Privacy policy

Who we are

Botseon is operated by Botseon ApS, a Danish company, CVR 46714040, Skansevej 88, 3400 Hillerød, Denmark. Write to us at the address in Contact at the end of this page.

There are two different relationships in this policy, and it matters which one you are reading about:

• We are the controller for your account, your billing records and the security records we keep about sign-ins and administration. We decide what we collect and why, and this policy is our notice to you about it.
• We are the processor for everything your bots read, remember or send on your organisation's behalf. Your organisation decides what that is; we only run it. The Data processing addendum is the contract for that half.

What this website collects

This website, the pages you are reading now, sets no cookies, runs no analytics and loads no trackers. It stores nothing about you in your browser: it follows your device's light or dark setting and has no theme control of its own. Its one script deletes a single storage key that an earlier version of the site used, and writes nothing back. The Cookie statement says the same thing in more detail.

Hosting a website means our host sees the request: your IP address, the page you asked for, your browser's user-agent string and the time. We use that only to serve the page and to keep the site up, and we do not build a profile from it.

What the service collects

The Botseon app, the product you sign into, holds two different things.

Data we are the controller for. Your name and e-mail address, your organisation and your role in it, your plan and your payment records, your usage against your allowance, and a security record of sign-ins and administrative actions.

Data we are the processor for. Everything your bots work on: conversations and their attachments, what a bot remembers, the files on a bot's computer, the messages a bot sends, and the records of each run. This can include personal data about people who never signed up to Botseon, someone your bot e-mails, for instance. Your organisation is the controller for all of it and decides what its bots may read and remember.

Why we are allowed to hold it (legal bases)

For the data we control:

• To provide the service you asked for: your account, your organisation, your bots. This is the performance of our contract with you (Article 6(1)(b) GDPR).
• To take payment and keep our books: our contract with you, and our legal obligation under Danish bookkeeping law (Article 6(1)(b) and (c)).
• To keep the service safe: the sign-in and administration records, abuse prevention, and protecting our systems. This is our legitimate interest in a service that is not abused (Article 6(1)(f)).

For data your bots handle, your organisation chooses the legal basis, not us. If you are not sure which basis covers the people your bots read about and remember, ask us. We hand customers an assessment template for exactly that case.

Where your data is processed

Your account, your content and everything we store are held in the EU. Three parts of the service can reach outside it: a model call, a voice call while the call is running, and a web search a bot runs. Whether a model call or a voice call does is decided by your organisation's residency setting, which starts on EU-only routing. Models and Voice calls below say what that setting allows. A web search sends only the search query, and the Sub-processors page says where each web search provider runs. What the rest looks like, provider by provider:

Several of the companies above are established outside the EU even though the region you get is in the EU. That is a real thing and we are not going to write around it: when a company established outside the EEA can reach data held in the EU, that is a transfer under Chapter V of the GDPR, and it needs a legal instrument. Ours are the European Commission's Standard Contractual Clauses, and for some providers an active EU–US Data Privacy Framework certification alongside them. The Sub-processors page names the instrument for each one.

Our own support staff work from the EU, and support access to a customer's data is from the EU.

Models

A bot's answer is produced by a language model, and the message it is answering is sent to the model provider to produce it. Which provider that is follows your organisation's residency setting, and we would rather state how that works than describe a position we have not reached.

Every organisation starts on EU-only routing. On that setting a model call is made on a route that runs in the EU, or on a route whose provider is bound by the European Commission's Standard Contractual Clauses for the transfer; where neither exists for what was asked, the call is refused, not sent somewhere else. The EU routes we run:

• Google Cloud Vertex AI, EU multi-region. Google's Gemini models, and the search index we build from your text.
• Mistral AI, France. Mistral's own models, the search index we build from your text, and dictation.

The routes outside the EU that EU-only routing allows, because their transfer runs under the Standard Contractual Clauses (since 27 October 2026):

• Image generation. A picture a bot generates, including a bot's generated avatar, is produced by Google's image models on Vertex AI, on Google's global endpoint or in the United States (us-central1). The description you give and the picture come back through Google.
• Music generation. A piece of music a bot generates is produced by Google's music model on Vertex AI, on Google's global endpoint, and is marked as made outside the EU.

An administrator who does not want this can exclude Google, or narrow the organisation's model allowlist, and pictures and music are then refused.

A model call leaves the EU only after the owner of your organisation has moved it off EU-only routing to the setting that allows providers outside the EU. Only the owner can do that, and has to type the organisation's name to confirm it. What becomes possible then:

• An administrator can add your organisation's own key for a model provider outside the EU, such as Anthropic PBC, United States, and calls on that key go to that provider. We hold no key of our own for Anthropic on the hosted service.

An owner can move the organisation back to EU-only routing at any time.

Your data is sent to a model provider to produce the answer and for nothing else. It is not used to train their models. Google's Service Specific Terms state that Google will not use customer data to train or fine-tune AI/ML models without the customer's prior permission or instruction (https://cloud.google.com/terms/service-terms, as published on 2026-09-06). The equivalent commitments from Mistral AI and Anthropic are recorded on the Sub-processors page.

