Privacy Policy
Last updated:
This policy explains how Gotachat handles personal data. It is also our personal data processing policy (política de tratamiento de datos personales) under Colombian Law 1581 of 2012 and Decree 1074 of 2015.
1. Who is responsible
Drupal Experience (drupalexperience.com), a business registered with the Chamber of Commerce of Bucaramanga, Colombia (commercial registration no. 669026) · Bucaramanga, Santander, Colombia · [email protected] · phone +57 607 654 9002 · WhatsApp +57 333 279 3371. We are the controller (responsable) of the data described in section 3.
For privacy questions and to exercise your rights, write to [email protected]. Drupal Experience's privacy team attends every question and claim about personal data.
2. Two different roles
- Our own data (we are the controller): data about the people who visit our website, write to our own assistants (the one on our website and the support assistant in the panel), sign up, buy a plan or are invited to an account (customers and their Team Members).
- Data about our customers' website visitors (we are the processor): when someone uses a chatbot on a customer's website, that customer decides what is collected and why; we process it on their behalf under our Terms of Service (section 11). If you were a visitor of one of those websites, please read that website's privacy notice and contact them to exercise your rights; if you write to us, we will pass your request to them.
3. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (stored hashed), company, language, optional display name and photo | Create and secure your account; let you sign in | Contract |
| Two-factor authentication settings | Protect your account | Contract; legitimate interest in security |
| Billing details: plan, invoices, country, Paddle customer and subscription IDs. We never receive your full card number — Paddle handles payment | Bill you, apply your plan, keep accounting records | Contract; legal obligation |
| Your chatbot settings and the content you give it to learn from | Provide the Service | Contract |
| Usage: conversations counted, features used, errors | Apply plan limits, support you, improve the Service | Contract; legitimate interest |
| Messages you send us (contact form, support, email) | Answer you | Legitimate interest; contract |
| Abuse reports: the chatbot or site reported, the reason, what you describe and, only if you give it, your email | Review the report, answer you and, when the law requires it, inform the authorities | Legitimate interest; legal obligation |
| What you write to our assistants (the one on our website and the support assistant in the panel) and, if you leave a message for our team or ask to get our reply by email in the chat, your name and email | Answer you and, if you ask, put you in touch with our team | Your authorization, which you give in the chat before writing (website); contract (panel) |
| Record of your authorization in our chat: its ID, date, the exact text you accepted, the language and the website — no IP address and nothing you write | Prove that you gave your authorization and, where applicable, that you withdrew it | Legal obligation |
| Technical data: IP address, browser, device, pages requested, timestamps | Security, abuse prevention, troubleshooting | Legitimate interest |
| Support access records (when our staff signs in to your account to help you) | Accountability and security | Legitimate interest; legal obligation |
| Product and service emails (renewals, limits, security notices) | Run the Service | Contract |
| Marketing emails, only if you opt in | News about Gotachat | Consent (you can withdraw it at any time) |
By signing up, you authorize us to process your data for these purposes. We do not sell personal data, and we do not use it for advertising profiling.
4. How we use AI
Chatbots answer using AI models provided by third parties (section 6). The texts sent to them are the visitor's question, the relevant parts of the customer's content and the recent conversation. We use these providers under paid terms that do not allow them to use the data to train their models, and we do not use customer content or conversations to train any model shared between customers. AI answers have no legal or similarly significant effect on anyone; we do not make automated decisions of that kind.
When a customer's content is indexed, we also review it automatically with the same AI providers, to detect content our Terms of Service prohibit (section 9). Flagged content is not indexed, and a person on our team reviews it; the review never suspends an account on its own.
When a visitor dictates a question with the microphone in a chatbot, the recording is sent to the same AI providers only to turn it into text, which the visitor reviews before sending. The recording is never stored, neither by us nor by the provider beyond processing it.
