Privacy policy

1. Who operates the service

Nothing But Bots is a Pegrio LLC product. This policy describes information used by our storefront, accounts, and website assistant service. Nothing But Bots handles purchases and local accounts; the Pegrio customer portal manages assistant setup, conversations, usage, and recurring billing.

2. Information we handle

• Account and purchase details: your name, email, password hash, email-verification state, order, selected plan, payment references, and service status.
• Business content: information you submit for setup, such as services, hours, FAQs, website address, contact routes, and appearance preferences.
• Visitor conversations: questions, assistant replies, conversation identifiers, and contact details a visitor chooses to share. The business operating that website can review its conversations and leads.
• Technical information: usage counts, errors, security events, and request information. Hosting, network, and security providers may process IP addresses and other connection details. Our account rate limits use keyed hashes rather than raw email addresses or IP addresses.
• Support communications: information you send us to resolve an account, service, billing, or privacy request.

Do not put passwords, full card numbers, health records, or other sensitive information into a chat or knowledge base. This service is intended for ordinary business inquiries.

3. Why we use it

We use this information to verify accounts, deliver and maintain assistants, answer visitor questions, pass inquiries to the relevant business, process payments, enforce usage limits, investigate problems, prevent abuse, and communicate about your service. We may review relevant conversations when providing support or correcting assistant behavior.

4. Cookies, browser storage, and analytics

• Signing in to NBB uses an essential session cookie. It normally expires after 30 days and is revoked when you sign out or change your password. Pegrio manages its own sign-in session.
• We may use short-lived experiment cookies to keep page variants consistent. These last up to seven days.
• The checkout uses browser session storage to remember an attempt and prevent accidental duplicate requests. It stores an opaque identifier and a fingerprint of the selection, not your raw contact details.
• Assistant widgets may use browser storage to keep conversation continuity.
• When enabled, Plausible measures page views and product interactions. Our custom events are designed to exclude names, email addresses, passwords, and account tokens. Blocking analytics does not prevent use of the service.

You can manage cookies and site storage in your browser. Removing essential storage may sign you out or remove checkout retry information.

5. Service providers and sharing

We do not sell personal information. We share information as needed to operate the service with:

• Stripe, for checkout, payment processing, invoices, and subscriptions. Card entry happens through Stripe; our systems retain payment references and status, not your full card number.
• Resend, for account verification, sign-in or recovery links, and service emails.
• Hosting, database, network, and security providers, to run and protect the storefront and Pegrio runtime.
• AI providers, to process relevant business context and visitor messages and generate replies. Their processing and retention also depend on the provider and service configuration; we do not promise that providers never retain data.
• Plausible, when configured, for website analytics.
• The business a visitor contacts, which receives that business’s conversations and submitted lead details.

Information may also be disclosed where required by law or needed to protect the service and its users. Providers may process information in countries other than your own. Contact us if you need information about the providers relevant to your account.

6. Retention and deletion

We retain account, order, conversation, and service records for operating the service, providing support, preventing abuse, and meeting recordkeeping obligations. Cancellation does not automatically delete these records. We do not promise a fixed automatic deletion period for all conversations or accounts.

Account setup and recovery links expire after one hour and can be used once. Queued account emails are encrypted, then their message content is cleared after successful delivery or expiry processing. Short operational records may remain for troubleshooting.

You may request deletion. We verify the request and explain any records that must be retained for billing, legal, fraud-prevention, or other legitimate needs. Backup and provider retention may differ from the live service.

7. Access, correction, and privacy requests

Contact pegriollc@gmail.com to request access, correction, export, or deletion of your information, or to ask about privacy. We may need to verify your identity. We handle requests within the time required by applicable law.

If you chatted with an assistant on another business’s website, that business controls the use of its inquiries and should usually be your first contact. Its own privacy notice also applies.

8. Security and changes

We use access controls, password hashing, protected session cookies, and encryption for sensitive queued account messages. No system can guarantee absolute security. Notify us if you suspect unauthorized access, and never share an account link or password with support.

We may update this policy as the service changes. Material changes will be communicated to active customers by email, and this page shows the latest revision date.

9. Contact

Pegrio LLC · Nothing But Bots
pegriollc@gmail.com