Privacy policy

Your name and email address to sign you in to every app and to contact you about your account. Billing is handled by Stripe: we see your plans, their status and the last digits of your card, never the full number.

Basic request data (IP address, browser) for security, rate limits and bot protection. Sign-in uses Cloudflare Turnstile to tell people from scripts.

We use this data to provide the apps you signed up for, for our legitimate interest in keeping them secure and free of abuse, and to meet legal obligations such as keeping invoices.

Most of Botensten's apps hold data about people you deal with: subscribers, signers, respondents, viewers, visitors, customers. For that data you're the controller and we're your processor: we use it only to run the app for you, never for our own marketing, and we sign a data processing agreement on request. What each app records:

For each subscriber we store the email address, the fields you import or collect, their subscription status, and the events of the emails you send them: delivered, opened, clicked, bounced, complained or unsubscribed. Opens and clicks come from a tracking pixel and redirected links in campaigns; confirmation emails carry neither.

Addresses that unsubscribed or complained are kept as a one-way hash so they're never emailed again by mistake. An address that hard bounced is kept as a hash for 180 days, and a known spam trap indefinitely, so no customer emails it.

We store the documents you upload, the people you send them to (name and email address), and an audit trail for each envelope: when it was sent, viewed and signed, from which IP address and browser, and a fingerprint of the document at each step. Signed PDFs are sealed with a digital signature and a trusted timestamp.

Signers receive their invitation and a signed copy by email. Documents and audit trails stay in your account until you delete them or close the account; you're responsible for keeping signed records as long as your agreements or the law require.

For each click on a short link or QR code we record the time, the referring site, the browser, operating system and device type, and an approximate location (country, region, city) worked out from the IP address. Known crawlers aren't counted. Click history is kept for your plan's history period and deleted after it.

The tracking script sets no cookies and stores nothing on the visitor's device. For each pageview or event it records the page, the referring site, browser, operating system, device type, screen size, language and an approximate location worked out from the IP address, which isn't stored. Visits are grouped with a one-way hash that changes every month, so a visitor can't be followed across websites or from one month to the next.

You decide what custom events and properties to send; don't send names, email addresses or other personal data in them. Data is kept for your plan's history period.

We store the answers people give to your forms and surveys, when they answered, and the browser and approximate location of the response. You decide which questions to ask; tell respondents why you collect their answers. Don't use forms to collect passwords, full card numbers or government ID numbers.

When you connect a social network account, we store the access tokens the network gives us and use them only to publish and schedule the posts you create and to read their statistics. We store your posts, media and schedule. Disconnecting an account deletes its tokens here; you can also revoke access in the network's own settings. Each network's own terms and privacy policy apply to what you publish there.

We store the documents you upload and, for each view of a shared link, the viewer's email address when the link asks for it, the time, the pages viewed and for how long, the browser and an approximate location. Tell the people you share with that views are tracked; a link can require an email address or a passcode before it opens.

When you add the chat widget to your website, we store the conversations your visitors start, the name and email address they give, the page they wrote from, their browser and an approximate location, and the replies your team sends. The widget keeps a cookie on your visitor's device so their conversation continues on their next visit. Tell your visitors about the chat in your own privacy notice.

The assistant on our public pages answers questions about Botensten. What you type and the page you're on are sent to Anthropic to write each answer, and the conversation is kept so we can follow up and improve the answers. If you leave your email address or book a call, we keep it with the conversation in our own customer records to reply to you. Don't share sensitive personal information with the assistant.

The apps and their databases run on servers we operate ourselves in the United States. A few providers handle parts of the work; each receives only what its job needs. The Subprocessors page lists them, what they do and where.

When data leaves the EU or UK for these providers, it relies on their Standard Contractual Clauses or the EU-US Data Privacy Framework.

Account and app data stay while your account is open, within each plan's history period where an app has one. When you delete your account, you can restore it by signing in for 30 days; then everything is erased, except billing records we must keep by law. We keep a one-way hash of the account's email address to recognize it if it signs up again. Server logs are kept for 7 days.

You can export your data from each app where it offers an export, and ask us for anything else. To access, correct, export or delete personal data, use our contact form; we answer within 30 days. People in your lists can ask you, or us, to delete their data, and can unsubscribe from any newsletter with one click. If you think we've mishandled your data, you can complain to your local data protection authority.

We don't sell personal data or share it for advertising, and we don't run ads.

Only what the apps need: a session cookie when you're signed in, a 30-minute cookie after you pass the bot check, and cookies that remember settings such as your time zone. No advertising or cross-site tracking cookies.

Our public pages, not the apps' dashboards, count visits with Botensten Analytics, which sets no cookie, doesn't store your IP address, and stays off when your browser sends Do Not Track or Global Privacy Control.

Botensten isn't meant for anyone under 16, and we don't knowingly collect their data. Customers must not upload data about children without the consent the law requires.

Questions about privacy go through our contact form, or by post to Botensten, 1460 Broadway, 10th Floor, New York, NY 10036. We'll email customers before material changes to this policy.