Last updated: 08-08-2026
1. Who we are
This Privacy Policy is issued by [IotaRise Private Limited] ("IotaBot," "we," "us," "our"), a company registered in India with its registered office at Sector 103, Gurgaon, Haryana, India, 122006, operating the IotaBot website, chat widget, and related products (together, the "Services").
We act as a data controller for personal data we collect directly from visitors to our own website and from our own business contacts (billing, sales, support). Where a business ("Customer") installs the IotaBot chat widget on its own website and uses IotaBot to talk to its visitors, we act as a data processor on that Customer's behalf for that conversation data — our processing there is governed by our agreement with the Customer, not this policy directly (see §9).
2. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email, phone, company, password hash, OAuth identifiers (Google) | Signup/login on the platform |
| Conversation data | Chat messages, pre-chat visitor form (name, email, phone, query), file attachments shared in chat | Visitors using a Customer's chat widget |
| Contact/lead data | Name, email, job title, company, LinkedIn URL, phone, city/country — for our own outreach | Manually entered or imported (Excel) by our team for the cold-email tool; contact form submissions |
| Billing data | Plan, billing address, transaction/subscription status | Our payment processor (Razorpay) — we do not store full card numbers ourselves |
| Cookies & device data | GA client ID, anonymous browser id, UTM/campaign parameters, ad click ids, IP address, browser/device type | Automatically, on website visits (see §4) |
| Communications | Support requests, contact-form messages | Submitted directly by you |
| Social/channel data | Instagram/email messages when a Customer connects those channels | Meta/Instagram API, inbound email |
3. Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Operating the chat widget and conversations | Performance of contract (with the Customer) / consent of the end visitor where required |
| Account creation, login, billing | Performance of contract |
| Cold-email outreach to prospective business contacts | Legitimate business interest, subject to opt-out via unsubscribe on every email |
| Website analytics (Google Analytics) | Currently applied without a separate consent gate, see §4 |
| Linking an anonymous ad-visit to your account | Consent — see §4 |
| Product improvement, security, fraud prevention | Legitimate interest |
| Legal compliance (tax, regulatory requests) | Legal obligation |
4. Cookies & similar technologies
Analytics — Google Analytics. We use Google Analytics to understand site usage. This sets cookies (_ga, _ga_*, _gid). IP addresses are anonymized before being sent to Google, and we do not enable Google's ad-personalization signals.
Campaign attribution. When you arrive via an ad or a link with campaign parameters, we record that visit (which campaign, landing page, and a random id for your browser) to measure which campaigns are effective. This is stored on our own servers and is not linked to your identity unless you separately consent — see below.
Linking to your account. If you arrive from an ad and later create an account or log in, we ask for your permission before connecting that anonymous campaign history to your account. Declining does not affect your ability to use the site. You can change this choice at any time via Privacy choices in the site footer.
You can also control cookies through your browser settings.
5. Who we share personal data with
We share personal data only as needed to run the Services:
- Infrastructure & hosting — our cloud servers and database (AWS, MongoDB Atlas) that store the Services' data.
- Email delivery — Google Workspace (for our own outreach and transactional email) and Mailgun (for Customer-configured support/email channels).
- Payments — Razorpay, to process subscription payments. We do not receive or store your full card number.
- Analytics — Google Analytics.
- Messaging platforms — Meta/Instagram, when a Customer connects that channel.
- Professional advisors — legal, accounting, and auditing where necessary.
- Authorities — where required by law, court order, or to protect our rights or the safety of others.
We do not sell personal data.
6. International data transfers
Some of our service providers (e.g. cloud hosting) may process data outside India. Where this happens, we take reasonable steps to ensure the data continues to be protected consistently with this policy and applicable law.
7. Data retention
We retain personal data only as long as necessary for the purposes described above — e.g., account data for as long as the account is active plus a reasonable period after closure for legal/audit purposes; cold-email contact data until you unsubscribe or ask us to delete it; billing records for the period required by tax law.
8. Your rights
Under India's Digital Personal Data Protection Act, 2023, and other applicable law, you may have the right to:
- Access the personal data we hold about you
- Correct or update inaccurate or incomplete data
- Erase your personal data (subject to legal retention requirements)
- Withdraw consent at any time, where processing is based on consent
- Nominate another individual to exercise your rights in the event of death or incapacity
- Register a grievance with us, and if unresolved, with the Data Protection Board of India
To exercise these rights, contact us using the details in §13. We will respond within the timeframe required by applicable law.
9. If you are a Customer's end user
If you are chatting with a business through IotaBot's widget, that business is the controller of your conversation data and is responsible for responding to your privacy requests. We process that data only on their instructions, under a data processing agreement. Contact that business directly, or contact us and we will direct your request to them.
10. Security
We use reasonable technical and organizational measures (encryption in transit, access controls, least-privilege credentials) to protect personal data. No system is completely secure, and we cannot guarantee absolute security.
11. Children's privacy
Our Services are not directed to children, and we do not knowingly collect personal data from children without appropriate parental/guardian consent where required by law.
12. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and, where required, we will provide additional notice or seek renewed consent.
13. Contact us / Grievance Officer
For any privacy questions, requests, or complaints:
Email: privacy@iotabot.io
Postal address: Sector 103, Gurgaon, Haryana, India, 122006
When contacting us, please tell us which country/state you're writing from so we can apply the correct local requirements.