Privacy Policy

This Privacy Policy explains how Bots And Flows ("Bots And Flows", "we", "us" or "our") collects, uses, discloses and safeguards personal information. It applies to our website at botsandflows.com, to enquiries and bookings made with us, to purchases made through our online store, and to the AI chatbots, voice agents and custom automation systems we design, build and operate for our clients.

We have written this document to be read, not merely accepted. If anything here is unclear, please contact us using the details in the final section and we will explain it in plain terms.

Overview and Scope

This Policy covers personal information we handle in two distinct roles, and the difference matters because it determines who decides what happens to the data.

• As a controller. When we decide why and how personal information is processed, for example information about visitors to our website, prospective clients who contact us, and customers who purchase from us. This Policy governs that processing in full.
• As a processor or service provider. When we build, host or operate an AI system for a client, that client determines the purposes of the processing and we act on their documented instructions. In that case, the client's own privacy notice governs the relationship with the individuals concerned, and our obligations are set out in the written agreement between us and that client.

This Policy does not apply to third-party websites, platforms or applications that we do not control, even where we link to them or integrate with them on a client's behalf.

Who We Are

Bots And Flows is an artificial intelligence and automation studio. We build conversational AI chatbots, AI voice agents and bespoke AI agents that carry out defined business processes for organisations across a range of industries.

For any question about this Policy or about how we handle personal information, our contact details are set out in the How to Contact Us section below. We are the point of contact for privacy matters and we will direct your request to the right person internally.

Information We Collect

Information you give us directly

We collect information you choose to provide, including when you complete a form, request a proposal, book a call, subscribe to updates, make a purchase, or correspond with us by email, telephone or messaging applications such as WhatsApp. This typically includes:

• Identity and contact details such as your name, business name, job title, email address, telephone number and country.
• Enquiry content such as the description of your project, your objectives, timelines, budget range and any documents or materials you send us.
• Transaction details such as the products or services ordered, billing and delivery information, invoice records and correspondence about your order.
• Account credentials where you create an account on our store, including your username and a securely hashed password.
• Recruitment information if you apply to work with us, including your curriculum vitae and employment history.

Information collected automatically

When you visit our website, certain information is recorded automatically by our servers and by the technologies described in the Cookies and Similar Technologies section:

• Device and connection data including IP address, browser type and version, operating system, device type, screen characteristics, language preference and time zone.
• Usage data including the pages you view, the links you select, referring and exit pages, search terms used to reach us, and the dates, times and duration of your visits.
• Server logs and security data including requests made, error events and information generated by security and firewall systems that protect the site against abuse.

Information from third parties

We may receive information about you from sources other than you, including payment processors who confirm the outcome of a transaction, analytics and advertising platforms, hosting and security providers, publicly available professional sources such as company websites and business networking platforms, and referrals from existing clients or partners.

Sensitive information

We do not seek to collect special categories of personal information, such as data revealing health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning sexual orientation. Please do not submit such information to us unless we have specifically asked for it and explained why it is needed. Where a client's AI system necessarily processes such information, that processing is governed by our written agreement with the client and by appropriate additional safeguards.

How We Use Information

We use personal information only for purposes that are compatible with the reason it was collected. Specifically, we use it to:

• Respond to your enquiries, prepare proposals and quotations, and arrange discovery or consultation calls.
• Deliver the services we have agreed to provide, including designing, building, testing, deploying, hosting, supporting and maintaining AI systems.
• Process orders, take payment, issue invoices and receipts, and administer refunds, credits and chargebacks.
• Manage accounts, authenticate users and provide customer support.
• Operate, secure, monitor and improve our website and our products, including diagnosing faults, investigating incidents and preventing fraud and abuse.
• Measure and analyse how our website is used so that we can improve its content, structure and performance.
• Send service messages relating to a project, an order or a change to our terms, which are necessary and not promotional.
• Send marketing communications about our services where you have asked to receive them or where we are otherwise permitted to do so, always with the ability to opt out.
• Comply with legal, tax, accounting and regulatory obligations, and establish, exercise or defend legal claims.

Legal Bases for Processing

Where data protection law requires us to identify a legal basis for processing, such as under the European Union General Data Protection Regulation and the United Kingdom GDPR, we rely on the following:

AI Systems and Automated Processing

Because artificial intelligence is central to what we build, we set out our approach to it explicitly rather than leaving it to inference.

