Privacy Policy

Last updated: April 22, 2026 · Effective: April 22, 2026

Botstrapp.ai ("Service", "we", "us") is operated by Informattach LLC, a New Mexico limited liability company. This Privacy Policy describes how we collect, use, and protect your information when you use our AI gateway and character engine services at botstrapp.ai.

This policy applies only to the botstrapp.ai service. Other services in the Botstrapp ecosystem (Commerce, Finance, News, etc.) maintain their own separate privacy policies.

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, date of birth (for age verification), and authentication credentials when you create an account.
• Payment Information: When you purchase attach credits, payment is processed by Stripe. We do not store your credit card numbers. We receive transaction identifiers and purchase amounts from Stripe.
• Conversation Data: Messages you send to AI models through our gateway. The extent to which we store this data depends on your chosen consent level (see Section 3).
• Character Data: If you use our character engine, information about characters you create or interact with, including personality parameters and conversation history.
• Data Preferences: Your consent choices, communication preferences, language settings, and privacy configuration.

1.2 Information Collected Automatically

• Anonymous Usage Statistics (all consent levels): Model used, provider, response latency, cost, intent category, and quality metrics. This data contains no user identifiers, no IP addresses, no message content, and no session linkage. It is truly anonymous as defined by applicable law.
• Technical Data: IP address (for rate limiting and session security), browser type, and device information as necessary for service operation and security. IP addresses are stored with active sessions and are removed when sessions expire.

1.3 Information We Do NOT Collect

• Biometric data (voiceprints, facial recognition, etc.)
• Precise geolocation
• Data from third-party social media profiles (beyond OAuth authentication)
• Behavioral advertising profiles — we do not serve ads

2. How We Use Your Information

• To Provide the Service: Routing your messages to AI model providers, managing your attach credit balance, and operating the character engine.
• To Improve the Service: Anonymous usage statistics help us optimize model routing, identify performance issues, and improve response quality.
• AI Model Training and Improvement: With your explicit consent (Consent Level 2), anonymized and de-identified conversation data may be used to train and improve our own AI models. See Section 2.1 for details.
• To Ensure Safety: Age verification, content moderation, and crisis detection protocols (see Section 7).
• To Process Payments: Managing attach credit purchases and maintaining transaction records.
• To Communicate: Sending service-related notifications, security alerts, and (with your opt-in) product updates.

2.1 AI Training — Transparency

We believe in full transparency about AI training:

• Consent Level 0 and 1: Your messages are NOT used for AI training. Only anonymous, non-identifiable statistics are collected.
• Consent Level 2: Your conversation data may be used to improve our AI models — but only after anonymization and removal of all personal identifiers. You can opt out of AI training specifically via your Data Preferences without downgrading your consent level.
• Minors (under 18): Data from users under 18 is never used for AI training, regardless of consent level.
• Withdrawal: If you withdraw AI training consent, we will stop using your data for future training. Data that has already been incorporated into trained models cannot be individually extracted, but no new data will be used.

3. Your Consent Levels

We operate a three-tier consent system. You choose your level during registration and may change it at any time in Settings:

• Level 0 — Quick Start (Anonymous): Only truly anonymous statistics are collected (model, latency, cost, intent category). No messages stored, no session linkage. Character engine is disabled at this level.
• Level 1 — Smart Experience: Intent summaries (not raw messages) are stored and linked to your session. Character engine is enabled. Your actual message text is not stored.
• Level 2 — Full Experience: Full message history is stored for personalization. Complete character memory and cross-device sync. Anonymized data may be used for AI model improvement.

Anonymous statistics (model, provider, latency, cost, intent category) are collected at all levels. These contain no user identifiers and cannot reasonably be used to identify any individual.

4. Third-Party AI Providers

When you send a message, we route it to the AI provider that hosts the model you selected. Your message content is transmitted to that provider for real-time processing.

We currently integrate with the following providers (10 direct integrations, 460+ models):

• OpenAI (GPT models)
• Anthropic (Claude models)
• Google (Gemini models)
• Groq (Llama, Mixtral models)
• xAI (Grok models)
• DeepSeek
• Cerebras
• SambaNova
• GitHub Models
• OpenRouter — aggregates 300+ additional models from various sub-providers

Important: Each provider has its own privacy policy and data handling practices. Once your message reaches a provider, their policies govern how they process that data. We cannot control or guarantee how third-party providers handle your data during processing. We recommend reviewing their respective privacy policies. We select providers based on their API terms, but we make no warranties about their internal data practices.

5. Data Retention

• Anonymous Statistics: Retained indefinitely (cannot identify individuals).
• Intent Summaries & Messages: Retained for a reasonable period necessary for service operation, then periodically purged. Message content is replaced with a placeholder upon purging; anonymous metadata is retained.
• Account Information: Retained for the duration of your account. Deleted upon account deletion request.
• Payment Records: Retained for 7 years as required by tax and financial regulations.
• Character Data: Retained for the duration of your account. Deleted upon request.
• Data Preferences: Retained for the duration of your account. Consent history is maintained for compliance purposes.

6. Children's Privacy (COPPA Compliance)

This Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will promptly delete such information.

Users between 13 and 17 years of age must have verifiable parental consent to use the Service. We implement age verification through date of birth collection during registration.

Additional protections for minors (13–17):

• Data is never used for AI model training, regardless of consent level
• Data is not shared with third parties for any purpose beyond service operation
• Behavioral profiles are not created
• No targeted advertising (we do not serve ads to any users)

If you believe your child has used our Service without proper consent, please contact us at privacy@informattach.com.

7. Crisis & Safety Protocols

Our Service includes automated safety monitoring. If conversations indicate potential self-harm or crisis situations, we may:

• Display crisis hotline information appropriate to your region
• Provide referrals to appropriate support resources
• Limit certain conversation patterns for user safety

Safety protocols operate in real-time. At Consent Levels 0 and 1, no conversation content is retained for this purpose. At Level 2, standard retention policies apply.

8. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you.
• Delete: Request deletion of all your data.
• Modify Consent: Change your consent level at any time.
• Portability: Export your data in a machine-readable format.
• Object: Opt out of any data processing beyond what is necessary for service operation.
• AI Training Opt-Out: Withdraw consent for AI training use specifically, without changing your overall consent level.

California Residents (CPRA)

If you are a California resident, you have additional rights under the California Privacy Rights Act (CPRA), including the right to know what categories of personal information are collected, the right to delete, and the right to opt-out of the sale or sharing of personal information. We do not sell or share your personal information.

9. Data Security

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest
• Row-Level Security (RLS) on all database tables
• Encrypted credential storage (Vault) with master key protection
• API key security with brute-force lockout protection
• Regular security audits and vulnerability monitoring
• Input validation and prompt injection protection

10. Payment Processing

Payments are processed by Stripe, Inc. We do not collect, store, or process credit card numbers or financial account details. Stripe's privacy policy governs the handling of your payment information. Stripe is PCI DSS Level 1 certified.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, by email notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about our data practices:

• Email: privacy@informattach.com
• Entity: Informattach LLC (New Mexico, USA)