Privacy policy

1. Who we are

LolliBot DM, operated by kirlos demyan llc, Wyoming, USA, is the provider of LolliBot DM and the party responsible for the processing described in this policy. We operate the Service using software and infrastructure licensed from a specialist platform provider established in the European Union, which acts on our instructions as our processor.

2. Our role: controller or processor

For the data we hold about our customers (account holders, their team members, billing and support contacts) we are the controller: we decide why and how it is processed, as described in this policy.

For the contacts, messages and other content that a customer processes through the Service ("Customer Data"), the customer is the controller and we are the processor. We process that data only on the customer's instructions, under the Data Processing Agreement at https://dm.lollibot.app/legal/dpa. If you are an end user who messaged a business that uses LolliBot DM, that business is responsible for your data and its own privacy notice applies. We will pass on any request you send us to that business where we can identify it.

3. What we collect

Account data

• Name, business name, email address, phone number, password (stored hashed), language and profile settings.
• Billing details, plan, invoices and payment status. Card and bank details are handled by our payment processor; we do not store full card numbers.
• Support requests and the correspondence around them.

Customer Data (processed on the customer's behalf)

• Contact records: names, phone numbers, email addresses, messaging identifiers, tags, notes and custom fields.
• Messages and attachments exchanged over the connected channels, including text, images, audio, video and documents, and the AI-generated replies sent from the account.
• Agent configuration: instructions, knowledge sources, FAQs and uploaded files used to generate replies.
• Appointments, deals, tasks and other records the customer keeps in the Service.
• Credentials and tokens for third-party accounts the customer connects, stored encrypted.

Technical data

• IP address, browser and device type, timestamps, pages and features used, error reports, and security logs.
• Essential cookies and local storage needed to keep you signed in and remember your preferences. We do not use advertising cookies on the Service.

4. Why we use it

• To provide the Service: deliver and receive messages, generate AI replies, run automations, book appointments and keep your records.
• To manage your account, billing and support.
• To keep the Service secure, prevent abuse and enforce our Terms of Service and the policies of the messaging channels.
• To improve the Service using aggregated, de-identified usage statistics.
• To send service messages such as security alerts, billing notices and changes to our terms. Marketing emails are sent only where allowed and always with an unsubscribe link.
• To comply with legal obligations and to establish, exercise or defend legal claims.

5. AI processing

When an AI agent replies, the relevant message content, conversation history and agent instructions are sent to an AI provider to generate the reply. Some AI providers are established in the United States; Section 8 explains how those transfers are protected. AI providers process content under commercial API terms that prohibit using it to train their models, and we do not train AI models on Customer Data.

AI-generated content can be inaccurate. Customers are responsible for how their agents are configured and for the messages sent from their account.

6. Legal bases

Where the GDPR or a similar law applies, we rely on the following legal bases for processing as a controller:

• Performance of a contract: providing the Service you signed up for, billing and support.
• Legitimate interests: securing the Service, preventing fraud and abuse, improving the product, and communicating with business contacts, balanced against your rights.
• Legal obligation: tax, accounting and regulatory requirements, and responding to lawful requests from authorities.
• Consent: where we ask for it, for example for optional marketing. You can withdraw consent at any time.

Where we act as a processor, the customer's legal basis applies to the Customer Data it processes through the Service.

7. Who we share data with

We share personal data only with the parties needed to run the Service, under contracts that require them to protect it:

• The platform provider: the software company that builds and operates the platform we resell to you, established in the European Union, which hosts the service on dedicated servers in Germany and holds its own written data processing terms with us.
• Messaging channel providers that carry your messages, such as Meta Platforms (WhatsApp Business, Instagram, Messenger) and Twilio (WhatsApp Business API), and any telephony or email carrier behind a channel you connect.
• AI providers that generate replies, summaries, transcriptions and search indexes from message content, some of which are established in the United States. They process content under commercial API terms that do not permit using it to train their models.
• Payment processors that handle subscription and top-up payments.
• Email delivery, error monitoring and content delivery services used to run the platform.

Where a customer connects its own third-party account (for example its own WhatsApp Business account, calendar, CRM, email account or AI API key), data flows to that third party under the customer's own agreement with it.

We may also disclose data where the law requires it, to protect the rights and safety of any person, or in connection with a merger or sale of our business, in which case this policy continues to apply.

We do not sell personal data.

8. International transfers

The Service is hosted on dedicated servers in Germany, and files and backups stay in the European Union. Some providers, in particular AI and messaging providers, process data in the United States or elsewhere outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where UK law applies) or on an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. Details of the safeguards are available from [email protected].

9. How long we keep data

• Account data: for as long as your account exists, and up to 30 days after closure so you can export your data.
• Customer Data: until the customer deletes it. Deleting a contact removes its conversation history from the live Service. Customers can also set contacts to be deleted automatically after a period of inactivity.
• Backups: deleted data leaves backups within 90 days.
• Financial records: for the period required by tax and accounting law.
• Security and server logs: typically up to 12 months.

10. Security

Data is encrypted in transit, backups and stored credentials are encrypted at rest, access is limited to people who need it for their role, and the platform is monitored for errors and suspicious activity. Our data-security page at https://dm.lollibot.app/legal/security describes the measures in more detail. No system is completely secure; if we become aware of a breach affecting your data we will tell you without undue delay.

11. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased, or its processing restricted, in the circumstances the law provides.
• Receive the data you gave us in a portable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where processing is based on it.
• Lodge a complaint with your data-protection authority.

To exercise a right, email [email protected]. We may need to verify your identity first. If you are an end user of a business that uses LolliBot DM, contact that business directly; they control your data, and we will assist them with your request.

12. Children

The Service is for businesses and is not directed at children under 16. We do not knowingly collect personal data from children as a controller. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.

13. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the current version. For material changes we will notify customers by email or in the Service before the change takes effect.

14. Contact

LolliBot DM. Privacy contact: [email protected]. General support: [email protected].