Start Free Trial
Log In

Privacy Policy

Last updated: August 12, 2026

1. Who we are

Gala Taitto LLC (“Company,” “we,” “our,” or “us”) operates OptInBot — an embeddable AI chatbot service that helps businesses answer visitor questions and capture leads on their websites. This Privacy Policy explains how we collect, use, share, and safeguard your information when you visit optinbot.io, use the OptInBot dashboard at app.optinbot.io, or interact with a website that has embedded our chatbot widget.

Contact: [email protected]

2. Who this policy applies to

Two distinct groups of people whose data we handle differently:

  • Business customers — people who sign up for OptInBot to add a chatbot to their own website.
  • Website visitors — people who chat with an OptInBot-powered chatbot on a business customer’s website.

Where the rules differ for one group, we say so explicitly.

3. Information we collect

From business customers

  • Account data: name, email address, and business details you provide at signup.
  • Authentication data: an authentication identifier and session cookies used to keep you signed in.
  • Billing data: a billing account identifier and subscription status. We do not store your payment card number — it stays with our payment processor.
  • Configuration data: chatbot instructions, uploaded knowledge base files, widget theme settings, and integration preferences you provide.
  • Integration credentials (only if you connect an integration): OAuth tokens issued to us by third-party services you explicitly authorize, such as Google Calendar or Slack. See Sections 6 and 7.
  • Support communications: emails and messages you send us.

From website visitors

  • Chatbot conversation content: the messages you send to and receive from a chatbot, plus a session identifier used to group them.
  • Contact details you volunteer: name, email, phone number, or other information you share with the chatbot during a conversation.
  • Meeting bookings: if you book a meeting through the chatbot, we store the date, time, duration, your email, and (if the business owner enables it) a Google Meet link.
  • Rating and feedback: if you rate the chat 👍/👎, we store that rating and any optional text feedback you provide.
  • Link clicks: if you click a link the chatbot suggests, we log the URL and click time.

Automatically collected

  • Technical data: IP address, browser type and version, operating system.
  • Error data: crash reports and session replays (with all message text, form inputs, and media automatically masked) collected for the purpose of diagnosing bugs.

4. How we use your information

We use your data only for the following purposes:

  • Provide, operate, and maintain OptInBot and its chatbot widget.
  • Authenticate business customers and keep them signed in.
  • Process payments and manage subscriptions.
  • Store and display conversation transcripts, leads, and bookings to the business customer whose chatbot generated them.
  • Send transactional emails — meeting invitations, booking confirmations, trial expiry warnings, payment receipts, cancellation notices.
  • Deliver optional notifications (for example to Slack) when a lead is captured, if the business customer has configured this.
  • Diagnose bugs and investigate abuse using error reports and rate-limit logs.
  • Comply with legal obligations.
  • Send marketing emails to business customers about product updates, but only if you have opted in — and you can opt out from any such email.

What we do NOT do with your data

  • We do not sell your personal data to third parties.
  • We do not use your data — raw, derived, or aggregated — to develop, improve, or train foundational or generalized machine learning or artificial intelligence models, including our own or any third party’s.
  • We do not use Google user data (from Google Calendar or Google account profile) for any purpose other than the specific booking functionality you have configured. See Section 7.
  • We do not use chatbot conversation content for advertising, market research, or model training.

5. Legal bases for processing (EEA / UK visitors)

If you are in the European Economic Area or the United Kingdom, we process your personal data under one of the following legal bases:

  • Contract — to provide the service you signed up for (business customers).
  • Legitimate interests — to keep the service secure, prevent abuse, and improve reliability.
  • Consent — for optional marketing emails, and for website visitors who share personal information with a chatbot they choose to use.
  • Legal obligation — for tax, accounting, and legal-request compliance.

You can withdraw consent at any time (see Section 10).

6. Service providers we work with

We share the minimum data necessary with third-party service providers to operate OptInBot. Each is bound by contractual obligations to protect the data we share, and none are permitted to use it for their own purposes.

  • Payment processing — Stripe, Inc. handles all billing. We share your billing email and subscription identifiers with Stripe. Payment card details are entered directly into Stripe’s PCI-compliant fields and never touch OptInBot’s servers.
  • Google APIs — when a business customer explicitly connects Google Calendar. See Section 7 for the full description of scopes and data usage.
  • Cloud hosting, authentication, and secrets storage — our application, authentication service, and secrets vault are hosted on a major US-based cloud provider with SOC 2 Type II certification.
  • Database — customer data is stored on a managed PostgreSQL service running on a major US-based cloud provider. All data is encrypted at rest and in transit.
  • AI language model provider — chatbot conversation content is sent to a US-based AI provider that generates the bot’s replies and extracts lead details (name, email, phone, business name) from the transcript. This provider is contractually restricted from using the content to train their own models.
  • Transactional email delivery — meeting invitations, notifications, and trial warnings are sent through a third-party transactional email service.
  • Optional integrations chosen by the customer (for example, Slack for lead notifications) — only enabled when a business customer explicitly connects them. Data shared is limited to what’s necessary to fulfill the customer’s configuration.
  • Error and reliability tracking — crash reports and session replays are collected by a third-party error tracking service to help us diagnose bugs. Session replays automatically mask all text, form inputs, and media; the chatbot message, rating, and booking UI containers are additionally fully blocked from replay capture.
  • Widget asset hosting — icons and images business customers upload for their chatbot widget are hosted on a third-party image CDN.
  • Workflow automation — some internal data flows (transcript delivery, integration wiring, scheduled jobs) run through a self-hosted workflow automation platform.

We do not use Google Analytics or advertising analytics on our service or embedded widget.

