Privacy and security
Last updated:
Your chatbot learns from your content and talks with your visitors, so it matters where that data goes. This article explains how Gotachat keeps it isolated, how long it is kept and what you should never load.
Your chatbot answers only from your content
Each chatbot answers only from its own knowledge sources, plus the recent conversation to stay coherent. It does not use outside knowledge, and it never answers from another account's content.
Each chatbot has its own knowledge base, separated from every other customer's. If you have several chatbots, a knowledge source only feeds the chatbots you connect it to.
What never to put in a knowledge source
Anything in a knowledge source can be shown to any visitor of the chatbots it feeds. A visitor can ask for any detail in it, and the chatbot answers from it. Load only what you would publish on your website. Never add:
- passwords or access codes;
- internal prices or margins;
- supplier details;
- personal data of your customers or staff.
Files you upload are stored privately: they are never published on a public address.
Where your data lives and who processes it
- Our servers are in the United States, on Amazon Web Services.
- We use Cloudflare for delivery and protection, Paddle for payments, and Anthropic and Google (Gemini API) for the AI models.
- The AI providers do not train on your data. We use paid terms that do not allow them to use the data to train their models, and we do not use your content or conversations to train any model shared between customers.
- For your visitors' data you are the controller and we are your processor.
- Paddle, our Merchant of Record, handles card details: we never receive or show your full card number.
Your visitors' privacy
The widget stores in the visitor's browser only an anonymous conversation identifier and the widget's state, so the conversation continues across the pages of your site. It uses no advertising cookies. The messages themselves are stored on our side, never in the visitor's browser, and the chatbot's memory of a conversation is kept for 24 hours from the last message.
Every answer is marked "AI-generated answers · may contain mistakes", so visitors always know they are talking with an AI.
A chatbot can also ask visitors to authorize the processing of their data before chatting. Each authorization is recorded with its ID, date, language, site and the exact text accepted, without IP addresses, and visitors can withdraw it from the chat menu (see Set up a chatbot in Help for clients, once signed in).
How long data is kept
| Data | Kept for |
|---|---|
| Account, content and settings | While the account is active, and 30 days after the subscription ends, the trial expires or the account is suspended |
| Closed account (Close my account) | Its content is deleted 7 days after closing |
| Account suspended for abuse | Kept while the case is open; never deleted automatically |
| Chatbot conversation memory | 24 hours from the last message |
| A chatbot's conversations with visitors, and the questions in its Analytics (email addresses and phone numbers hidden in the lists) | 90 days, visible to the customer's administrators |
| Voice dictation recordings | Never stored: only turned into text |
| Live chat messages in the real-time system | 48 hours |
| Live chat transcripts | 12 months in your account |
| Visitor authorizations (chatbots that ask for them) | 24 months, or until the chatbot is deleted |
| Messages left by visitors | As long as your account exists |
| Billing and invoice records | As long as tax law requires (in Colombia, up to 10 years) |
| Security and access logs | Up to 90 days |
| Backups | Overwritten in their normal cycle, at most 35 days |
When an account is left without service (the trial expired, the subscription ended, a failed payment was not resolved or the account was suspended), we email its administrators on day 23 with the deletion date. On day 30 its content is permanently deleted: chatbots, knowledge sources and their files, live chat transcripts and the users of the account. Paying again before that stops the countdown. After deletion we keep only, without personal data, the organization's name, country and website, its plans, payments and packs, and the number of conversations used, for accounting. You can also ask us to delete your account at any time.
The warning and the deletion run by themselves every day. An account suspended for abuse is never deleted automatically while its case is open.
Access to your account
- Each person on your team has their own user. Administrators see everything in the account; advisors only see the chatbots assigned to them and their own live chat transcripts.
- Two-factor authentication is optional and recommended: an authenticator app, a code by email, or recovery codes.
- When you ask for help, our support staff may sign in to your account as one of your team members to see what they see. Every access is recorded.
- Your site key is public by design: it only works on the domains you registered for that chatbot.
Report abuse
Anyone can report a chatbot made with Gotachat that shows illegal content or content our policy does not allow: with the Report link under the AI notice in the chat, on the Report abuse page, or by email to [email protected]. No name is needed, and the email is optional. A person of our team reviews every report.
If our team suspends an account for abuse, its administrators get an email with the reason and how to appeal: reply to it, or write to [email protected], within 30 days. The content is kept while the case is open. Its people can sign in and see the account's page and its support tickets, nothing else; its plan is paused and nothing is charged. If the account does not come back, we cancel the plan and refund the part of the period paid after the day of the suspension, as the Terms of Service say.
Need more help?
Read our privacy policy and terms of service. For privacy questions or requests, write to [email protected], or contact us.