Privacy you can
actually read.
We write GDPR documents for a living, so ours should be the easiest you’ve read. Every policy, your rights, and how to use them — in one place.
- No cookies, analytics or trackers on our website
- We never sell personal data
- Your data never trains AI models
- Every rights request answered within one month
Everything, in one place
Privacy Policy
What we collect when you visit, write to us or hire us — why, on what legal basis, who sees it and for how long.
Read the policy For visitors · ePrivacyCookie Policy
Why there’s no cookie banner: the site sets no cookies, and the chat stores only a session ID and a copy of your conversation, and only when you open it.
Read the policy For clients & visitorsTerms & Conditions
Quotes, payments, AI use, ownership of what we build, liability and the rules for using this website.
Read the terms For clients · Art. 28 GDPRData Processing Agreement
Our commitments when we process your customers’ data inside the chatbots, workflows and websites we build for you.
Read the DPA For clients · Art. 32 GDPRSecurity measures
The technical and organisational measures that protect client data — access, encryption, AI guardrails and incident response.
See the measures For clients · Art. 28(2) GDPRSub-processors
The providers we rely on to deliver client projects, where they process data and how transfers are safeguarded.
See the listWhat you can ask us for
These rights come from the GDPR and Moldovan Law No. 195/2024. Using them is free, and you don’t need to explain why.
Access
Find out whether we hold your data and get a copy of it, with what we use it for.
Rectification
Have anything inaccurate corrected, or incomplete data completed.
Erasure
Have your data deleted when we no longer need it or have no legal basis to keep it.
Restriction
Pause how we use your data while a question about it is being resolved.
Portability
Receive the data you gave us in a machine-readable format, or have it sent elsewhere.
Objection
Object to processing based on our legitimate interests — and to direct marketing at any time.
Human decisions
Not be subject to significant decisions made solely by automated means, including AI.
Complaint
Complain to a data protection authority at any time — you don’t need to ask us first.
Three steps, one month at most
Send us your request
Email hello@botbridge.org with the subject “Data protection request”. The template on this page covers everything we need.
We confirm and verify
We confirm receipt. If we can’t be sure the request comes from you, we ask for the minimum needed to verify it — never more.
We act and reply
We complete the request and tell you what we did. For complex requests we may need up to two more months, and we’ll tell you why within the first month.
If you’re a customer of one of our clients — for example you used a chatbot we built for them — that business controls your data. Contact them first; we’ll help them answer.
Request template
Copy it, fill in the brackets, delete the rights you don’t need.
Subject: Data protection request Hello BotBridge, I am writing to exercise my rights under the GDPR / Law No. 195/2024. My name: [full name] Email or phone you may know me by: [contact details] My relationship with BotBridge: [e.g. I sent an enquiry in March 2026 / I work for a client] I request: [ ] access to my personal data and a copy of it (Art. 15) [ ] correction of: [what is wrong and what it should be] (Art. 16) [ ] erasure of my personal data (Art. 17) [ ] restriction of processing (Art. 18) [ ] a copy of my data in a machine-readable format (Art. 20) [ ] to object to the processing of my data for: [purpose] (Art. 21) Please reply to: [email address] Thank you, [name] [date]
If you’re not satisfied
You can complain to the data protection authority where you live, work or where you think the infringement happened.
Living elsewhere in the EU? Find your authority on the European Data Protection Board’s list.
How we use AI responsibly
Yes. Every chatbot we build tells users they are talking to an AI system, as Art. 50(1) of the EU AI Act (Regulation (EU) 2024/1689) has required since 2 August 2026. Where the client wants it, the chatbot also offers a route to a person.
No. We don’t train models on client or end-user data, and we only use AI providers whose business terms exclude training on customer data. Where a provider offers reduced or zero data retention, we switch it on.
Not on its own when it matters. We don’t build solutions that take decisions with legal or similarly significant effects on people without human review (Art. 22 GDPR), and we don’t build high-risk AI systems under the AI Act unless agreed separately in writing.
Guardrails: the chatbot answers only from the client’s approved knowledge base, has explicit limits on topics and commitments, and is tested by the client’s team on real cases before launch. AI can still make mistakes, which is why important answers stay under human oversight.
The rules we work to
| Regulation | What it covers |
|---|---|
| Regulation (EU) 2016/679 — GDPR | Processing of personal data of people in the EU, including by businesses outside the EU that offer them services |
| Romanian Law No. 190/2018 | National measures implementing the GDPR in Romania |
| Moldovan Law No. 195/2024 | Personal data protection in the Republic of Moldova, aligned with the GDPR, in force since 23 August 2026 |
| Directive 2002/58/EC and Romanian Law No. 506/2004 | Cookies, device storage and electronic marketing |
| Regulation (EU) 2024/1689 — AI Act | Transparency for chatbots and AI-generated content; prohibited and high-risk AI practices |
| Directive 2011/83/EU and Directive (EU) 2019/770 | Consumer rights for distance contracts and digital services |
Versions
We review every document at least once a year. Material changes are announced to clients 30 days before they take effect.
| Document | Version | In effect since |
|---|---|---|
| Privacy Policy | 1.2 | 21 September 2026 |
| Cookie Policy | 1.2 | 21 September 2026 |
| Terms & Conditions | 1.1 | 17 September 2026 |
| Data Processing Agreement | 1.1 | 17 September 2026 |