Who we are
The data controller is ECHOSYSTEM-MOTHER AGENCY, Serbia (“we” or “BizzBot”). Under the name BizzBot we offer chat bots for websites and run the website bizzbot.rs.
For any privacy question, contact us here:
- Email: info@bizzbot.rs
- Phone or Viber: +381 63 131 4309
Our roles: controller and processor
What we are in relation to your data depends on where you left it.
We are the controller
We decide why and how the data is used when it comes to:
- the website bizzbot.rs and its security,
- the contact form and other direct communication with us,
- the newsletter sign-up,
- our clients’ accounts (registration, login, dashboard).
We are the processor
When you talk to a bot on one of our clients’ websites, that client is the controller and we are the processor: we store and process the conversation on the client’s instructions and only so the bot can work. The client decides whether a bot exists on its website and, in its own privacy policy, must also describe the chat bot. A data processing agreement is available to clients on request.
What data we handle, why and on what basis
The legal basis is the reason we are allowed to process the data. We rely on the Serbian Law on Personal Data Protection (“Official Gazette of RS”, no. 87/2018) and, where it applies, the EU General Data Protection Regulation (GDPR).
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting bizzbot.rs | IP address, time, requested page and browser details in the technical logs of our hosting provider. The provider derives an approximate country from the IP address; we use it only to choose Serbian or English and we do not store it. | Showing the site, security, correct operation, choosing the language. | Legitimate interest (security and operation of the site). |
| Contact form | Name, email, message text and the time of sending. To protect against spam we also keep a hash (an unreadable fingerprint) of your IP address with a daily counter, without your name or message text. | To reply to you and prepare an offer; protecting the form from abuse. | Steps at your request before entering a contract; legitimate interest (abuse prevention). |
| Newsletter | Email address and the time of sign-up. | Sending news about bots and website tips. | Your consent, which you can withdraw at any time. |
| Client account | Company name, email, password (kept by Firebase Authentication in hashed form; we cannot see it), plan, account status, creation date and bot settings. Images you upload as a bot avatar are stored in our database (shrunk to 256 × 256 pixels) and can be read publicly at their own address, so anyone who sees the chat widget can see them. For self-service registration we also keep a hash of the network address with a daily counter, to limit mass creation of accounts. | Creating and running accounts, operating the dashboard and bots, protecting against mass registration. | Performance of a contract; legitimate interest (abuse prevention). |
| Direct communication | Contact details and the content of the message or call (email, phone, Viber) you leave us. If you write to us on Viber, Viber’s terms apply too. | Answering your enquiry and support. | Steps at your request; legitimate interest. |
| Chat bot on a client’s website | See section 4. | Running the bot on the client’s instructions. | The legal basis is set by the client as controller; we act as processor. |
We do not use data for advertising, we do not build marketing profiles and we do not make decisions that have legal effect on you. Enquiries and newsletter addresses are visible only to the agency’s administrators.
Conversations with the chat bot
This section applies if you talk to a bot that runs on the website of one of our clients.
What is stored
- the text of your messages (at most 500 characters each) and of the bot’s replies, with the time;
- your first and last name, only if the client asks for them before the conversation and you enter them;
- a random conversation identifier (new every time the page is opened) and a random device identifier kept in your browser;
- your IP address;
- the date and time of the conversation.
Do not enter health data, card numbers, passwords, national ID numbers or other sensitive data in the chat. The bot does not need them, and the conversation is stored.
Who sees the conversation
The website owner (our client) in its dashboard, and we do, for support and abuse prevention. Other clients cannot see anyone else’s conversations.
Abuse protection
To keep the bot available to everyone, bots with AI replies have limits:
- at most 10 messages per day for one device and IP address;
- anyone who reaches that limit three days in a row, or sends the same message 10 times in a row, is blocked automatically.
For this we keep the device identifier, the IP address, the number of messages per day (for the last three days), the text of the last message (up to 500 characters) and the block status. The website owner or we can lift the block. Bots with ready-made answers (buttons) do not keep these counters.
Artificial intelligence
When a bot with AI replies needs to answer, we send the AI model provider, Anthropic:
- your messages from the current conversation (up to the last 20);
- the bot’s instructions;
- if the bot has been taught the content of the website, the parts of the client’s website text that are most similar to your question. They are found by Voyage AI, to which we send your latest message.
We do not send your name, IP address or device identifier to the AI providers. Replies are written by a machine and can be wrong.
How long
A conversation is deleted automatically and permanently 90 days after it started. The website owner or we can erase the message text earlier; the record with the date and technical details then stays until day 90. If you want your conversation deleted, contact the website owner or us, and when the request is justified we will also remove the record manually. All retention periods are in section 7.
