Privacy Policy

01Who we are and what this covers

This Privacy Policy explains how InstantKnowledgeBot (“we”, “us”) collects, uses and protects personal data when you visit our website, create an account, build bots, or chat with a bot that someone has embedded on their website.

• For our website and your account, we decide how your data is used (we are the “controller”).
• For chats on a customer's bot, the business that operates the bot decides how those chats are used, and we process them on its behalf (we act as its “processor”). If you chatted with a bot on someone else's website, that business's privacy notice also applies, and you can contact it directly.

02Information we collect

Account data

When you sign up we collect your name, email address and password. We store the password only as a salted, one-way hash (scrypt) — never in plain text. We also record when you accepted the Terms, your newsletter choice, your plan and limits, and basic signup context: IP address, browser user agent, referring website, campaign (UTM) tags, and — only if you allowed analytics cookies — your analytics visitor id. When you log in we record the time and IP address, and for each signed-in session we keep the IP address, user agent and last-seen time so you can review and revoke sessions.

Signing in with Google, Apple, Microsoft or Facebook. If you choose to continue with one of these providers, we receive only your name, email address, whether the provider has verified that email, and an account identifier for that provider. We use them only to create your account and sign you in. We don't receive your password for that provider, we don't post anything on your behalf, and we don't access your contacts, friends, photos or other data. If you use Apple's "Hide my email", we receive Apple's private relay address instead of your real one.

Uploaded documents and your bots' knowledge base

We store the documents and text you upload, the text extracted from them, and your bot settings (name, greeting, color, starter questions, AI source and model). This content is used to answer questions in your bots. It stays until you remove it, delete the bot, or delete your account.

Chat conversations on embedded bots

When a visitor chats with a bot, we store the conversation so the bot owner can review it: the visitor's messages and the AI's answers, timestamps, a random chat session id, the hostname of the website where the bot is embedded, any thumbs up/down feedback, and whether the bot could answer. We don't ask visitors for their name or email; a conversation only contains that if the visitor types it in. Conversation logs are deleted automatically when the bot owner's plan history window ends: 7 days on Free, 30 on Starter, 90 on Pro and 365 on Agency.

Our own chat assistant on this website

Our public pages may show our own chat assistant (the chat button in the corner). If you use it, we are the controller of that conversation: we store it as described above for up to 365 days and use it to answer your questions, help you and improve our help content, and if you leave your contact details in the chat we use them only to reply to you. The assistant runs on the same hosted AI providers listed below, uses only the essential chat session storage described in the cookie table, and doesn't need analytics cookies.

Activity and usage logs

We keep an activity log for your account (for example: signed up, email verified, logged in, bot created or updated, documents added, key added or removed, limit reached) and usage counters per bot and day (message counts, token counts, feedback counts, and which AI provider and model were used). Activity entries are deleted after 180 days. Aggregate usage counters are kept with your account so we can enforce limits and show your history.

Website analytics

On our public pages (home, signup, login, contact and legal pages) we record page views with our own first-party analytics, without ad networks. For each view we record the page and title, the referring website, UTM campaign tags and ad click ids if present in the link, device type, browser and operating system (derived from the user agent), country if our hosting provider supplies it, and a session id stored in your browser's session storage.

• With analytics consent, we also store a random persistent visitor id in your browser so we can recognize returning visits.
• Without analytics consent, we use an anonymous identifier computed from your IP address, user agent and the date, which changes every day and can't be used to follow you across days. We don't store your IP address with page views.

Page-view records are deleted after 180 days. We don't run analytics inside the dashboard, admin area or embedded chat; the only exception is that, with your consent, the dashboard reports a completed purchase to Google Tag Manager (and, through it, to the ad platforms below if you accepted marketing cookies).

Google Tag Manager, Google Analytics, Google Ads and Meta Pixel

Only if you accept analytics cookies, our public pages also load Google Tag Manager, which we use to run Google Analytics. Google then receives information about your visit (pages viewed, referrer, device and browser details, approximate location derived from your IP address, and an analytics cookie identifier) to produce aggregated usage reports for us.

Only if you accept marketing cookies, Google Ads may also set cookies so we can measure whether one of our ads led to a sign-up or a purchase (conversion measurement). When you sign up or buy a plan, we tell Google Tag Manager that it happened, along with the plan and price for purchases; we don't send your name or email address. We use Google Consent Mode: advertising storage and ad user data follow your marketing choice, and Google ad personalization is always off. If you reject both analytics and marketing cookies, Google Tag Manager isn't loaded at all.

Also only if you accept marketing cookies, Google Tag Manager loads the Meta Pixel from Meta Platforms (Facebook and Instagram). Meta then receives the pages you view on our public site, that a sign-up or purchase happened (with the plan and price for purchases), device and browser details, your IP address, Meta's cookie identifiers (_fbp, _fbc) and the Facebook click id (fbclid) if you arrived from one of our ads. We don't send your name or email address. Meta uses this to measure which of our ads led to sign-ups and purchases and to help show our ads to people likely to be interested, and may combine it with other information it holds about you under its own policies. Learn more in Meta's Privacy Policy; you can also manage ad preferences in your Facebook or Instagram settings. Turning marketing cookies off in Cookie settings stops the Meta Pixel from loading on later page views.

You can change your choice at any time with Cookie settings. Learn more in Google's Privacy Policy and at how Google uses information from sites that use its services.

Newsletter

If you opt in at signup (the box is pre-ticked and you can untick it), in the website footer, or on the contact form, we store your email, name if given, where you subscribed, when you consented and the IP address used. Every email includes an unsubscribe link. You can also turn the newsletter off in your dashboard settings. After you unsubscribe we keep a record of that so we don't email you again.

