Privacy Policy

1. Introduction

Botyard ApS ("Botyard", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

We are registered in Denmark. For GDPR purposes, we are the data controller for the personal data we process.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, company name, job title when you register
• Payment Information: Billing address, payment card details (processed by our payment provider)
• Communications: Messages you send us via email or support channels
• Your Content: Data, configurations, and content you upload to the platform

2.2 Information Collected Automatically

• Usage Data: Features used, pages visited, actions taken within the platform
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, error logs, and diagnostic information
• Sign-up source: We collect sanitised, allowlisted UTM campaign codes whether or not optional consent is given, and may associate them with your account when you sign up. We use these codes together with account-retention and subscription information to understand which campaigns bring customers who continue using and paying for Botyard. We rely on our legitimate interests in measuring long-term campaign effectiveness. We keep these UTM signup-source records for the life of your account and delete them when your account is deleted, unless they are deleted earlier because they are no longer needed or an applicable data-protection right requires it.
  If you enable Marketing, we also store advertising click identifiers such as gclid and rdt_cid in our own signup records, where we keep them for at most 90 days. Click identifiers in the links you use are also sent to our analytics provider, where the analytics retention applies. We share them with advertising platforms only if you consent to marketing. If you arrived from a Reddit ad and Marketing consent is active when you sign up, we send Reddit a SignUp event containing your Reddit click identifier, sign-up time and a random conversion identifier used to prevent duplicate reporting. Marketing consent must also remain active when the event is sent. We do not include your email address or your device's IP address in this server-side event. We do not send Google click identifiers to Google under this arrangement.
• Cookies and similar technologies: We use necessary cookies for essential functions and to remember your privacy choices for six months. On botyard.io, if you enable Analytics, we also use PostHog cookies and local storage for detailed usage analytics; session replay requires its separate setting. Marketing cookies and Reddit tracking are used only with Marketing consent. Without optional consent, we use limited cookieless audience counting, as explained in section 2.4. The signed-in app uses PostHog cookies and similar technologies for product analytics and session replay by default, which you can switch off in account settings, as explained in section 2.4.

2.3 Information from Third Parties

• SSO Providers: Identity information from your organization's identity provider
• AI Model Providers: Usage and billing data from integrated AI services

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To provide, maintain, and improve the platform
• Account Management: To manage your account and provide customer support
• Billing: To process payments and send invoices
• Communications: To send service updates, security alerts, and marketing (with consent)
• Security: To detect, prevent, and respond to security incidents
• Compliance: To comply with legal obligations and enforce our terms
• Analytics: To understand usage patterns and improve the service

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your data based on:

• Contract: Processing necessary to provide the services you've requested
• Legitimate Interests: Security and service improvement
• Legal Obligation: Compliance with laws and regulations
• Consent: Marketing communications (you can withdraw consent anytime)
• Privacy preferences: Our legitimate interests in remembering and respecting your choices (Article 6(1)(f)); necessary preference storage is exempt from cookie consent. We keep proportionate consent evidence to meet GDPR accountability obligations, including Article 7(1) (Article 6(1)(c)).
• Limited cookieless audience counting: Our legitimate interests in measuring audience size and understanding service use (Article 6(1)(f)), with data minimisation and your right to object.
• Sanitised UTM campaign tags in our signup records: Our legitimate interests in measuring our own campaigns and signup sources (Article 6(1)(f)), with allowlisting, minimisation and your right to object.
• Detailed analytics on botyard.io: Your Analytics consent (Article 6(1)(a)). Session replay on botyard.io: Your separate Session replay consent, with Analytics enabled (Article 6(1)(a)).
• Product analytics and session replay in the signed-in app: Our legitimate interests in understanding and improving the Service (Article 6(1)(f)), with masking of inputs and content, a 30-day maximum for session recordings, the 'Share usage data & session recordings' setting and your right to object.
• Advertising click identifiers in our signup records, Reddit Pixel and Reddit conversion sharing: Your Marketing consent (Article 6(1)(a)), including the relevant cookies and similar technologies.

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Cloud hosting, payment processing, analytics, and support tools
• AI Model Providers: When you use integrated AI services
• Your Organization: Administrators of your enterprise account
• Legal Authorities: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal data. With Marketing consent, we share the limited visit and sign-up information described above with Reddit for advertising measurement and the other advertising uses explained in this policy. We do not share your app content, product-analytics or session-replay data with Reddit.

Reddit's role. Reddit processes the advertising event data it receives as an independent controller for its own uses under its Advertising Data Processing Agreement. For the collection and transmission of information through the Reddit Pixel on our website, Botyard and Reddit may be jointly responsible. You can exercise your data-protection rights by contacting Botyard at [email protected], or by contacting Reddit directly. See Reddit's Privacy Policy for its uses of the data and how to contact Reddit.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the UK and EEA. When we transfer data internationally, we use appropriate safeguards:

• Standard Contractual Clauses approved by the European Commission
• UK International Data Transfer Agreement
• Adequacy decisions where applicable

7. Data Retention

We retain your data for as long as necessary to:

• Provide the services you've requested
• Comply with legal and regulatory requirements
• Resolve disputes and enforce our agreements

Personal accounts.When you delete your account, we delete Your Content within 30 days, except where we're legally required to retain it.

Organization workspaces. Content created in an organization's workspace belongs to that organization, which acts as the data controller (see our Data Processing Agreement). If you delete your account, we delete your personal account data within 30 days. Content you created in an organization's workspace is retained and deleted according to that organization's instructions, or within 30 days of the organization's deletion.

Retention: We remember an explicit privacy choice for six months. Session recordings, on botyard.io and in the signed-in app, are retained for no more than 30 days; this limit applies to recordings only, not to analytics events. In our own signup records we keep advertising click identifiers for at most 90 days; click identifiers sent to our analytics provider are subject to the analytics retention described below. We do not enforce a fixed deletion deadline for analytics or cookieless-counting events stored by PostHog; plan-based limits on how long events remain accessible in queries do not guarantee their deletion. We delete data earlier where it is no longer needed or required by applicable rights. Cookie/storage expiries are listed in the cookie details and may differ from these backend retention periods.

UTM signup-source records: We keep these records for the life of your account and delete them when your account is deleted. We delete them earlier if they are no longer needed or an applicable data-protection right requires deletion.

Aggregated, anonymized data may be retained indefinitely.

8. Your Rights

Under applicable data protection laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a portable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw any consent you have given at any time

Change your choices: On botyard.io, use Cookie settings at any time. Disabling Analytics stops detailed website analytics and session replay; disabling Session replay stops website replay; disabling Marketing stops future advertising tracking and conversion sharing. Website cookie settings, including Reject all, do not control product analytics or session replay in the signed-in app: to stop those, switch off 'Share usage data & session recordings' in account settings (Account → Profile → Privacy), or object as described below. Limited cookieless counting and the limited UTM processing described above continue on legitimate interests unless an applicable objection requires us to stop. To object, contact [email protected]. You can object to our use of UTM signup-source records for campaign analysis by contacting [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal and does not automatically delete data already received by Reddit; applicable data-protection rights remain available.

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication
• Regular security assessments
• Employee training on data protection
• Incident response procedures

10. Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children. If we learn we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

For privacy-related inquiries or to exercise your rights:

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) or your local supervisory authority.