last 4 characters are ever displayed back to you. AI usage on your own key is billed to you by that provider.

6. Subprocessors

We use trusted third parties to run SiteBot. Each processes only the data needed for its function:

7. Cookies

We use minimal, essential cookies only — primarily authentication and session cookies set by Clerk so you can stay signed in. We do not use advertising or cross-site tracking cookies. The chat widget uses localStorage (not a cookie) for the visitor ID described above.

8. Data retention

• Chat history is automatically deleted after a retention window — currently 7 days on the launch plan.
• Website content (crawled text) is kept while the website exists in your account and is deleted when you remove the website.
• Account & organization data is kept while your account is active and deleted (or anonymised) after account closure, subject to any legal retention requirements.

9. Security

We protect data with encryption in transit (HTTPS/TLS) and encryption at rest for secrets (such as BYOK keys, AES-256). Access to production systems is restricted and controlled. No system is perfectly secure, but we work to protect your data and will notify affected users of a breach as required by law.

10. Your rights

Depending on your location (including under the EU GDPR and India's Digital Personal Data Protection Act, 2023), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete most data yourself by removing a website or closing your account; for anything else, email hello@sitebot.in and we'll respond within a reasonable period.

11. End-visitor data (for site owners)

12. Children

SiteBot is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children.

13. International transfers

SiteBot is operated from India and uses global providers (see Subprocessors). Your data — and the content sent to AI providers — may be processed in other countries. We rely on the safeguards provided by those providers for such transfers.

14. Changes to this policy

We may update this policy as the product evolves. We'll post the revised version here and update the "Last updated" date above. Material changes may be communicated by email.

15. Contact

Questions or requests? Email hello@sitebot.in. See also our Terms of Service.

This document is a general template provided for convenience and does not constitute legal advice. SiteBot's operator should have it reviewed by a qualified lawyer to ensure it fits the business and complies with applicable laws before relying on it.