Embott is an AI sales-agent product offered by WebSenor Private Limited. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and the rights you have over it. It applies to merchants who install Embott on their site and to visitors who chat with the Embott agent.
1. Who controls your data
For merchants (you, the business installing Embott): we are the data controller for the data you create with us — your account, your bot configuration, billing, and the conversations you observe on your dashboard.
For your end customers (visitors who chat with the bot on your site): the merchant is the data controller and Embott acts as the data processor. We process visitor data on the merchant's instructions through the bot's configuration.
2. What data we collect
2.1 Merchant account data
- Name, email address, password (hashed with bcrypt, never stored in plaintext)
- Business name, website domain, billing country
- Payment information — handled by Stripe / Shopify Billing; we never store full card numbers
- Usage telemetry — pages viewed in the dashboard, feature toggles, support tickets
2.2 Site content we crawl
- Public pages of the merchant's website, product catalogs, FAQ, About, and Contact pages
- Sitemaps and Open Graph metadata
- Shopify / WooCommerce product + order data — when the merchant explicitly grants the OAuth scopes during install
2.3 Visitor data (when a visitor chats)
- Conversation transcripts (every user + bot message)
- Optional contact info the visitor provides (name, email, phone, business)
- Page URL, referrer, UTM parameters, device type, locale
- Approximate IP-derived geolocation (country, city) — IP itself is not stored long-term
- Cart state passed by the storefront
- For logged-in shoppers on a connected store: customer ID and email, only if the merchant opts in
2.4 What we do NOT collect
- Full IP addresses (we hash them after geolocation)
- Credit-card numbers or banking details
- Government-issued identifiers (SSN, passport, Aadhaar, etc.)
- Health, biometric, or precise-location data
- Children's data — Embott is not intended for use by anyone under 16
3. How we use it
- To run the chat agent — generating replies, qualifying leads, recovering carts, booking calls
- To keep the merchant's bot trained on fresh site content (re-crawl on a schedule)
- To surface conversations, leads, and analytics in the merchant dashboard
- To send transactional emails (account verification, billing receipts, security alerts)
- To improve product quality — only on aggregated and anonymised data
- To prevent abuse — rate limiting, spam detection, fraud signals
- To comply with legal obligations and court orders
We do not sell personal data. We do not train any public AI model on your conversations. The AI model (Anthropic Claude) receives your data through a zero-retention API tier and does not retain it after the request is served.
4. Sub-processors
The third parties we share data with, strictly for service delivery:
- Anthropic (USA) — Claude API. Zero-retention tier. Anthropic Privacy
- DigitalOcean (USA / EU) — application hosting and managed Postgres
- Cloudflare (USA / global) — DNS, CDN, DDoS protection
- Resend (USA) — transactional email delivery
- Stripe (USA / EU) — payment processing (only when billed outside Shopify)
- Shopify (Canada / USA) — when installed via the Shopify App Store
- ipinfo.io (USA) — IP → country/city lookup (no data retained on their side)
5. Where data is stored
Production data lives in encrypted Postgres clusters in DigitalOcean's EU (Frankfurt) and US (NYC3) regions. Backups are encrypted with AES-256 and retained for 30 days. All data in transit is encrypted with TLS 1.3.
6. How long we keep it
- Active merchant accounts: for as long as the account exists.
- Closed accounts: 30 days, then deleted, unless legal hold applies.
- Conversations: 24 months by default. Merchants can shorten this in settings.
- Logs: 14 days.
- Billing records: 7 years (statutory retention).
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or outdated data
- Delete your data ("right to be forgotten")
- Restrict or object to processing
- Port your data to another service
- Withdraw consent (where processing is based on consent)
- Lodge a complaint with your local data-protection authority
To exercise any of these, email info@websenor.com. We respond within 30 days. If the request comes via a Shopify merchant's customers/data_request webhook, we handle it through the merchant's admin in line with Shopify's GDPR requirements.
8. Cookies and tracking
Embott uses a single first-party cookie (chatry_visitor) to remember a visitor across page loads within a chat session. No third-party advertising or cross-site tracking cookies are set by the widget.
9. Children
Embott is built for businesses. We do not knowingly collect data from anyone under 16. If you believe a minor has provided data through our widget, email us and we will delete it.
10. International transfers
When data leaves your region, the transfer is covered by Standard Contractual Clauses with each sub-processor.
11. Security
- TLS 1.3 in transit; AES-256 at rest
- Passwords hashed with bcrypt (work factor 12)
- JWT-based session tokens, short-lived, rotated on logout
- Role-based access control inside the dashboard
- HMAC-verified webhook payloads
- SOC 2 controls in flight (target: Q4 2026)
12. Changes to this policy
If we materially change this policy, we'll email the merchant's account email and update the "Last updated" date above. Continued use of Embott after the change date constitutes acceptance.
13. Contact
Questions, requests, or concerns:
Email: info@websenor.com
Postal: WebSenor Private Limited, Bangalore, India