ReldavaBot Back to dashboard

Privacy Policy

Last updated: 24 August 2026.

ReldavaBot lets you build chat assistants that answer from your own material - documents you upload, pages of your website, files in your cloud storage, messages in your inbox - and put them on your site or in your messaging channels. This policy explains what we collect, what we do with it, and who else sees it. It is written to be read, not to be survived.

Who we are

The Service is operated by Reldava Tech ("we", "us"). Write to [email protected] for anything in this policy, including requests to access, correct, export or delete your data. We answer privacy requests from the same address.

Two kinds of data, two different roles

The distinction runs through everything below, so it comes first.

Your account data is data about you: your name, your email address, your organization, your billing record. For this we are the controller - we decide what to collect and why, and this policy is our answer to you.

Your content is what you bring into the Service and what your bots' visitors say to them: uploaded files, crawled pages, synced mail and cloud documents, chat transcripts, and anything a visitor types into a lead form on your bot. For this we are a processor - the data is yours, we hold it to run the Service for you, and we act on your instructions. If that content includes personal data about other people, you are the controller for it and the "Data processing terms" section below sets out the terms on which we handle it.

What we collect

Account information. Your name, email address, and a password hash if you signed up with a password. If you sign in with Google or Microsoft, we receive your name, email address and profile picture from them - never your password.

Organization information. The organization name you choose, the members you invite, their roles, and the invitations you send.

Billing information. Your plan, your credit usage, and an identifier for your customer record at Stripe. Card numbers, billing addresses and payment details are entered on Stripe's own pages and are held by Stripe. We never see or store them.

Content you connect. Files you upload, text you paste, pages we crawl from addresses you give us, and - only if you connect the account yourself - messages from Gmail or Outlook and files from Google Drive, OneDrive or Dropbox. We store this content, and passages extracted from it together with their numeric representations, so your bots can find the right passage to answer from.

Conversations with your bots. The messages visitors send to your bots and the replies they receive, the channel they came through, and an identifier for the visitor supplied by that channel. If your bot shows a lead form, whatever the visitor types into it - typically a name, an email address and sometimes a phone number.

Technical information. When you sign in we store a session record with your IP address, your browser's user-agent string and an expiry date. Our servers keep operational logs of requests and errors. That is the extent of it.

What we do not collect

We do not use analytics of any kind. There is no Google Analytics, no Plausible, no product-analytics SDK and no advertising pixel anywhere in ReldavaBot - not on the marketing site, not in the dashboard, not in the chat widget.

One third-party script exists, and only one. If you open the WhatsApp channel screen of a bot, we load Meta's JavaScript SDK from Meta's servers so that their sign-up flow can run. Loading it lets Meta see the request, including your IP address, and it sets Meta's own cookies for that flow. It loads on that one screen and nowhere else - never on the marketing site, never in the chat widget your visitors see, and not on any other page of the dashboard.

We do not ask for your phone number, and we do not buy or enrich data about you from anyone.

How we use it

  • To run the Service: authenticate you, keep your organization and its bots working, index your content and answer with it.
  • To bill you: track credit usage against your plan and process subscriptions through Stripe.
  • To support you: answer the messages you send us, and diagnose faults you report.
  • To keep the Service safe: rate limits, abuse and fraud prevention, and investigating misuse.
  • To meet legal and accounting obligations.

We do not sell your data or your content, and we do not share it for advertising.

How your content reaches AI providers

This is the most important thing in this policy, so it gets its own section.

ReldavaBot does not run its own language models. To answer a question, we send the visitor's message and the passages we selected from your content to a third-party model provider, receive the generated reply, and pass it back. The same applies when we index your content: the text is sent to an embedding model so it can later be searched. Which provider that is depends on the model you chose for the bot, and the model picker names it.

The providers involved, and what each receives.

  • OpenAI - passages of your content for indexing, and, for bots on an OpenAI model, the conversation and the selected passages to generate a reply.
  • Anthropic - for bots on a Claude model, the conversation and the selected passages to generate a reply.
  • Google - for bots on a Gemini model, the conversation and the selected passages to generate a reply. This is Google's AI service, and it is separate from the Gmail and Drive access described further down, which happens only if you connect those accounts yourself.
  • OpenRouter, which routes to Cohere - the visitor's question and candidate passages, to rank which passages are most relevant. Text only, no account data.

We also use a model to score the sentiment of visitor messages and, once a night, to group similar questions for the "Top questions" report in your dashboard. Both run over conversation text only.

Your account data - names, emails, billing records - is never sent to a model provider.

Training

We do not use your content or your conversations to train any model, and we do not allow anyone else to. The providers listed above do not train on data submitted through their APIs, under the API terms we use them on. Where a provider offers a setting that would permit training, logging or sharing, we leave it off.

Who else we share data with

We use a small number of services to run ReldavaBot. Each receives only what it needs.

  • Hetzner - hosting and object storage in the European Union. Your uploaded files and our database live here.
  • Stripe - subscriptions and payments. Receives your billing details directly from you.
  • Our email provider - delivers account emails such as address confirmation, password reset and invitations.
  • OpenAI, Anthropic, Google, OpenRouter/Cohere - as described in the section above.
  • Telegram, Meta (WhatsApp, Messenger, Instagram) - only for the channels you connect, and only the messages exchanged on that channel.
  • Google, Microsoft, Dropbox - only for the accounts you connect, and only to read what you selected.

We also disclose data where the law requires it: a court order, a lawful request from an authority, or to establish or defend a legal claim. We will tell you when we are allowed to.

Connected accounts

Nothing is read from an outside account until you connect it yourself and grant access on that provider's own consent screen. You can disconnect at any time from Settings, and disconnecting removes the stored credentials.

Google. With your permission we read the files and folders you select in Google Drive, including names, types and modification dates, and messages in the Gmail label you choose, including subject, sender, recipient, timestamps and body text. We read only. We never send, modify or delete anything, and we do not read attachments or contacts. We do not use the Google Picker API.

Microsoft. With your permission we read the OneDrive folders you select and the messages in your Outlook Inbox, on the same read-only basis.

Dropbox. With your permission we read the folders you select.

The chat widget on your site

When you embed a bot on your website, the widget stores a conversation identifier and a session identifier in the visitor's browser using local storage. This is not a cookie, it is not shared across sites, and it carries no advertising identifier - it exists so a visitor who reloads the page does not lose the conversation. The visitor can clear it from the widget itself.

If you embed a bot, you decide what your visitors are told. You are responsible for your own privacy notice covering the chat and any lead form you enable, and for having a lawful basis for the personal data your visitors give you through it.

Cookies

We set three cookies. All are strictly necessary, and none is for advertising or tracking.

  • A session cookie that keeps you signed in. It expires after 30 days.
  • A short-lived cookie that remembers which plan you picked on the marketing site, so we can take you to it after signing up. It expires after 24 hours.
  • A short-lived security cookie used while connecting a Facebook or Instagram account, to protect that flow against cross-site request forgery.

Because we run no analytics and no advertising, there is nothing here for a cookie banner to ask you about.

How long we keep it

We keep your account data and your content for as long as your account exists.

When you delete a source or a bot, it stops being used immediately and is erased permanently, along with the passages extracted from it and the file behind it, after seven days.

When you delete your account, we delete it at once: your profile, your sign-in methods, your sessions, and every organization you own, with its bots, its content, its files, its conversations and its leads. There is no grace period and no way for us to restore it afterwards.

Two things outlive that deletion, and we would rather say so than imply otherwise. Our payment provider's event records, which we keep so that billing history and tax obligations can be reconciled. And our internal administrative log, which records actions our operators take on organizations - a log that a deletion could erase would not be an audit log. Neither contains your content.

Security

Your organization's stored credentials - channel tokens, connected-account tokens - are encrypted with AES-256-GCM before they reach our database, with the key held in the server environment rather than in the database. Traffic to and from the Service uses TLS. Access to production systems is limited to those who need it. Passwords are stored only as hashes and are never recoverable, by you or by us.

No system is perfect. If we ever become aware of a breach affecting your personal data, we will notify you and the competent authority as the law requires.

Your rights in the European Economic Area and the United Kingdom

You have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. You may also lodge a complaint with your national supervisory authority.

Most of these you can exercise yourself: your profile page lets you change your name and password, and delete your account with everything it owns. For anything else, write to [email protected].

We process your account data to perform our contract with you, to meet legal obligations, and for our legitimate interest in keeping the Service running and secure. We process your content on your instructions.

Your rights in the United States

Depending on your state, you may have the right to know what personal information we collect, to obtain a copy of it, to have it deleted, and to correct it. You may also be entitled not to be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising and no analytics, so there is nothing to opt out of.

To exercise any of these rights, write to [email protected].

Where your data is held

Our servers and storage are in the European Union. Some of the providers listed above process data in the United States. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism in the provider's own terms.

Data processing terms

This section applies where we process personal data contained in your content, and forms our data processing agreement with you.

Subject matter and duration. We process your content to provide the Service, for as long as your account exists.

Nature and purpose. Storage, indexing, retrieval, and generation of replies, as described in this policy.

Categories of data and data subjects. Whatever your content contains and whoever your bots' visitors are. You decide both.

Our instructions. We process your content only to provide the Service and as you direct through it, and otherwise only where the law requires, in which case we will tell you unless we are forbidden to.

Confidentiality. Everyone with access is bound to confidentiality.

Security. As described in the "Security" section above.

Sub-processors. The providers listed under "Who else we share data with" act as our sub-processors. You authorise them. If we add or replace one, we will update this policy before the change takes effect; if you object, you may stop using the affected feature or close your account.

Assistance. We will help you, so far as we reasonably can, to respond to requests from individuals, and to meet your own obligations on security, breach notification and impact assessments.

Deletion. On account deletion your content is erased as described under "How long we keep it".

Information. On request we will provide the information reasonably needed to show that we meet these terms.

Marketing

Today we send only messages the Service needs to send: confirming your address, resetting your password, inviting you to an organization, and answering you when you write to us. We do not run a newsletter and we do not send offers.

If we ever start, it will be with your consent where consent is required, and every such message will carry a one-click unsubscribe. Unsubscribing will never stop the account messages above.

Children

The Service is for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, write to [email protected] and we will remove it.

Do Not Track

We do not track you across websites, so a Do Not Track signal changes nothing about what we do.

Changes to this policy

We will update this page when our practices change, and the date at the top will say when. If a change materially affects your rights, we will tell you by email before it takes effect.

Contact

Reldava Tech - [email protected].