How AI systems handle information

The chatbots, voice agents and automation systems we build process the inputs given to them in order to produce a response or carry out a task. Depending on the design agreed with the client, this may involve transmitting content to third-party model providers, speech-to-text and text-to-speech services, or other integrated platforms. The specific providers used in any given system are documented for the client that commissions it.

Training and model improvement

• We do not use client data, or the conversations handled by a client's AI system, to train publicly available or general-purpose AI models for our own benefit.
• Where a model is fine-tuned or customised for a client, that work is carried out for that client alone and the resulting configuration is not reused for other clients without written permission.
• Where we rely on third-party model providers, we seek arrangements under which submitted content is not used to train their general models, and we configure available controls accordingly.

Conversation records

Conversations with a chatbot or voice agent may be recorded, transcribed and retained so that the system can be supported, audited, evaluated for quality and improved. Where a voice agent records a call, the applicable notice and any consent required by law are the responsibility of the party operating the service, and we build the necessary notification steps into the system where a client asks us to.

Automated decision-making

We do not use personal information to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, without a lawful basis and appropriate safeguards. Where a client's system is designed to support such decisions, we build in human review and, where required, the ability to contest the outcome.

Client Data We Process on Your Behalf

When we act as a processor or service provider for a client, we undertake to:

• Process personal information only on the client's documented instructions and for the agreed purposes.
• Impose confidentiality obligations on personnel with access to the data.
• Apply appropriate technical and organisational security measures.
• Engage sub-processors only under written terms that impose equivalent obligations, and inform the client of intended changes.
• Assist the client, so far as reasonably practicable, with responding to individuals exercising their rights and with security, breach notification and impact assessment obligations.
• Delete or return personal information at the end of the engagement, subject to any retention required by law.

If you believe an organisation is using an AI system built by us and you wish to exercise your rights over your data, please contact that organisation directly. If you contact us instead, we will pass your request to the relevant client and confirm that we have done so.

Cookies and Similar Technologies

Cookies are small text files stored on your device. We and our providers also use related technologies such as pixels, tags, software development kits and local storage. We use them for the following purposes:

Most browsers let you view, delete and block cookies through their settings. Blocking strictly necessary cookies will affect how the website works, including the store and checkout. Where required by law, we ask for your consent before setting non-essential cookies and you may change your choice at any time.

How We Share Information

We do not sell personal information. We share it only in the circumstances described here, and only to the extent necessary:

• Service providers. Hosting, infrastructure, security, email delivery, customer support, analytics, scheduling, accounting and similar providers who process information on our behalf under contract.
• Payment processors. Card and wallet payments are handled by third-party processors, including Stripe and PayPal. Full card details are submitted directly to the processor and are not stored on our systems. Their handling of your data is governed by their own privacy notices.
• AI and communications platforms. Model providers, telephony, messaging and transcription services necessary to operate the systems we build, as documented with the relevant client.
• Professional advisers. Lawyers, accountants, auditors and insurers where reasonably required.
• Corporate transactions. A prospective buyer or investor in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality, and any successor entity following completion.
• Legal and safety. Courts, regulators, law enforcement or other authorities where we are legally required to disclose, or where disclosure is necessary to protect our rights, property or safety, or those of our clients or the public.
• With your direction. Any other party where you ask us to share information or clearly authorise us to do so.

International Data Transfers

We work with clients and providers in multiple countries, and personal information may therefore be transferred to, stored in, or accessed from a country other than the one in which you are located. The laws of those countries may differ from those of your own.

Where we transfer personal information across borders, we take steps to ensure it remains protected to an appropriate standard, which may include transferring to a country recognised as providing adequate protection, entering into standard contractual clauses or equivalent approved terms, and applying additional technical and contractual safeguards. You may request further information about the mechanism applied to a particular transfer by contacting us.

Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, tax, accounting or reporting requirements, and to resolve disputes or enforce agreements. In practice this means:

• Enquiries that do not proceed are generally retained for a limited period so we can respond to follow-up contact, and then deleted or anonymised.
• Client and project records are retained for the duration of the engagement and for a reasonable period afterwards to support the system, honour warranties and meet record-keeping obligations.
• Transaction and financial records are retained for the period required by applicable tax and accounting law.
• Marketing contact details are retained until you opt out, after which we keep a minimal suppression record so that we can honour your choice.
• Website logs and analytics are retained for a short operational period, other than aggregate statistics which do not identify you.

