# Privacy policy

> DRAFT preview, copy not approved

Source: https://botofmouth.com/es/legal/privacy/
Last updated: 2026-10-21

> **DRAFT, not legal advice, to be reviewed.** This page shows the structure and our intended practice. It is not yet a binding policy.

How BotOfMouth, a brand of Luminos Ventures Technologies Ltd, Israel, handles your data.

## 1. Who is responsible for your data

The controller of your personal data is Luminos Ventures Technologies Ltd, a company registered in Israel ("we", "us"). Company number: 517320172. Registered address: A.D. Gordon 7, Tel Aviv 6340007, Israel.

Privacy contact: [meni@botofmouth.com](mailto:meni@botofmouth.com).

EU representative: [TBD by counsel: needed under GDPR Article 27 unless the occasional-processing exemption applies]. Data protection officer: [TBD by counsel: required or not].

## 2. Data we collect

| Data | What it is | Where it comes from |
|---|---|---|
| Free AI checkup inputs | Your website address or social handle, business name, town and the language your customers ask in | You, in the checkup form |
| Contact details | Your email, if you ask for your full report or request access | You |
| Customer account | The owner's name, email and phone number, and the business details we need to run the service | You, at sign-up and later |
| Purchase details | Name, email, country, plan, amounts and transaction ID. Never your card number. | Paddle, our merchant of record |
| Access credentials | Tokens or limited user roles for the accounts you connect | You, when you connect an account |
| AI answers | The raw answers AI assistants give about your business | The AI assistants we ask |
| Messages | What you send us by email, WhatsApp or Telegram, our support channels | You |
| Technical data | IP address, browser type and request times, used for security and to stop abuse | Your browser |

We use Cloudflare Web Analytics, which sets no cookies and does not track you across sites. It counts visits in aggregate.

## 3. Why we use it, and our legal basis

If you are in the EU or the UK, the GDPR requires a legal basis for each use. These are ours.

| Purpose | Legal basis |
|---|---|
| Running the free AI checkup you ask for, and sending you the result | Steps you ask for before a contract, and our legitimate interest in answering your request |
| Sending you follow-up emails about BotOfMouth after a checkup | Your consent, which you can withdraw at any time |
| Providing the service: changes, monitoring, reports and support | Performance of our contract with you |
| Billing, invoices and tax, through Paddle | Performance of the contract, and legal obligations |
| Counting visits to this site in aggregate (Cloudflare Web Analytics) | Our legitimate interest in knowing how the site is used |
| Keeping the service secure and preventing abuse | Our legitimate interest in a safe service |
| Keeping records the law requires | Legal obligations |

We never sell your data or share it with ad networks. We never publish your AI answers without your written consent.

## 4. Who we share it with

We share data only with the providers below, which we need to run the service.

| Recipient | Why |
|---|---|
| Paddle.com (merchant of record) | Checkout, payments, invoices, sales tax and refunds. Paddle handles your payment details under its own [privacy notice](https://www.paddle.com/legal/privacy). |
| Cloudflare (hosting, database, analytics, bot protection) | Hosting this website and our software, storing checkup results, customer data and access credentials, Cloudflare Web Analytics, and protecting the site from bots |
| Google Workspace | Our email, including the automated report emails we send you |
| AI providers whose assistants our checkup asks: OpenAI, Anthropic, Perplexity, Google and xAI | They receive the business name, website and location you enter. They never receive your email or payment details. |
| DataForSEO | Fetches Google AI answers for the checkup. It receives the business name, website and location only. |
| Meta Platforms (WhatsApp support messages) | If you contact us on WhatsApp, your messages are also handled under WhatsApp's own privacy terms. |
| Telegram (support messages) | If you contact us on Telegram, your messages are also handled under Telegram's own privacy terms. |
| Professional advisers and authorities | Where needed for legal, tax or accounting reasons, or where the law requires it |

When we start using a new provider, we add it here before it handles your data.

## 5. Personal data and AI

- We mask personal data before any AI processing: owner names, emails and phone numbers are replaced with tokens, unless a task needs them.
- What we send to AI models is information about your business, such as its website, name and town.
- Screenshots are blurred where they show emails, phone numbers or card details before any AI reads them.
- Access credentials are never given to AI models.
- Your customers' personal data stays in the systems where you keep it. We never export customer lists.

## 6. International transfers

We are based in Israel, and some of our providers are in the United States and other countries. Israel has an adequacy decision from the European Commission. For transfers to other countries, we use safeguards the law accepts, such as the EU Standard Contractual Clauses or the UK transfer agreement. [TBD by counsel: confirm the safeguard for each provider]

## 7. How long we keep it

| Data | How long |
|---|---|
| Raw AI answers | 24 months |
| Customer account data and the business details you gave us | Deleted within 30 days after your subscription ends |
| Access credentials | Deleted when we remove our access, within 7 days after your subscription ends |
| Free AI checkup inputs and contact details, if you don't subscribe | 12 months |
| Invoices and billing records | As long as tax and accounting law requires [TBD by counsel: period] |
| Technical data and security logs | [TBD by counsel: e.g. 90 days] |

## 8. Security

- Access credentials are kept in a secrets store on Cloudflare, one per account, and fetched only when needed. They never appear in logs.
- Each part of our software can reach only the accounts it needs.
- Every change we make is recorded in a log that cannot be deleted.

## 9. Your rights

Depending on where you live, you may have the right to:

- see the personal data we hold about you and get a copy;
- correct it;
- have it deleted;
- restrict or object to how we use it, including for direct marketing;
- receive it in a portable format;
- withdraw your consent at any time, without affecting earlier use;
- complain to a data protection authority: in Israel, the Privacy Protection Authority; in the EU or UK, the authority where you live or work.

## 10. How to use your rights

Write to [meni@botofmouth.com](mailto:meni@botofmouth.com). We will answer within one month. We may ask you to confirm who you are first.

If you live in a US state with a privacy law, such as California, you can use the same email to ask what we hold, or to have it deleted or corrected. We don't sell personal data or share it with ad networks.

## 11. Cookies

This site sets no ad or tracking cookies. We use Cloudflare Web Analytics, which sets no cookies and does not track you across sites. It counts visits in aggregate.

Paddle's checkout may set the cookies it needs to process your payment. They are covered by Paddle's privacy notice.

## 12. Children and changes

BotOfMouth is a service for businesses. It is not meant for anyone under 18, and we don't knowingly collect their data.

We may update this policy. The date at the bottom of this page shows the last change. If a change is material, we will tell customers by email.