Privacy Policy

1. Our Role: Controller and Processor

When we process your Pulbot account data (registration, billing, support), we act as the data controller.

When your business connects its channels and we process conversations with YOUR end customers, we act as a data processor: you are the controller of that data, you decide what it is used for, and you are responsible for informing your end customers and obtaining their consent.

Accordingly, if one of your end customers exercises a right (access, rectification, deletion), the request is handled through you; we provide technical assistance.

2. Use of Artificial Intelligence

Pulbot uses artificial intelligence. We state this explicitly so there is no ambiguity.

Platform features that rely on AI models:

• Conversational agents (“AI Agent” and “Code Agent” nodes): they generate natural-language replies to your customers’ messages.
• Automatic conversation classification, tagging, and summaries.
• Transcription of voice notes and audio received through messaging channels.
• Analysis of images sent by customers when the flow requires it (for example, finding a product from a photo).

To deliver these features we send strictly the necessary content to AI model providers: OpenRouter (which in turn routes to providers such as Anthropic and OpenAI), OpenAI, and ElevenLabs. They act as subprocessors and are bound by contractual confidentiality obligations.

We do not train AI models on your data or your customers’ data, and we do not authorize our providers to do so.

Generative AI can produce incorrect, incomplete, or inappropriate output. AI-generated results are provided “as is,” without warranty of accuracy, and do not constitute legal, medical, financial, or professional advice. The business operating the bot is responsible for the content it sends to its customers and must supervise it.

We do not make automated decisions producing legal or similarly significant effects on a person based solely on AI. You can disable any AI node in your flows and run the platform in a purely deterministic mode.

3. Meta Platform Integrations

Pulbot is an authorized integrator of Meta Platforms (WhatsApp Business API, Instagram Graph API, and Messenger Platform). When a business connects its Meta accounts to Pulbot, we process the following data on its behalf, strictly to deliver the messaging automation service:

• WhatsApp Business API: phone numbers, business profile data, message contents, attachments, message status updates, and conversation metadata required to send and receive messages on behalf of the business.
• Instagram Graph API: business account ID, Instagram username, message contents, attachments, comments, and mentions required to operate the inbox and automation flows.
• Messenger Platform: page-scoped user IDs, message contents, attachments, postbacks, and delivery receipts required for conversational automation.
• OAuth tokens and webhook signatures are stored encrypted at rest and used only to authenticate API calls.

We do NOT use Meta Platform data to train AI or machine-learning models. We do NOT sell, rent, or share Meta Platform data with third parties for advertising. We process this data solely to provide the contracted service to the business that owns the connected accounts.

4. What Data We Collect (Privacy Label)

This is the complete list by category, in the format required by the App Store and Google Play:

• Identifiers and contact data: name, email address, phone number, and user ID. Linked to you. Used for app functionality, authentication, and support.
• Business data: legal name, tax ID (RIF), and address. Linked to you. Used for the contract and legal invoicing.
• User content: messages, attachments (images, audio, video, PDF), catalogs, flows, and configurations you create or receive. Linked to you. Used to deliver the service.
• Financial data: payment references and transaction identifiers. Linked to you. Used for billing. We do not store full card numbers; the payment gateway processes them.
• Usage and diagnostic data: flow execution logs, tool consumption, errors, and technical traces. Linked to you. Used for operation, security, and service analytics.
• Connection data: IP address and user agent, from which an approximate country- or city-level location is derived. Linked to you. Used for security and abuse prevention. We do not collect precise (GPS) location.

We do not use any of this data for advertising or cross-app / cross-site tracking, and we do not sell or share it with data brokers.

5. Cookies and Similar Technologies

Our website and application use only strictly necessary cookies and local storage: session, authentication, language preference, and security. We do not use advertising or profiling cookies.

We do not load Google Analytics, the Meta Pixel, or any other third-party tracker on our site. The site includes a Meta domain-verification tag, which collects no visitor data.

When you choose to connect a Meta account, the application loads the Facebook JavaScript SDK to run Embedded Signup. That SDK is loaded only on that screen and at your request; at that point Meta may process data under its own privacy policy.

If we add analytics or advertising tools in the future, we will update this section and, where the law requires it, obtain your consent before enabling them.

6. Providers and Subprocessors

We rely on the following providers to deliver the service, each with access limited to what is strictly necessary:

• Amazon Web Services (AWS): application hosting and file storage (S3).
• MongoDB: platform database.
• OpenRouter, OpenAI, and ElevenLabs: AI models, audio transcription, and speech synthesis.
• Meta Platforms (WhatsApp, Instagram, Messenger) and Telegram: messaging channels.
• Stripe, Binance Pay, and Banco Nacional de Crédito (BNC): payment processing.
• GlitchTip, self-hosted on our own infrastructure: error monitoring and technical traces.