Artificial intelligence and other service providers
We do not pass data to anyone except service providers without whom the site and the bots would not work. They process the data on our instructions. These are all the ones we currently use:
| Provider | What it is for | Data it handles | Where |
|---|---|---|---|
| Google (Firebase) | Database (avatar images are kept in it too), account login; sending the new-password email. | Everything we store: enquiries, newsletter addresses, accounts, conversations, bot settings; the email address when you reset a password. | The database is in the European Union. Google is a US company, see section 6. |
| Vercel | Hosting of the site and server functions. | All traffic to the site: IP address and the content of requests (forms, chat messages) while they pass through the server; technical logs. | USA (server functions run in the US). |
| Anthropic | The AI model that writes the bot’s replies. | Messages from the current conversation, the bot’s instructions, parts of the client’s website text. | USA. |
| Voyage AI | Turning text into numeric vectors so the website content can be searched. | Text from the client’s website (when learning its content) and your latest message to the bot. | USA. |
This site does not use analytics, advertising or social media services, and none of them is loaded in your browser. If we add a new provider that handles personal data, we will update this policy.
Transfers of data abroad
The database is in the European Union, but Vercel, Anthropic and Voyage AI operate in the US, and Google is also a US company. So your data, for example a message you send to a bot, may be processed in the US.
As the safeguard for such transfers we rely on standard contractual clauses, which are part of the data processing terms (DPA) these providers publish. We do not claim that they hold any particular certification. You can read the details in their privacy policies (links in the previous section) or ask us at info@bizzbot.rs.
How long we keep data
| Data | How long |
|---|---|
| Contact-form enquiries | As long as needed to reply to you and handle a possible collaboration, or until you ask for deletion. When we remove an enquiry from the dashboard it stays in the trash for 30 days and is then permanently deleted. |
| Newsletter addresses | Until you unsubscribe or ask for deletion. After removal they stay in the trash for 30 days and are then permanently deleted. |
| Client accounts | As long as the account exists. A deleted account stays in the trash for 30 days (it can be restored) and then the login account, bots (with the website text they learned), conversations, visitor records, uploaded avatar images and the saved AI key are permanently deleted. Technical usage counters may remain: they contain no visitor data. A copy of an avatar image may stay for a while in the temporary cache (CDN) of our content delivery network. |
| Conversations with a bot | 90 days from the start of the conversation, then automatic permanent deletion (once a day). |
| Visitor records of a bot (abuse protection) | 90 days after the visitor's last message, then they are deleted automatically. The exception is a visitor who is currently blocked: that record stays until the block is lifted, because deleting it would silently unblock the visitor. A record holds the device identifier, IP address, counters for the last three days, the text of the last message (up to 500 characters) and the block status. |
| Form and registration protection (hash of network address and daily counter) | The record keeps counters for the last 7 days. It holds no name, email or message text, and the record itself has no automatic deletion period. |
| Technical logs of the hosting provider | A short time, according to the provider’s rules. |
| Data we are legally required to keep (e.g. accounting documents) | As long as the law requires. |
After deletion, copies may briefly remain in the service providers’ systems until they are overwritten, according to their rules.
How we protect data
- The site and the API run over HTTPS.
- The AI key is kept only on the server and never reaches the chat widget or your browser. It is available to the server and to the agency’s administrators.
- A bot works only on the domains the client has approved.
- Access is role-based: a client sees only its own bots and conversations, and only the agency’s administrators see all data. The database rules enforce this on the server.
- Enquiries, conversations and visitor records can be written only through our servers, not directly from a browser.
- Abuse limits: messages per visitor, daily limits per bot, limits for the contact form and registration, and hidden fields that stop automated bots.
- We cannot see passwords; Firebase Authentication keeps them in hashed form.
- We treat visitors’ messages as data, not as instructions for the AI, which makes it harder to abuse the bot.
- Google encrypts the data in the database and in transit.
No system is completely secure. If a data breach occurs that could harm you, we will notify the Commissioner and you within the deadlines set by law.
Your rights
You can ask for:
- access: to find out whether we handle your data and to get a copy;
- correction of inaccurate data;
- erasure of data;
- restriction of processing;
- portability: to receive the data you gave us in a common, machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent, for example unsubscribing from the newsletter. Withdrawal does not affect processing before it.
Write to info@bizzbot.rs. We reply without delay and at the latest within 30 days. We may ask you to confirm who you are. A request is free of charge unless it is manifestly unfounded or excessive.
For conversations with a bot on a client’s website, contact the website owner first, because the owner decides about that data and we help the owner fulfil the request. You can also write to us.
We do not use automated decision-making that has legal effect on you. The only automatic measure is the abuse block described in section 4, which a person can lift.
Children
The site, accounts and newsletter are intended for business users, not for people under 16. We do not knowingly collect children’s data. If you think a child has sent us data, tell us and we will delete it. Chat bots on clients’ websites are available to all visitors of those websites, and the client is responsible for their purpose.
Changes to this policy
When something important changes, for example a new service provider or a new kind of data, we will update this page and the date at its top.
Contact and complaints
Questions, requests and objections: info@bizzbot.rs, phone or Viber +381 63 131 4309.
If you believe we process your data contrary to the law, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of Serbia (poverenik.rs). If you live in the EU, you can also contact the competent authority in your country. You can lodge a complaint without contacting us first.
This policy is published by ECHOSYSTEM-MOTHER AGENCY.