Contact form messages

When you contact us we store your name, email, subject and message, along with your IP address and user agent (to fight spam), and your account id if you're signed in. We email you a confirmation of your message.

AI provider keys

If you connect your own AI provider key, we store it encrypted (AES-256-GCM) together with its last four characters, status and available models. The full key is never shown again, logged, or sent anywhere except to the matching provider.

Verification codes and security data

We send one-time 6-digit codes to verify email addresses, reset passwords and confirm admin sign-ins. We store only a hash of each code, which expires after 10 minutes. We also use IP addresses for rate limiting and abuse prevention.

03How we use information

• Provide the Service — run your account, build and serve your bots, show conversations, analytics and usage in your dashboard.
• Security and abuse prevention — authenticate you, rate-limit requests, detect spam and abuse, and enforce usage limits.
• Communicate with you — verification and password-reset codes, important service and policy notices, replies to your messages, and the newsletter if you opted in.
• Improve the Service — understand which pages and features help people, using the analytics described above.
• Legal compliance — meet legal obligations and respond to lawful requests.

We don't sell your personal data for money. Only with marketing consent, Google and Meta measure which of our ads led to sign-ups and purchases, and Meta may use that information to help show our ads to people likely to be interested (see above).

Legal bases (EEA/UK)

We rely on: contract (to provide your account and bots); legitimate interests (security, abuse prevention, essential first-party measurement without persistent ids, and improving the Service); consent (analytics visitor id, ad measurement with Google and Meta, newsletter — you can withdraw it at any time); and legal obligation where applicable.

04AI processing and service providers

We share personal data only with service providers that help us run the Service, under contracts that limit how they can use it. The hosted AI providers listed below always reflect the providers we currently use; this list and the “Last updated” date change automatically when we switch providers.

We may also disclose information if required by law, to protect the rights, safety and security of our users or the public, or as part of a merger, acquisition or sale of assets (with notice to you).

05Cookies and local storage

We use a small number of cookies and browser storage items, almost all of them our own; Google Analytics cookies are set only if you accept analytics, and Google Ads and Meta cookies only if you accept marketing. Advertising cookies let Google and Meta measure which of our ads work and help those platforms show our ads to people likely to be interested. You can change your choice at any time with Cookie settings.

06Security

• All traffic is encrypted with HTTPS.
• Passwords are stored only as salted scrypt hashes; one-time codes and session tokens are stored only as hashes.
• AI provider API keys are encrypted at rest with AES-256-GCM and never returned to any browser.
• Session cookies are HttpOnly, and pages use a strict Content Security Policy.
• Access to production data is restricted, and admin sign-in requires an emailed one-time code.

No system is perfectly secure. If we learn of a breach that affects your personal data, we'll notify you and the authorities as required by applicable law.

07Retention

When you delete your account we delete your profile, bots, knowledge bases, conversations, keys, sessions, usage and activity, and mark your newsletter subscription as unsubscribed.

08Your rights and choices

Depending on where you live — including under the EU GDPR, the UK GDPR and the California Consumer Privacy Act (CCPA/CPRA) — you may have the right to:

• access your personal data and receive a copy in a portable format;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing, and withdraw consent at any time (this doesn't affect processing before withdrawal);
• know what categories of personal information we collect and how we use and disclose them (California), and not be discriminated against for exercising your rights;
• complain to your local data protection authority.

Do it yourself: in your dashboard Settings you can download a full export of your data (profile, bots, conversations and activity), change your name and newsletter preference, review and revoke sessions, and permanently delete your account. You can also contact us at the details below and we'll respond within the time required by law (usually within one month). We may need to verify your identity first.

How to delete your data

This applies however you signed up, including with Google, Apple, Microsoft or Facebook:

1. Log in and open Dashboard → Settings.
2. Scroll to Delete account and confirm. Your account, bots, uploaded documents, conversations, sessions and connected sign-in methods are permanently deleted right away.
3. Can't log in? Email support@instantknowledgebot.com from your account's email address and ask us to delete your data. We'll confirm when it's done, usually within 7 days.

You can also disconnect a sign-in provider at any time: in Settings → Connected sign-in methods, or from the provider itself (for Facebook: Settings & privacy → Settings → Apps and websites). Disconnecting a provider stops it from signing you in, but doesn't delete your InstantKnowledgeBot account; use the steps above for that.

We don't sell personal information for money. If you accept marketing cookies, letting Google and Meta measure our ads and help show them to people likely to be interested may count as “sharing” personal information for cross-context behavioral advertising (or a “sale”) under California and other US state privacy laws. You can opt out at any time by turning marketing cookies off in Cookie settings, or by choosing “Reject non-essential” on the cookie banner; this applies to the browser you use. We don't knowingly sell or share the personal information of anyone under 16.

Chat visitors: if your request concerns a conversation with a business's bot, please contact that business first. We'll help them respond, and you can also reach us directly.

09International transfers

Our service providers may process data in the United States and other countries whose data protection laws differ from yours. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) or an adequacy decision.

10Children

The Service is not intended for children. You must be at least 16 to create an account, and we don't knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we'll delete it. Businesses that embed bots on sites directed at children are responsible for meeting the laws that apply to them.

11Changes to this policy

We may update this policy as the Service changes. The “Last updated” date at the top shows the latest version. If we make material changes, we'll notify you by email or in your dashboard before they take effect.

12Contact us

For privacy questions or to exercise your rights, reach us here: