1. Who we are
The controller of the personal data processed on the Botree website and platform is Rafael Henrique Anoni do Nascimento Ltda (Gameplay do Boy, gameplaydoboy.com.br), Brazilian company number (CNPJ) 48.011.000/0001-13, Rua Paraíba, 3336, Patrimônio Velho, Votuporanga/SP, CEP 15.502-150, Brasil. Our data protection officer (DPO) is Rafael Henrique Anoni do Nascimento, at contato@botree.com.br.
This policy explains which data we process, why, with whom we share it, how long we keep it and how you can exercise your rights, under the Brazilian General Data Protection Law (Law 13,709/2018, "LGPD") and, where applicable, the European General Data Protection Regulation ("GDPR").
2. Data we process
- Account: name, email, password (stored only as a hash), country, language and record of your acceptance of the terms (date, version and IP).
- Billing: Brazilian tax ID (CPF, Brazil only), phone, company, address, plan, payment history and the last 4 digits and brand of your card. The full card number stays only with Stripe.
- Meta connection: identifiers of the WhatsApp Business account (WABA ID, Phone Number ID, number) and of the Instagram professional account (ID, username), access tokens (stored encrypted) and the Facebook user ID that authorized the connection.
- Customer service: data of the contacts who chat with the bots (phone or Instagram ID, public name and photo, messages, images and audio), registered agents and statistics.
- Support: messages and images sent in tickets.
- Technical: IP, date and time of access, browser and security logs, plus the cookies described in section 10.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Create and keep your account, provide the service and connect WhatsApp and Instagram | Performance of contract |
| Charge the subscription, issue receipts and meet tax obligations | Performance of contract and legal obligation |
| Security, fraud prevention and access logs | Legal obligation and legitimate interest |
| Emails about your account, billing, support and important notices | Performance of contract |
| Send Botree news and offers by email, only if you opt in (you can leave at any time through the link at the end of each email or in My account) | Consent |
| Remember preferences such as language (non-essential cookies) | Consent |
| Improve the product with usage statistics | Legitimate interest |
We do not sell personal data and we do not use your data for third-party advertising.
4. Your customers' data
The data of people who chat with your bot is processed by us on behalf of your business: you are the controller and Botree is the processor. We use it only to deliver the conversations, keep the history and produce statistics for you. You are responsible for informing your customers and having a legal basis to serve and message them.
To handle your customers' requests (access, portability or deletion), you can export as JSON or delete everything Botree keeps about a contact (messages, conversation state, attributes, contact record and media files) on the Contact data page, in the signed-in area, also available from My account. Anything already delivered to the contact on WhatsApp or Instagram stays in those apps.
5. Who we share data with (subprocessors)
To provide the service we rely on the companies below (subprocessors), which process data on our behalf and only for the stated purpose:
| Company | Purpose |
|---|---|
| Hostinger | Hosting of the website, database and files, and sending and receiving email |
| Stripe | Payment processing and card storage |
| Meta (WhatsApp, Instagram, Facebook) | Sending and receiving messages and connecting accounts |
| DeepSeek | AI answers, when you turn this feature on (receives the conversation text and your business information) |
| Telegram | Internal alerts for our team: name and email of the Botree customer, connected WhatsApp number or Instagram username and the beginning of support ticket messages. No data of the people who chat with your bots goes to Telegram. |
| Cloudflare (cdnjs) | Delivery of the website icons (it receives the visitor's IP) |
| Authorities | When required by law or court order |
6. International transfers
Botree is operated from Brazil. Some subprocessors store or process data outside Brazil (for example in the United States, the European Union and, for AI, China). These transfers happen to perform our contract with you and under contractual safeguards, as allowed by article 33 of the LGPD.
For customers in the European Union, transfers of data to Brazil and to other countries without an adequacy decision from the European Commission rely, where needed, on the standard contractual clauses approved by the European Commission (article 46 of the GDPR).
7. How long we keep data
| Data | Period |
|---|---|
| Account, bots and conversations | While the account exists; up to 90 days after closure |
| Payments and tax data | 5 years (tax law) |
| Access logs | 6 months (Brazilian Internet Civil Framework) |
| Meta tokens | Deleted as soon as you disconnect the account |
| Support tickets | While the account exists |
8. Security
We use HTTPS, hashed passwords, signature checks on integrations (Stripe and Meta), access control, anti-bot limits and backups. No system is completely immune. If a security incident affects data of your account or of your customers, we will notify you by email within 72 hours of becoming aware of it, explaining what happened, which data was affected and what we are doing. When there is relevant risk, we will also notify the data protection authority and the affected people, as required by law.
9. Your rights
At any time you may: confirm whether we process your data; access it; correct it; ask for anonymization, blocking or deletion of unnecessary data; ask for portability; know with whom we share it; withdraw consent (news and offers emails, for example, can be turned off through the link at the end of each email or in My account); and ask for account deletion.
Send your request through the Your data page or to contato@botree.com.br. We answer within 15 days. You may also complain to the Brazilian data protection authority (ANPD) or to your local authority.
Deletion requests made through Facebook or Instagram are also handled automatically: Meta notifies us and we remove the data linked to the Meta account. Progress can be checked at botree.com.br/meta_status_excluir.php.
10. Cookies
Cookies are small files stored in your browser. On Botree:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| PHPSESSID | Essential | Keep you signed in and protect forms | Until you close the browser |
| bt_cookies | Essential | Remember whether you accepted or declined cookies | 12 months |
| bt_idioma | Preference (only with your consent) | Remember the chosen language | 12 months |
| __stripe_mid, __stripe_sid | Essential (Stripe) | Security and fraud prevention on the payment page | Up to 1 year |
We do not use advertising or third-party tracking cookies. You can change your choice at any time under "Cookie preferences" in the website footer, or delete cookies in your browser.
11. Minors
Botree is intended for businesses and professionals aged 18 or over. We do not knowingly collect data from minors.
12. Changes to this policy
We may update this policy. Relevant changes will be announced by email or in the panel. The date of the current version is shown at the top of the page.