Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how SiriusLabs Solutions Private Limited, which operates the brand "Botosynthesis" ("Botosynthesis", "we", "us", "our"), collects, uses, shares and protects personal data when you use our Services. Please read it together with our Terms and Conditions (the "Terms").

1. Who we are

SiriusLabs Solutions Private Limited, Door No. 268, Ward No. 13, Surya Mandir K Pass, Pragati Nagar, Banswara, Rajasthan 327001, India.

Email: hi@botosynthesis.com

2. What this Privacy Policy covers

This Privacy Policy applies to our "Services", which means:

• our website at botosynthesis.ai;
• our platform at app.botosynthesis.ai;
• our mobile app (available on the Enterprise plan only); and
• our related APIs.

Botosynthesis is a no-code platform for building chatbots and AI agents for WhatsApp, Instagram, Messenger, Telegram and website chat widgets, with an omnichannel inbox and CRM. This Privacy Policy does not cover websites, apps or services run by other companies, even if you reach them through our Services.

3. Our role: Data Fiduciary and Data Processor

We play two different roles, depending on whose data it is:

• Our customers' account, billing and website data. For data about people who visit our website, sign up for or use our Services, or contact us, we decide how and why the data is used. We are the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023, the "DPDP Act") or "controller" (under the GDPR, where it applies).
• End users' data. Our customers are businesses that use Botosynthesis to talk to their own contacts ("end users"). When an end user chats with a bot or agent built on Botosynthesis, we process that person's data on behalf of our customer. The customer is the Data Fiduciary (controller) and we are the Data Processor (processor). We process this data only to provide the Services to the customer and according to the customer's instructions.

If you are an end user who chatted with a business through a Botosynthesis-powered bot, please contact that business with any questions or requests about your data. If you contact us, we will pass your request to the relevant customer where we can.

4. Information we collect

4.1 Information you give us

• Account information: your name, email address, phone number, business name, password or other login details, and account settings.
• Billing information: billing name and address, GST details and payment records. Payments are processed by Razorpay; we do not store full card numbers.
• Channel and configuration information: details of the channels you connect (such as WhatsApp Business numbers, Instagram accounts, Facebook Pages, Telegram bots and websites), the chatbots and AI agents you build, your templates, flows and settings.
• AI provider API keys that you add to the platform (see section 7).
• Communications: messages you send us, such as support requests and feedback.

4.2 End-user data we process for our customers

When an end user interacts with a customer's bot, the Services process, on the customer's behalf, data such as the end user's name, phone number or username, profile picture, messages and attachments, conversation metadata (such as time stamps and channel), CRM fields the customer records, and prompts and responses exchanged with the customer's chosen AI provider.

4.3 Information collected automatically

When you use our website or platform, our servers and tools automatically record information such as your IP address, approximate location derived from it, device and browser type, pages or features you use, and dates and times of access. We also use cookies and similar technologies (see section 9).

5. How we use information and our lawful basis

Purpose	Lawful basis
Creating and running your account, providing the Services, customer support	Performance of our contract with you (the Terms); legitimate uses under the DPDP Act
Billing, invoicing, GST and accounting	Contract; compliance with legal obligations
Processing end-user data for our customers	On the customer's instructions, as their Data Processor
Keeping the Services secure, preventing fraud and misuse	Legitimate interests / legitimate uses; legal obligations
Improving the Services using usage information	Legitimate interests
Website analytics through Google Analytics 4	Your consent, where the law requires it
Marketing emails about our products	Your consent, which you can withdraw at any time
Complying with law, court orders and lawful requests	Legal obligations

Where we rely on your consent, we ask for it separately and you can withdraw it at any time by emailing hi@botosynthesis.com or using the unsubscribe link in our emails. Withdrawing consent does not affect processing that took place before.

We do not sell your personal data. We do not use customer data or end-user data to train AI models.

6. WhatsApp, Instagram, Messenger, Telegram and website widget

• WhatsApp: customers connect their own WhatsApp Business account through the official WhatsApp Cloud API provided by Meta. Messages sent and received through WhatsApp are also processed by Meta under Meta's own terms and privacy policy. Meta bills WhatsApp message fees directly to the customer; Botosynthesis adds no markup.
• Instagram and Messenger: messages are processed by Meta under Meta's terms and privacy policy.
• Telegram: messages are processed by Telegram under Telegram's terms and privacy policy.
• Website widget: conversations through the chat widget on a customer's website are processed by us on behalf of that customer.

We are not responsible for how Meta, Telegram or other platform providers handle data under their own policies.

7. AI providers (bring your own key)

Customers connect their own API keys for AI providers such as OpenAI, Google Gemini, Anthropic Claude, xAI and DeepSeek. When a bot or agent uses AI, the relevant prompts and conversation content are sent to the provider the customer chose, under the customer's own agreement with that provider. Some providers may process data outside India (for example, DeepSeek may process data in China). Customers should review their chosen provider's terms and privacy policy. We protect stored API keys with reasonable security safeguards and use them only to provide the Services. We do not use customer or end-user data to train AI models.

