BotPenguin

GDPR overview

GDPR compliance is claimed explicitly and in concrete terms. BotPenguin positions itself as a data processor, publishes a Data Processing Agreement at botpenguin.com/dpa and offers it to every customer on request. Because the company has no establishment in the European Union, it has appointed an Article 27 representative, Cubes srl, contactable at info@cubessrl.it, alongside a named Data Protection Officer, Ajay Pratap Sudhakar, at dpo@botpenguin.com. The policy sets out rights of access, rectification, erasure, objection, restriction, portability and consent withdrawal, the right not to be subject to automated decision-making, and the right to complain to a supervisory authority, with the competent authority determined by Clause 13 of the EU Standard Contractual Clauses. Sub-processor changes are notified thirty calendar days in advance. ISO 27001, SOC 2, HIPAA and CCPA are claimed alongside.

Who owns the data?

BotPenguin acts as a data processor and treats chatbot data as belonging to the customer, who remains the controller. The vendor stores questions and responses on the customer's behalf and undertakes not to sell chatbot data to third parties without permission; sharing is limited to service providers bound by contract to the same confidentiality terms. End users who talk to a bot, called Respondents, have no direct relationship with BotPenguin and must send access, correction or deletion requests to the customer running the bot. Deleting an account permanently erases the chatbot data it held, within a reasonable period. A named Data Protection Officer, reachable at dpo@botpenguin.com, handles rights requests.

Reuse rights

Customers keep the right to use the conversation data their bots collect, and nothing in the published terms restricts how they reuse leads, transcripts or contact details gathered through the platform; the customer is treated as the controller and carries responsibility for the legal basis behind that reuse. On BotPenguin's own side the declared uses are service delivery, statistical analysis, product improvement, security and fraud prevention, plus commercial communications that can be refused at any time, for which the vendor builds user profiles and segments through statistical techniques. Conversation data is explicitly excluded from training shared AI models, and Google Workspace APIs are not used to develop or train generalised AI or machine-learning models. The privacy policy also states that no cookies of any kind are in use at the date of the policy. LLM inference runs through OpenAI, Claude or Gemini, selected by the customer.

Data retention & training

Hosting summary

Production data is hosted on Amazon Web Services in Europe, specifically the Stockholm region (eu-north-1), a point the privacy policy and the DPA both state explicitly. The deployment spans multiple AWS availability zones with replication between them and regular backup restoration testing. Annex III of the DPA lists the sub-processors in the open: Amazon Web Services, MongoDB Atlas, Elastic Search and Redis, all in EU Stockholm; HubSpot for customer support in EU Germany; and, chosen by the customer, LLM providers (OpenAI, Claude, Gemini), Meta, Telegram, Microsoft Teams and Twilio for message transport. Data is encrypted in transit with TLS 1.2 or above and at rest with AES-256, and customer data sets are logically isolated from one another. Automated daily backups run with a 12-hour recovery point objective, and disaster recovery procedures are documented and tested twice a year. Data residency options beyond Stockholm exist but are reserved for enterprise and white-label accounts. The publisher itself is Indian, so European hosting is a deliberate choice rather than a consequence of its own jurisdiction.