Privacy Policy

OptoBot is built and operated by Optomatica LLC — you can read more about the company at optomatica.com.

• Website: https://optobot.ai (this site)
• Product app: https://web.optobot.ai
• Contact for anything privacy-related: [email protected]

This policy explains what information Optomatica collects and how it is handled in three situations:

1. You browse this website — including what our analytics tool sees.
2. You chat with the OptoBot widget — on this site (the demo widget) or on a business that uses OptoBot on its own website.
3. You message a business on WhatsApp — when that business answers with OptoBot.

Who decides how data is used depends on the situation. For this website and for Optomatica's own business records, Optomatica decides. When you chat with a business that uses OptoBot, that business decides how it uses the conversation — Optomatica provides the tooling and handles conversations on the business's instructions. In data-protection terms, the business is the controller of its conversations and Optomatica is the processor. This policy explains Optomatica's side of the handling.

That division carries responsibilities: a business using OptoBot is responsible for its own privacy notice and for its lawful basis and consent choices for the conversations it handles with OptoBot.

Chat conversations. When you send a message to an OptoBot widget, we collect the message, the assistant's answer, and the resulting conversation transcript. On WhatsApp, we collect the messages you send to the business's number and the replies.

Details you choose to give. If you ask to be contacted — or a business is offline but you want a follow-up — the assistant may ask for contact details one field at a time: name, email, phone number, company, and your message. Giving them is your choice; you can skip, and which fields appear is configured by the business. Every lead is linked to the conversation it came from.

Business account information. If you sign your business up for OptoBot, we collect your account and organization details, your project settings, and billing information. Payments are processed by Stripe (card payments in USD) and Paymob (payments in Egyptian pounds); card details are handled by those providers. API keys created in the dashboard are stored only as hashes and are shown exactly once.

Website usage data. This website uses Google Analytics — see section 8.

We do not collect anything through this website's forms or pop-ups: this site has no contact form. Contact happens by email, so what you email us is what we receive.

OptoBot answers from the business's own content — documents and website pages the business added and verified — and links the source under every answer. To produce that answer, the AI model provider the business selected for its project (OpenAI, Mistral, or Gemini) receives three things: your message, the recent earlier messages of the same conversation, and the business's own materials — its company profile and the content retrieved as relevant to your question. Nothing else about you or your device is transmitted: no session identifier, no IP address, no browser details.

Producing a single answer can involve a few calls to that same provider — for example, to match your question against the business's content, or to check a draft answer before it is shown. Those steps use the same materials described above.

Conversations are long-lived by design: a returning visitor picks up where they left off, so recent context is kept with the conversation.

Conversations are stored in OptoBot's own database — Postgres — with PII redaction applied before they are stored:

• Email addresses, phone numbers, national ID numbers, and card numbers typed into a chat are masked before they are stored, not after. The redaction works on these patterns; it does not try to identify names or other details in free text.
• Contact details you deliberately submit through lead capture — name, email, phone, company, and your message — are not masked: they are stored as you gave them so the business can reach you.
• This redaction is a platform default on every tier — it is always on; nobody switches it off.
• The same masking is applied when a conversation transcript is written to a business's CRM.

Redaction applies to what is stored, not to what the model sees: as described in section 4, the AI model receives your original message so it can answer — the stored copy is the masked one.

Two boundaries we state plainly: the public widget never exposes staff identities, IP addresses, device fingerprints, or the business's raw source documents; and we do not publish a hosting-region commitment today — in-region hosting is a roadmap item, not a shipped feature.

Retention is a built-in platform policy, not a setting businesses configure:

• Data belonging to dormant free-tier projects is anonymized or deleted by a daily purge job after 5 years of inactivity.
• Active projects and paying organizations are not purged.
• If a paying organization cancels, it reverts to free-tier treatment: its projects are anonymized or deleted only after the same 5 years of complete inactivity, and any activity along the way resets that clock. There is no separate grace period.

When a business connects its own WhatsApp number to OptoBot, the messaging itself runs on WhatsApp, operated by Meta. Messages you send to the business's number pass through Meta's WhatsApp infrastructure under Meta's own terms, and the business's number must pass Meta's own business-verification steps before going live. Optomatica receives those messages through Meta webhooks, which are signature-verified; the connection's credentials are encrypted at rest; and redelivered messages are deduplicated so you never get a double answer.

Today OptoBot answers text messages on WhatsApp. If you send a voice note, image, or document, the assistant politely asks you to type your question — media handling is not shipped.

This website uses Google Analytics on every page to understand how the site is used. Google Analytics is the only thing on this site that sets cookies. It receives information about your visit — pages viewed, the site that referred you, general browser and device information, and approximate location derived from your IP address.

This site does not show a cookie consent banner. You can control or delete cookies through your browser settings, and block Google Analytics specifically with Google's own opt-out tools.

We don't sell personal information. Information is shared only in these ways:

• With the business you're chatting with. The business sees its conversations and transcripts in its inbox — including during human handoff, when a staff member takes over the thread.
• With AI model providers (OpenAI, Mistral, or Gemini — the business's choice) to generate answers, as described in section 4.
• With an OCR service (Z.AI GLM-OCR): scanned documents that a business uploads may be read by this service to extract their text (paid plans only). It handles business documents only — visitor chat messages never go through it.
• To the business's own CRM, if the business connected Zoho CRM (a paid-plan feature). The business controls this: transcript write-back to the CRM can be switched off per organization.
• To the business's own integrations, if it uses the OptoBot API or webhooks. Those integrations run on the business's own keys, so the business is responsible for that data.
• By email, at the moments described: when a staff member replies to you after handoff, the reply is emailed to the address you gave, with a link back to the conversation; when a business is offline, its team receives a digest of overnight activity.
• With payment processors Stripe and Paymob, for business customers' billing.
• With Google, via Google Analytics, for this website's traffic data — see section 8.

In plain terms — PII redaction, automatic retention, and audit logging are built in (retention is an automatic platform policy on every tier; the audit log surfaces from the BUSINESS tier):

• PII in chats is masked before storage (section 5).
• Secrets and connection credentials (WhatsApp credentials, CRM tokens, webhook signing secrets) are encrypted at rest; API keys are stored hashed.
• Access is role-scoped: staff with inbox access (view, claim, reply) hold exactly those powers and no project or admin access.
• Accounts can protect themselves with opt-in two-factor authentication.
• Every escalation, claim, and release in the handoff flow is recorded in an audit trail.
• A business's website content is crawled only after the business proves it controls the domain.

We make no third-party certification or audit claims of any kind — this list describes the mechanisms that ship, nothing more.

Depending on applicable law, you may have the right to ask what information we keep about you and receive a copy, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you have given — without affecting processing that was already carried out. You may also complain to a privacy regulator. Legal exceptions may apply.

• You can skip any request for contact details in a chat. Details are asked only when a follow-up makes sense — for example, when the team is offline — never in the middle of a live conversation with staff.
• For a conversation with a business, contact that business first. It is the primary handler of its own conversations, and we support it in responding to your requests as required by applicable law.
• For everything Optomatica controls directly — this website and your business account with us — email us at [email protected] with any question or request about your information. We will treat the request seriously and reply from that address.

If we change this policy, we post the updated version on this page, update the effective date above, and also notify registered business customers by email.

Questions about this policy: [email protected]

Optomatica LLC