We keep this list current. You can request the version in force at privacy@pulbot.com.

7. How We Use Your Data

• When you register for Pulbot, we collect basic data such as your name, email, and company details (RIF, address) to establish a contract and provide the service.
• We record technical and platform usage data, including interactions with bots, flows, messages, and tool consumption, to operate, optimize, and personalize the experience.
• To process payments, we use external payment providers that collect the information necessary to manage billing and transactions, under their own security standards.
• We do not use your personal data or your customers’ data to train artificial intelligence models, nor do we transfer it to third parties for purposes other than those described in this policy.
• You can delete your account and data through the in-app settings or by contacting us.

8. Data Collected in Different Scenarios

Registration and account management

When creating your account and registering your company, we request basic personal and business data such as name, email, RIF, document type, and address. This is necessary to establish the contract and configure the platform for your company.

Platform use and communication

While using bots, flows, and digital channels (WhatsApp, Instagram, Messenger, Telegram), we collect technical and operational information such as conversation logs, interaction history, messages sent and received, and tool consumption data, to operate the service, optimize flows, and ensure correct functioning.

Billing and payments

To manage digital billing and consumption payments, we collect the data required by current SENIAT regulations, such as billing information and payment references. Payment processing is carried out by authorized external providers, who handle financial information under their own security measures.

Support and customer service

When assistance is required, we may collect additional information to resolve incidents and contact you, always with your consent.

9. Content You Upload or Receive

The platform allows uploading and receiving files: images, audio, video, and PDF documents, whether your own or sent by your customers. They are stored encrypted in AWS S3 and served through time-limited signed links.

You are responsible for the content that you or your customers upload through your account, including copyright and likeness rights in that content. If we detect — or are notified of — illegal or infringing content, we may remove it or block access to it.

The copyright notice-and-takedown procedure (DMCA), including counter-notification, is described in our Terms and Conditions.

10. Where We Store Your Data

Your data is stored on secure servers provided by Amazon Web Services (AWS), in regions selected to comply with applicable data protection regulations.

When data must be transferred outside the country, we apply legal and technical safeguards to protect its confidentiality, integrity, and availability.

11. How Long We Keep Your Data

We keep your data for as long as necessary to provide the service, comply with legal obligations, or resolve disputes. We may anonymize information for internal analysis.

WhatsApp, Instagram, and Messenger message data is retained according to the contractual term agreed with the customer business; on contract termination, message content is deleted within 90 days unless a longer retention period is required by law.

12. Your Rights

You have the right to access, correct, restrict, port, or delete your personal data, and to object to its processing, in accordance with the Venezuelan Personal Data Protection Law and other applicable regulations. To exercise these rights, contact privacy@pulbot.com.

If you are located in the European Economic Area or the United Kingdom, you also have the rights provided by the GDPR, including the right to lodge a complaint with your supervisory authority.

If you are a California resident: we do not sell or share your personal information as those terms are defined by the CCPA and CPRA, and we have not done so in the preceding twelve months. We also do not sell or share the personal information of consumers under 16 years of age.

California residents may exercise their rights to know, delete, correct, and limit the use of sensitive personal information by writing to privacy@pulbot.com, either directly or through an authorized agent. We will not discriminate against you for exercising these rights.

13. Minors

Pulbot is a business product and is not directed to individuals under 18. We do not knowingly collect personal data from children under 13, nor from minors under 16 in jurisdictions where that is the applicable threshold. If we determine that we have received a minor’s data without the required authorization, we delete it. If you believe this has happened, contact privacy@pulbot.com.

14. Security

We encrypt data in transit (TLS) and at rest. Access tokens, connector credentials, and secrets are stored encrypted and are never displayed in plain text after being saved. Internal access is role-restricted and logged.

No system is infallible. If a security breach affecting your personal data occurs, we will notify you without undue delay and inform you of the measures taken.

15. Data Deletion

You can request deletion of your Pulbot account and associated personal data at any time:

• From the app: Settings → Account → Delete account.
• By email: send a request from your registered address to privacy@pulbot.com with the subject “Data deletion request.”
• Detailed instructions: https://www.pulbot.com/data-deletion.

We process deletion requests within 30 days. Some records (e.g., invoices) may be retained for the period required by tax or accounting law and then permanently deleted.

16. Changes to This Policy

We may update this policy. We will publish the version in force on this page with its update date and, where changes are material, notify you by email or in-app at least 15 days before they take effect.

17. Contact

PULBOT SOLUTIONS, C.A. — RIF J-50711756-1 — Caracas, Venezuela.

Privacy: privacy@pulbot.com · Support: soporte@pulbot.com · Legal: legal@pulbot.com · Copyright: dmca@pulbot.com