Privacy Policy
WhatBotsSay (“we”, “us”) is operated by Varion Team LTD, a company registered in England & Wales (Company No. 17230615), 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the data controller for personal data processed through whatbotssay.com. Contact: [email protected].
What we collect
- Account data — your email address (we use passwordless magic-link sign-in; we never store passwords).
- Alert & waitlist emails — the address you ask us to send monitoring alerts or product updates to. Every alert email contains a one-click unsubscribe link.
- Scan inputs — brand names, categories, domains and competitor names you submit. These describe businesses, not people; please don’t submit personal data in scan fields.
- Billing data — subscriptions are processed by Stripe. We store your plan and a Stripe customer reference. We never see or store card numbers.
- Technical logs — IP address and request metadata, used for security and rate-limiting, retained for up to 30 days.
How we use it
- To provide the service: run scans, keep score history, send displacement alerts (performance of a contract).
- To secure the service: abuse prevention, rate limits (legitimate interests).
- To process payments and maintain subscriptions (performance of a contract, legal obligations).
- To send occasional product updates to the waitlist (consent — unsubscribe anytime).
We do not sell personal data and we do not run advertising or cross-site tracking.
Processors we rely on
- Supabase — database and authentication (project hosted in the EU).
- Stripe — payment processing and billing portal.
- Resend — transactional email delivery.
- Cloudflare — DNS, CDN and security in front of our server.
- AI & search providers (Perplexity, SerpApi/Google) — we send them the scan prompts built from your brand/category terms to retrieve answers. No account or contact data is shared with them.
- PostHog (EU) — privacy-friendly product analytics, hosted in the EU, running cookieless (nothing stored on your device). Signed-in users are identified by an opaque account ID only — never by email.
Some processors may handle data outside the UK/EEA; where they do, transfers rely on recognised safeguards such as adequacy decisions or Standard Contractual Clauses.
Retention
Account and scan data are kept while your account is active and deleted on request. Waitlist emails are kept until you unsubscribe. Technical logs are kept up to 30 days. Billing records are retained as required by tax law.
Your rights
Under UK GDPR you may request access, correction, deletion, restriction, portability, or object to processing. Email [email protected] and we’ll respond within 30 days. You may also complain to the UK Information Commissioner’s Office (ico.org.uk).
Children
The service is not directed at children under 16 and we do not knowingly collect their data.
Changes
We may update this policy as the product evolves; material changes will be announced on the site. The effective date above always reflects the current version.