Model providers keep no prompts or outputs. Every model the hosted service uses for chat, voice and the search index runs under a zero-data-retention arrangement with its provider: a contract, or a setting the provider documents. A provider that keeps a copy of a request, even for a short period for abuse monitoring, is not used on the hosted service. That is why Anthropic's Claude models on Google Cloud are not used: Google keeps those prompts and answers for up to 30 days. Each provider's row on the Sub-processors page names the arrangement it runs under. Where your organisation adds its own key for a provider, calls on that key are covered by the zero-retention arrangement on your organisation's own account with that provider.

Voice calls

If a bot takes or makes a call, the audio and the turn-by-turn transcript are handled by a voice provider for as long as the call is running. Which provider follows your organisation's voice setting, which an administrator chooses, and its residency setting. ElevenLabs, United States, grants zero retention only to its Enterprise customers, so it is not used on the hosted service until it does so for us. Speech synthesis runs through Google Cloud, Ireland, on a European endpoint with no logging, under the transfer instrument named for it on the Sub-processors page. Speech to text in a voice call runs through Deepgram, United States, on its EU endpoint, until our speech-to-text provider in the EU is live. Deepgram does not train its models on that audio: every request we send opts out. We have not yet confirmed how long Deepgram keeps audio and transcripts, and we are confirming its retention terms and its data processing agreement with Deepgram now. The Sub-processors page states where that stands.

Everything we keep about the call stays in the same EU database as the rest of your data, under the same separation, the same encryption and the same retention schedule: the call record, the transcript, and the usage records behind your bill.

An administrator has to acknowledge a provider outside the EU before the first call that would use it, and until they do, those calls are refused. An organisation set to EU-only routing gets a provider in the EU or no call.

How long we keep it

Each kind of record has a shortest period we keep it for, a default, and a longest we will ever keep it.

The intention is that an organisation sets its own default between the shortest and the longest. That control is not built yet, so today the defaults above are what applies.

Invoices and accounting records are kept for five years from the end of the financial year they belong to, as Danish bookkeeping law (Bogføringsloven § 12) requires.

Deleting your account is always available, whatever the schedule above says about any one kind of record. When an organisation is deleted, its content is hidden immediately and permanently removed after a 7-day grace period; the key that protects the encrypted part is destroyed at the same point. An individual's erasure request has no grace period at all: once we act on it, the removal is immediate. We answer such a request within one month, the same deadline as every other right in Your rights below. The Data processing addendum explains what erasure does and does not reach.

Who else sees it

The companies we use, what each one does, where, and under what legal instrument, are listed on the Sub-processors page. That page separates two things that are easy to confuse: the providers we have appointed to run the service, and the places a member of your organisation chooses to connect a bot to, such as their own mailbox. The second is your organisation's choice, not ours.

We do not sell your data and we do not share it for advertising.

Push notifications

If you turn on push notifications, the notification itself, the bot's name, its avatar and a short excerpt of the message, travels through Apple's and Google's push services to reach your device. That is how push works on a phone; there is no way to deliver a preview without it. Turn previews off in your device settings if you would rather they did not. Your organisation can also turn previews off for everyone: the notification still arrives and still names the bot, but no longer carries an excerpt of the message. That is not yet something you can switch on yourself in the product; write to us and we will turn it on by hand until it is.

Your rights

You can ask us to give you a copy of your data, to correct it, to move it elsewhere, to delete it, to restrict what we do with it, or to object to processing we base on our legitimate interest.

Get a copy of your own data yourself, free of charge and at any time, from Settings → General → Your data: we e-mail you a link as soon as it is ready, usually within a few minutes. For anything this page does not already give you a self-service path for, write to the address below and we will answer within one month.

You can change most of your account details yourself from Settings → General. The address you sign in with is the one exception: it is not yet something you can change there, because changing it is a sign-in operation and not only a data-protection one. Write to us and we will update it by hand in the meantime.

Delete your own account from Settings → General.

One right needs flagging: restriction is not yet something you can switch on yourself in the product. Write to us and we will handle it by hand until it is.

We do not use your data, or data your bots hold about someone else, to make a decision that has a legal or similarly significant effect on a person without a human being involved: nothing we do falls under Article 22. If your own use of a bot makes such a decision about someone, assessing that is your responsibility as the controller for that content, not ours; we hand you an Annex III deployer-duty assessment template for exactly that case on request (write to privacy@botseon.com), the same way we hand customers a DPIA template (see the Data processing addendum).

If your bots hold data about you and you are not a member of the organisation that runs them, that organisation is the controller and your request goes to them. Tell us and we will pass it on.

You can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, or to the supervisory authority where you live.

Changes to this policy

If we change this policy in a way that matters, we will tell the administrators of every organisation before it takes effect. The date at the top is the version you are reading.

Contact

Botseon ApS, CVR 46714040 Skansevej 88, 3400 Hillerød, Denmark

Privacy questions: privacy@botseon.com

We have not appointed a Data Protection Officer.