This Privacy Notice explains how fKodeLabs ("we", "us", "our") – the data controller behind Webbot – collects, uses, shares, and protects personal data. Contact: support@fkodelabs.com.
1. Who we are
fKodeLabs (https://www.fkodelabs.com) operates the Webbot platform. For personal data we process on our own behalf (e.g. account data), we act as a data controller. For Customer Data you upload or your end users submit through the widget, we act as a data processor on your instructions.
2. Personal data we collect
- Account data: name, email, password hash, profile image, organisation, role.
- Workspace data: chatbot configuration, knowledge base content, branding, integrations.
- Conversation data: messages exchanged with the assistant, voice transcripts, attachments.
- Lead data: name, email, phone number, custom form fields, source, and conversation context captured through the widget or pre-chat form.
- Usage & telemetry: log entries, IP address (hashed for rate limiting), device/browser info, performance metrics, error reports.
- Support data: emails and messages you send us.
3. How we use personal data
- Provide, operate, and maintain the Service (contract performance).
- Process AI requests through configured providers (contract performance).
- Authenticate users, prevent fraud, abuse, and secure the Service (legitimate interests).
- Send transactional emails (account, billing, security) (contract performance).
- Send product updates or marketing where permitted, with opt-out (consent / legitimate interests).
- Comply with legal obligations (legal obligation).
- Improve and develop new features using aggregated or de-identified data (legitimate interests).
4. Legal bases (UK/EEA users)
We rely on (a) performance of a contract to provide the Service, (b) legitimate interests for security, anti-abuse, analytics, and product improvement, (c) consent where required (e.g. non-essential cookies, marketing), and (d) legal obligation where applicable.
5. Sharing & subprocessors
We share personal data with the following categories of recipients:
- Cloud hosting & database: our infrastructure provider for storage, compute, and authentication.
- AI providers: OpenRouter (chat inference), Mistral (embeddings), Pinecone (vector search), Tavily (web search) — engaged for every AI request. Provider keys you configure yourself are used in place of ours where supported.
- Payments: Dodo Payments, which processes subscription payments (name, email, billing amount, and payment identifiers).
- Email & notifications: our transactional email provider.
- Analytics & error monitoring: tooling used to keep the Service reliable.
- Integrations you enable: webhook endpoints you configure.
- Professional advisers (legal, accounting) and authorities where required by law.
6. International transfers
Personal data may be transferred to and processed in countries outside your own, including the United States and the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
7. Retention
We retain personal data only as long as necessary for the purposes above. Account and workspace data are kept while your account is active and for a reasonable period after closure to handle billing, legal, and audit needs. Conversations and lead data follow the retention controls you configure. Logs and rate-limit counters are retained for a short period for security purposes. We delete or anonymise data when no longer required.
8. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, role-based access controls, server-side tenant checks, secret management, HMAC-signed webhooks, and audit logging. No system is perfectly secure; you are responsible for safeguarding your account credentials and API keys.
9. Your rights
Depending on your jurisdiction, you may have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion or restriction of processing;
- object to processing based on legitimate interests;
- port your data to another service;
- withdraw consent at any time (where processing is based on consent);
- lodge a complaint with your local data protection authority.
To exercise these rights, email support@fkodelabs.com. We aim to respond within 30 days.
10. Cookies
We use a small number of cookies and similar technologies that are strictly necessary to authenticate you and keep your session secure. Where we use analytics or marketing cookies, we will request your consent and provide controls.
11. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
12. Changes
We may update this Privacy Notice from time to time. Material changes will be notified through the Service or by email.
13. Contact
Privacy questions or requests: support@fkodelabs.com.
We answer every email personally.