A current list of the specific sub-processors we use is available on request at [email protected].

7. Google user data (Google Calendar integration)

When a business customer connects their Google Calendar to OptInBot, we access Google user data solely to provide the booking feature they configured. We do not use Google user data — raw, derived, or aggregated — for advertising, market research, training or improving any AI or machine learning model, or any purpose unrelated to the booking functionality.

Scopes we request and what we do with each

  • https://www.googleapis.com/auth/calendar.readonly — we call the Calendar freeBusy endpoint on the calendars the customer explicitly selected for conflict-checking, so we only offer meeting times when they are actually free. We do not read event content, attendees, ACLs, or settings.
  • https://www.googleapis.com/auth/calendar.events — we create one event per booking on the calendar the customer designated as the booking destination, with the visitor listed as an attendee and (if enabled) a Google Meet link.
  • openid / .../auth/userinfo.email — we read the connecting account’s email address once at connection time to display which account is connected in the customer’s dashboard.

Limited Use compliance

OptInBot’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google user data only to display availability to the visitors the chatbot is speaking with, and to create meeting events on the business customer’s behalf.
  • We do not transfer Google user data to any third party except as necessary to provide these features or as required by law.
  • We do not use Google user data for advertising or any purpose unrelated to the booking feature.
  • We do not allow humans to read Google user data unless (a) we have your affirmative agreement for specific messages, (b) we do so to investigate security issues or abuse, (c) we are required to do so by applicable law, or (d) the data is aggregated and used for internal operations in a manner consistent with applicable law.
  • We do not use Google user data — raw, derived, or aggregated — to develop, improve, or train generalized or non-personalized AI or ML models.

Revocation

You can disconnect Google Calendar from OptInBot at any time from the Integrations page in your dashboard. When you disconnect, we immediately call Google’s OAuth revocation endpoint (https://oauth2.googleapis.com/revoke) to invalidate the stored tokens and delete them from our database. You can also revoke access directly from https://myaccount.google.com/permissions.

8. How we protect your data

  • Encryption in transit: all communication between your browser, OptInBot’s servers, our database, and every third-party API we use is protected with HTTPS/TLS 1.2 or higher.
  • Encryption at rest: all customer data — including OAuth tokens issued by Google and Slack — is stored in a managed database that encrypts all data at rest using AES-256 disk encryption. Application-level secrets are stored in a cloud-managed secrets vault, encrypted with provider-managed keys.
  • Access control: OAuth tokens and other sensitive data live in database columns accessible only to OptInBot server-side code running under a scoped service credential. No client-side JavaScript, no third-party analytics, and no OptInBot employee outside of on-call operations ever has direct access. Row-Level Security is enabled on every table storing tenant data.
  • Rate limiting: all endpoints that interact with Google user data or process visitor chat are rate-limited per session and per IP to prevent abuse.
  • Session replay masking: our error tracking records session replays with all text, inputs, and media masked by default, and additionally blocks the entire chatbot message, rating, and booking UI containers so message content, visitor names, and emails are never captured in replays.
  • Webhook authentication: internal service-to-service HTTP calls require a shared secret; requests without it are rejected.
  • Payment security: card data is never seen or stored by OptInBot. Our payment processor handles all card processing under PCI DSS Level 1 certification.
  • Vulnerability reports: send suspected security issues to [email protected]. We investigate and, where appropriate, disclose material issues to affected users.

9. Data retention

  • Business customer account data: retained while your account is active. Deleted within 30 days of account closure.
  • Conversation transcripts, leads, bookings: retained for the life of the business customer’s account or until the customer deletes them from their dashboard. Deleted items are held in a “Trash” state for 30 days to allow restoration, then permanently purged by an automated job.
  • OAuth tokens: retained only while the corresponding integration is connected. Revoked and deleted on disconnect.
  • Payment records: retained as long as required by applicable tax and accounting law (typically 7 years).
  • Error and rate-limit logs: retained for up to 90 days.
  • Session replays: retained for up to 90 days for issue investigation.

10. Your rights

Depending on your location, you have some or all of the following rights over your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Correction — ask us to correct inaccurate data.
  • Deletion — ask us to delete your data (“right to be forgotten”). Business customers can delete their account from the dashboard. Website visitors can email us to have their conversation, booking, or lead data removed.
  • Portability — request a machine-readable copy of your data.
  • Objection / restriction — object to or restrict our processing of your data for certain purposes.
  • Withdraw consent — where processing is based on consent, withdraw it at any time.
  • Complain to a supervisory authority — for EEA/UK residents, you can lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected] with the request and enough information for us to identify the relevant data. We will respond within 30 days.

11. Children’s privacy

OptInBot is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you become aware that a child has provided us with personal information, please contact us and we will delete it.

12. International data transfers

OptInBot is operated from the United States. If you access the service from outside the United States, your data may be transferred to, stored in, and processed in the United States and other countries where our service providers operate. By using OptInBot, you consent to this transfer. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

13. Restrictions on use

Our services are open to lawful users. We reserve the right to refuse service, suspend accounts, or terminate access to any user or business found to be engaged in fraudulent, harmful, or unlawful activity. We may also report such activity to appropriate authorities as required by law.

14. Service availability

If OptInBot experiences downtime or a security incident that affects your data, we will communicate with affected users as soon as reasonably possible, and in any event within the timeframes required by applicable law.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced to business customers by email and posted at optinbot.io/privacy with a revised “Last updated” date at least 14 days before they take effect. Continued use of OptInBot after that date constitutes acceptance of the revised policy.

16. Contact us

Questions, requests, or complaints:

Gala Taitto LLC
Email: [email protected]