8. Who we share information with

We share personal data only as described here:

• Service providers that help us run the Services, who may use the data only to provide their services to us. These include:

Provider	Purpose
Hostinger	Website and platform hosting
Google (Google Analytics 4 via Site Kit)	Website analytics
Meta (WhatsApp Cloud API, Instagram, Messenger)	Messaging channels connected by customers
Telegram	Messaging channel connected by customers
AI provider chosen by each customer (OpenAI, Google, Anthropic, xAI or DeepSeek)	AI responses, under the customer's own account
Razorpay	Processing payments
Service providers that help us send emails	Sending account and service emails

• Our customers: end-user data processed through a customer's bots is available to that customer.
• Legal and safety reasons: where we believe it is necessary to comply with law, a court order or a lawful request from authorities; to enforce the Terms; or to protect the rights, property or safety of SiriusLabs Solutions Private Limited, our employees, our users or others.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner, who will be bound by this Privacy Policy or by terms that protect it at least as well.
• Aggregated or de-identified data that cannot reasonably identify you, for example statistics about how the Services are used.

9. Cookies and analytics

We use:

• Essential cookies that are needed for the website and platform to work (for example, to keep you logged in).
• Analytics cookies from Google Analytics 4, which we use through Google Site Kit, to understand how visitors use our website. Google Analytics is provided by Google LLC (and, for users in the EU/UK, Google Ireland Limited). Where the law requires it, we use analytics cookies only with your consent.

We do not use cookies to track you across other websites for advertising. You can learn how Google uses data at https://policies.google.com/technologies/partners-sites and opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout. You can also block or delete cookies in your browser settings, although some features may then not work.

10. International transfers

We are based in India, and some of our service providers (including Google, Meta, Telegram and AI providers) may process data in other countries. Such transfers are made as permitted under the DPDP Act. Where the GDPR or UK GDPR applies, we rely on appropriate safeguards recognised by those laws, such as Standard Contractual Clauses.

11. How long we keep information

We keep personal data only as long as needed to provide the Services and for the purposes described in this Privacy Policy, or as required by law. For example:

• Account data: while your account is active, and for a reasonable period afterwards to deal with any remaining questions, unless you ask us to delete it sooner.
• End-user conversation data: as long as the customer keeps it on the platform or as the customer instructs, and deleted after the customer's account closes, subject to legal requirements.
• Billing and tax records: for the period required by Indian tax and accounting laws.
• Server logs: as long as needed for security and troubleshooting.

When data is no longer needed, we delete it or make it anonymous.

12. How we protect information

We use reasonable security safeguards to protect personal data, including encryption of data in transit (HTTPS/TLS) and access controls. Your account is protected by your login credentials. Please keep them confidential and tell us at once at hi@botosynthesis.com if you suspect unauthorised access. No system is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will notify affected customers, the Data Protection Board of India and other authorities as required by applicable law.

13. Your rights

Under the DPDP Act (India), you have the right to:

• get a summary of the personal data we process about you and how we process it;
• ask us to correct, complete, update or erase your personal data;
• withdraw consent you have given;
• have your grievances addressed by our Grievance Officer (section 15);
• nominate another person to exercise your rights if you die or become unable to do so; and
• complain to the Data Protection Board of India if you are not satisfied with our response.

If the GDPR or UK GDPR applies to you, you also have the right to access, rectify, erase, restrict or object to processing of your data, to data portability, and to complain to your local data protection supervisory authority.

To exercise your rights, email hi@botosynthesis.com. We may need to verify your identity first. You can also delete your account from within the platform or by emailing us. End users of a customer's bot should send requests to the business that runs the bot.

14. Children

Our Services are for businesses and for users aged 18 or over. We do not knowingly collect personal data of children (under 18 in India, or under the age set by local law elsewhere). If you believe a child has given us personal data, contact hi@botosynthesis.com and we will delete it. See also our Terms.

15. Grievance Officer

In line with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, our Grievance Officer is:

• Name: Kalapana Saini
• Email: hi@botosynthesis.com
• Address: SiriusLabs Solutions Private Limited, Door No. 268, Ward No. 13, Surya Mandir K Pass, Pragati Nagar, Banswara, Rajasthan 327001, India

We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days of receiving it.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date at the top of this page. For material changes, we will notify you by email or in the platform before they take effect and, where the law requires it, ask for your consent again.

17. Contact us

For questions about this Privacy Policy, email hi@botosynthesis.com or write to SiriusLabs Solutions Private Limited, Door No. 268, Ward No. 13, Surya Mandir K Pass, Pragati Nagar, Banswara, Rajasthan 327001, India.