Privacy Policy
Last updated 16 September 2026
This describes what the operator of QuickAssistBot does with personal data in QuickAssistBot. It is written to match what the software actually does.
Two different roles
There are two kinds of people in this system, and we treat their data differently.
- You, the customer. We are the controller of your account data.
- Visitors to your clients' websites. You decide what their chatbot asks and what happens to the answers, so you are the controller and we are your processor. We handle their data on your instructions and for no purpose of our own — we do not use it to train models or to market to anybody.
That means it is your job to tell visitors that a chat widget on your client's site collects what they type, and to have a lawful basis for it.
What we hold
| Data | Why | How long |
|---|---|---|
| Your name, email, hashed password | To run your account and sign you in | Until you close the account |
| Bot settings, and the page content we index from sites you point us at | So the bot can answer | Until you delete the bot or account |
| Visitor messages and the bot's replies | So the conversation works, and so you can read what was asked | Until you delete the bot or account |
| Contact details a visitor submits — name, email, phone, message | To pass the enquiry to you and your client | Until you delete the bot or account |
| IP addresses of chat and sign-in requests | Rate limiting only — to stop abuse and runaway cost | Rolling window, deleted automatically (an hour for chat, 15 minutes for sign-in) |
| Monthly counts of replies and pages | To apply your plan's limits | Kept as a usage history until you close the account |
| Subscription status and a record of billing webhooks | To know what you are entitled to, and to resolve disputes | Until you close the account |
We never see or store your card details — Lemon Squeezy handles payment entirely.
Who else processes it
- The AI provider you select (Anthropic, OpenAI or Google) — receives the visitor's question and the relevant indexed content in order to generate a reply.
- Resend — delivers lead alerts and account email.
- Lemon Squeezy — merchant of record for payments.
- Cloudflare R2 — encrypted offsite backups of the database.
- Our hosting provider — runs the servers the Service sits on.
Any webhook URL you configure sends lead data to a destination you chose; what happens there is between you and that provider.
Where it is processed
[Name the countries your host, your AI provider and your backups are in, and the transfer mechanism you rely on.]
What you can do
- Get a copy. Account → Download everything exports your whole account as a JSON file, immediately: bots, indexed content, conversations, leads and usage.
- Delete it. Account → Close this account permanently deletes your bots, their knowledge, conversations, leads and sub-accounts. It cannot be undone.
- Correct it. Account details are editable in the dashboard; write to us for anything you cannot reach.
- Object or complain. Write to us, and to your local data protection authority if we have not put it right.
Deleted data disappears from the running service immediately. Encrypted backups are kept for 30 days and then expire, so a copy may persist in them for that long — backups are only ever used to recover the service, never to restore a deleted account.
Security
Traffic is served over HTTPS. Passwords are stored as salted hashes, never in a readable form, and changing one signs out every other session. Billing webhooks are rejected unless they carry a valid signature. Each account can only reach its own data, which is enforced in one place in the code and tested on every route.
No system is perfectly secure. If we discover a breach affecting your data we will tell you and, where required, the relevant authority.
Cookies
One cookie, to keep you signed in. It is marked SameSite=Lax and expires after
30 days. There is no analytics, advertising or third-party tracking on this service, so there
is nothing to consent to. The chat widget itself sets no cookie on your clients' websites; it
keeps a random session id in the browser's own storage so a conversation survives a page
refresh.
Children
QuickAssistBot is a business tool and is not directed at children. We do not knowingly collect their data. If a bot you run is likely to be used by children, that is your responsibility to handle under Acceptable use.
Changes
We will post updates here and email account holders about material ones.