Privacy Notice for the Chat Widget

This notice applies to your interaction with the botts.ai chat widget when it is embedded on a customer's website. For your visit to the botts.ai website itself, our general privacy policy applies.

1. Roles: Who is responsible for what?

When you interact with the chat widget on a customer website, the roles are as follows:

• Controller within the meaning of GDPR Art. 4(7) and Swiss FADP Art. 5(j) is the operator of the website on which the widget is embedded. They decide on the purpose and means of the data processing in the chat and are your primary point of contact for data protection matters. You will find their contact details in the imprint or in the privacy policy of that website.
• Processor is botts.ai gmbh, Neugasse 15, 6300 Zug, Switzerland (info@botts.ai). We operate the chat's technical infrastructure on behalf of the website operator and on the basis of a Data Processing Agreement (DPA).

2. What data is processed in the chat?

When you use the chat widget, we process:

• Chat content: the messages you enter and the responses generated by the chatbot.
• Conversation metadata: a randomly generated conversation ID, timestamps and, where applicable, a device identifier.
• Technical connection data: IP address and browser information, to the extent required for establishing the connection and abuse prevention. The IP address is not permanently linked to your chat content in storage.
• Optional input: if you voluntarily enter a name, e-mail address, phone number or other personal data in the chat, this is processed as part of the conversation log.

You do not have to provide any personal data in order to use the widget.

3. Where does the data go?

• Switzerland First (default): By default, all chat data remains exclusively within Switzerland. The language models (LLM) and databases are hosted by our Swiss partner Infomaniak (ISO-certified). No transfer to third countries takes place.
• Optional: international providers: The website operator can enable more powerful models from international providers in their bot settings. In that case, your chat content is transmitted to OpenAI (USA) or Anthropic (USA, via Microsoft Azure AI Foundry). Both providers are contractually committed to a Zero Training Policy — your data is not used to train their models.
• No sale to third parties: We do not sell or rent your data and do not share it for advertising purposes.

The website operator can tell you on request which models the specific bot uses.

4. Conversation storage in your browser

So that you can continue an ongoing conversation after a page reload, the widget stores a conversation ID in your browser's localStorage — as first-party storage of the website on which the widget runs (not of botts.ai). This entry contains no chat content, only a technical identifier. You can delete it at any time via your browser settings; in that case the conversation will start fresh.

The widget sets no tracking cookies and performs no cross-site tracking.

5. Retention

The retention period for chat logs is set by the website operator as controller and is part of their own privacy policy. botts.ai stores the data technically only for as long as the operator has configured or as is required to provide the service. Server logs are typically deleted within a few days.

6. Sub-processors

In the context of the chat widget, we use the following sub-processors:

• Infomaniak (Switzerland) — hosting, database, object storage and Swiss AI models.
• Microsoft Azure (Switzerland / EU / USA) — OpenAI and Anthropic models (only when enabled by the operator).
• Anthropic (USA, via Microsoft Azure Foundry) — language models (Claude, only when enabled by the operator).
• OpenAI (USA) — GPT-family language models (only when enabled by the operator).

A complete and continuously updated list of our sub-processors can be found in our general privacy policy.

7. Your rights

Under the GDPR and the Swiss FADP, you have in particular the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to lodge a complaint with a supervisory authority

Because the website operator is the controller and decides about your chat data, please direct access, rectification, erasure and objection requests primarily to them. If that is not possible or you wish to contact us directly as processor, you can reach us at info@botts.ai; we will forward your request to the responsible controller and support them in handling it.

8. Data Processing Agreement (DPA)

For our business customers, we provide a standardised Data Processing Agreement (DPA) which contractually governs compliance with the FADP and the GDPR. Business customers can request it at info@botts.ai.

9. Currentness and amendment of this notice

Due to the further development of our services or changed legal requirements, an amendment of this notice may become necessary. The current version is available at https://botts.ai/widget-privacy.

Dated May 2026.

In the case of translations of this notice into other languages, the German version is legally authoritative in case of doubt.