5. How long we keep data
| Data | Kept for |
|---|---|
| Account, content and settings | While the account is active, and 30 days after the subscription ends, the trial expires or the account is suspended (with an email warning 7 days before deletion). If an administrator closes the account, 7 days after closing it. An account suspended for abuse is kept while its case is open |
| Conversation memory between a visitor and a chatbot | 24 hours from the last message |
| A chatbot's conversations with visitors (what was asked and answered) and the questions in the customer's analytics, with email addresses, phone numbers and long numbers hidden in the analytics | 90 days, visible to the customer's administrators |
| Record of visitors' authorizations (in our chat and in our customers' chatbots) | 24 months from when the authorization was given |
| Live chat messages in the real-time system | 48 hours; the full transcript is kept 12 months in the customer's account |
| Details of counted conversations (chatbot, site, date and number of questions; no text or personal data) | 13 months; after that, only monthly totals |
| Contact requests left by visitors | As long as the customer's account exists, unless the customer deletes them earlier |
| After an account is deleted | A record without personal data: the organization's name, country and website, its plans, payments, top-ups and number of conversations used — for accounting and billing questions |
| Billing and invoice records | As long as tax and accounting law requires (in Colombia, up to 10 years) |
| Security and access logs | Up to 90 days, longer only when needed to investigate an incident |
| Backups | Overwritten in their normal cycle, at most 35 days |
6. Who receives data
We share data only with providers who need it to run the Service, under contracts that protect it:
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, email delivery (Amazon SES) | United States |
| Cloudflare | Content delivery, protection against attacks, bot checks (Turnstile), visit statistics without cookies (Web Analytics) | Global network |
| Paddle.com | Merchant of Record: checkout, payments, taxes, invoices, refunds | United Kingdom / global |
| Microsoft (Microsoft 365) | Our support and privacy mailboxes (the messages you send us) | United States |
| Anthropic | AI models that write chatbot answers | United States |
| Google (Gemini API) | AI models for answers and for searching the knowledge base | United States |
Paddle acts as an independent controller for the payment data it collects; see Paddle's privacy notice. We may also disclose data to our professional advisers (accountants, lawyers) under confidentiality, to authorities when the law requires it, or to a buyer of the business, who would be bound by this policy. We will notify customers 30 days before adding a new provider that processes their visitors' data.
7. International transfers
Our servers are in the United States. When we transfer personal data from Colombia, the EU/EEA, the UK or other countries, we use the safeguards the law requires: for the EU/EEA and UK, the European Commission's Standard Contractual Clauses (and the UK addendum) or the EU–US Data Privacy Framework where the provider is certified; for Colombia, the conditions of Law 1581 and the guidance of the Superintendence of Industry and Commerce (SIC).
8. Your rights
Depending on where you live, you have the right to:
- know, access and get a copy of your data;
- update and correct it;
- delete it, or revoke consent where we rely on it, when there is no legal or contractual duty to keep it;
- object to or restrict certain processing, and port your data to another provider;
- request proof of the authorization you gave, and be told how your data has been used;
- complain to the data protection authority — in Colombia, the Superintendencia de Industria y Comercio (www.sic.gov.co), after first contacting us; in the EU/EEA or UK, your local authority.
How to exercise them: write to [email protected] from the email address on your account (or proving your identity), saying what you need. We answer questions (consultas) within 10 business days and claims (reclamos) within 15 business days, as Colombian law requires, and within one month for requests under the GDPR; if we need more time, we will tell you why. Some of these you can also do yourself in your account (edit your profile, download live chat transcripts). In our chat you can withdraw your authorization at any time with the Authorization button below the header, which also shows its ID and date; with that ID you can ask us for proof of your authorization.
9. Security
We protect data with encryption in transit (HTTPS/TLS), passwords stored as hashes, optional and staff-mandatory two-factor authentication, separation of each chatbot's knowledge base, access limited to the people who need it, records of staff access to customer accounts, and monitoring. No system is completely secure; if a breach affects your data, we will tell you and the authorities as the law requires.
10. Cookies and similar technologies
- Our website and panel use strictly necessary cookies: the session cookie that keeps you signed in, and security cookies set by Cloudflare (including Turnstile, used to stop automated sign-ups). The checkout is provided by Paddle, which sets its own cookies to process the payment and prevent fraud.
- The chatbot on our customers' websites stores in the visitor's browser (local storage) an anonymous conversation identifier and the widget's state, only so the conversation continues across pages, and, when the website asks for the visitor's authorization, its ID and date, so the chat does not ask again. Our own chat does the same. It does not track visitors across other websites.
- Visit statistics: on our site and the panel, Cloudflare Web Analytics counts visits and page views and measures how fast pages load, without cookies, without storing anything in your browser and without following you on other sites. It is never added to the chatbot on our customers' sites.
- We do not use advertising cookies. If we add analytics that require consent, we will ask for it first.
11. Children
The Service is for businesses and professionals and is not directed to children. We do not knowingly collect data from people under 18. Customers must not use a chatbot to collect children's data without meeting the legal requirements that apply to them.
12. Changes to this policy
We will publish any change on this page with its new date and, if the change is material, tell customers by email at least 30 days in advance.
13. Validity
This policy is in force from the date of its last update, shown at the top. Data is processed for as long as needed for the purposes in section 3 and the periods in section 5.