Data we process on behalf of a client is retained according to that client's instructions and our agreement with them. When information is no longer needed, we delete it or irreversibly anonymise it.

How We Protect Information

We maintain technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encryption of data in transit, access controls and the principle of least privilege, authentication requirements for administrative access, network and application firewalls, monitoring and logging, secure development practices, vendor due diligence, and staff confidentiality obligations.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping any account credentials confidential and for notifying us promptly if you believe an account has been compromised. Where a personal data breach occurs and the law requires notification, we will inform the relevant supervisory authority and affected individuals within the applicable timeframes.

Your Privacy Rights

Subject to the law that applies to you, you may have the right to:

Access

Obtain confirmation of whether we process information about you and receive a copy of it.

Correction

Have inaccurate information corrected and incomplete information completed.

Deletion

Ask us to erase information where there is no continuing lawful basis to retain it.

Restriction

Ask us to limit our processing in defined circumstances, for example while accuracy is being verified.

Portability

Receive certain information in a structured, commonly used, machine-readable format, or ask us to transmit it to another organisation where technically feasible.

Objection

Object to processing based on legitimate interests, and object at any time to processing for direct marketing.

Withdraw consent

Withdraw any consent you have given, without affecting the lawfulness of processing carried out beforehand.

Complain

Lodge a complaint with the data protection authority in your country or region.

To exercise a right, contact us using the details below. We will verify your identity before acting, which may require additional information, and we will respond within the period required by applicable law. We do not charge a fee unless a request is manifestly unfounded or excessive, and we will tell you in advance if that applies. If we cannot act on a request, we will explain why.

Rights Under European and UK Data Protection Law

If you are located in the European Economic Area, the United Kingdom or Switzerland, the rights listed above apply to you under the GDPR and equivalent legislation, together with the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, except where permitted with appropriate safeguards.

You have the right to lodge a complaint with your local supervisory authority. We would appreciate the opportunity to address your concerns before you approach the authority, but you are entitled to contact it at any time.

Rights Under United States State Privacy Laws

If you are a resident of California or of another United States state with comprehensive privacy legislation, you may have the right to know what personal information is collected, used, disclosed and shared; to request deletion; to request correction; to opt out of the sale or sharing of personal information and of targeted advertising; to limit the use and disclosure of sensitive personal information; and to obtain a copy of your information.

We do not sell personal information and we do not share it for cross-context behavioural advertising for payment. You will not be discriminated against for exercising any privacy right, and we will not deny services, charge different prices or provide a different level of quality because you made a request. You may use an authorised agent to submit a request on your behalf, provided the agent supplies proof of authorisation and we can verify your identity.

Marketing Communications

Where we send marketing messages, every message includes a simple way to unsubscribe, and you may also opt out by contacting us directly. We will action opt-out requests promptly. Please note that we may still send you non-promotional service messages that relate to an active project, an order or a change to our legal terms, as these are necessary to the service.

Children's Privacy

Our website, products and services are directed to businesses and to adults. We do not knowingly collect personal information from children, and our services are not intended for use by them. If you believe that a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

Third-Party Websites and Services

Our website may link to third-party sites, and our services may integrate with third-party platforms. We do not control those parties and are not responsible for their content or their privacy practices. We encourage you to read the privacy notice of any third party before providing information to it.

Changes to This Policy

We may update this Policy from time to time to reflect changes to our practices, our services, or legal and regulatory requirements. The revision date shown at the top of this page indicates when it was last changed. Where a change is material, we will provide a more prominent notice, which may include notifying you by email or by a notice on our website. Your continued use of our website or services after an update takes effect constitutes acceptance of the revised Policy.

How to Contact Us

If you have a question, a concern or a request relating to this Privacy Policy or to how we handle personal information, please contact us. We aim to acknowledge every privacy enquiry promptly and to resolve it fully.

• Email: info@botsandflows.com
• Telephone: +61 429 202 376
• Website: botsandflows.com/contact

If you are dissatisfied with our response, you may escalate the matter to the data protection or privacy authority with jurisdiction over your location.