Privacy Policy
Last updated
The short version: we keep what we need to run your rooms and bill you, we don’t sell it, we don’t run ad trackers, and what’s inside your room is yours.
Who we are
Botel (botel.dev) is the controller of the personal data described here. For anything about your data, write to [email protected].
What we collect
Your account
- Your email address and password. The password is stored only as a salted hash.
- For each sign-in session: its dates, IP address and browser user agent.
- SSH public keys you add to reach your rooms.
Billing
- Your top-ups, refunds, disputes and charges, and your Stripe customer ID. We never see your card details.
Your rooms
- Room details: name, size, status and key times, and if you connect a bot, its handle and the last chat it spoke in.
- Usage: awake time, storage and, for managed inference, model, tokens and cost per call. We do not store your prompts or the model’s replies.
- An activity log of room events, shown in your console.
- Everything inside the room, and snapshots of it: files, the agent’s memory and conversations, browser sessions and software.
- Keys you give us (model-provider API keys, Telegram bot tokens), stored encrypted.
Invite requests
- Your email, any note you add, the referring page and your browser user agent. We don’t store your IP address with it.
Website visits
- Cloudflare Web Analytics counts page views without cookies or local storage, and without tracking you across sites.
Why we use it
- To provide the service (contract): running your rooms, signing you in, billing, service emails.
- To meet legal obligations: payment and accounting records.
- For our legitimate interests: security, preventing fraud and abuse, and answering invite requests.
We need your email and a password to open an account, and a payment to top up. Without them we can’t provide the service.
We do not sell your data, use it for advertising, or train models on your room. Model providers handle prompts under their own terms.
Who else processes it
| Provider | What for | Where |
|---|---|---|
| Scaleway | Hosts Botel and every room, including backups. | France (EU) |
| Scaleway Transactional Email | Sends our service emails. | France (EU) |
| Stripe | Takes top-up payments and saves your card if you ask it to. Card details go to Stripe, never to us. | United States and EU |
| Cloudflare | Delivers botel.dev, protects it from attacks and counts page visits. | Global network, United States company |
| OpenRouter | Routes model requests when you use managed inference. | United States |
| Model providers | Run the model you choose. | Varies by provider |
| Telegram | Carries bot messages, only if you connect one. | Global |
With your own model key, your room talks to that provider directly under your agreement with them.
Where data leaves the EU, we rely on GDPR safeguards such as standard contractual clauses. Email [email protected] for a copy.
We may disclose data when the law requires it.
How long we keep it
- Account and billing records: while your account is open, and longer where tax law requires.
- A room and its snapshots: until you delete the room. Deleting it erases its files, memory and snapshots, usually at once and at the latest 31 days later. A room left at zero balance for 30 days can be deleted.
- Room activity log: 90 days.
- Invite requests: 180 days.
- Database backups: 30 days.
- Sign-in sessions (IP address, browser): 30 days after the session ends.
Deleting your data
Delete a room any time from the console. To close your account and delete everything, email [email protected] from the address on the account.
Your rights
Under the GDPR you can ask us to access, correct, delete, restrict or port your data, or object to how we use it. Email [email protected]; we reply within one month. You can also complain to your data protection authority.
While your balance is above zero, you can copy anything out of your room over SSH.
Cookies
We set only the cookies that keep you signed in. When you top up, Stripe’s payment form sets fraud-prevention cookies, and Cloudflare may set security cookies. All are strictly necessary, so there is no consent banner. We use no advertising or tracking cookies.
Security
Traffic is encrypted in transit and stored keys are encrypted. If a breach affects your data, we will tell you and the authorities as the law requires.
Age
Botel is for people aged 18 and over. We do not knowingly collect data from anyone younger.
Changes
We will email account holders before material changes take effect.
Questions: [email protected] · Terms of Service · Home