Privacy policy

Last updated: 7 October 2026

This policy explains which personal data AHB GmbH collects when you visit this website or use Botti, why, who receives it, and how long we keep it. It is written for the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

AHB GmbH, TODO Street 1, TODO TODO, Switzerland, is responsible for the processing described here.

For anything about your data, write to [email protected] or to the postal address above.

2. Two roles: your account, and your customers' reviews

• Data about you — your account, your Google connection, your billing, your visits to this website. We decide how this is used, so this policy covers it.
• Data inside the reviews — the names and words of the people who review your business. We process these on your behalf, to show you reviews and draft replies. For that data you are responsible, and our data processing agreement governs what we may do with it. This policy still explains how we handle it in section 5.

3. What we collect

When you visit this website

• Server logs: IP address, date and time, the page requested, browser and operating system. We need these to deliver the website and keep it secure.
• Cookies: only the ones the website needs to work — see section 8. We do not use advertising or tracking cookies.

When you create an account and connect Google

• Account data: your name, email address, the business you work for, and your role (for example owner or location manager).
• Google account data: the name and email address of the Google account you connect, and the access tokens Google gives us. We store tokens encrypted.
• Google Business Profile data: your business locations and their details, the reviews they have received, and existing replies.
• Your settings and edits: tone, sign-off, the things Botti must never promise, your publishing rules, and the edits you make to drafts.
• Activity records: who approved, edited or published which reply, and when. The audit trail is part of the product.

When you pay

• Billing data: company name, billing address, VAT number, plan and invoices. Card details go directly to our payment provider; we never see or store full card numbers.

When you contact us

• The content of your message and your contact details, to answer you.

4. Why we use it

• To provide Botti: import your locations and reviews, draft replies, publish the replies you or your rules approve, and produce reports.
• To run your account and billing, and to send you service emails (for example the monthly report, invoices and security notices).
• To keep the service secure, prevent abuse and fix errors.
• To answer your questions.
• To meet legal obligations, such as keeping accounting records.

We do not sell personal data. We do not use your data or your reviews for advertising, and we do not use them to train AI models — neither our own nor anyone else's.

If the GDPR applies to you, our legal bases are: performing our contract with you (Art. 6(1)(b)), our legitimate interest in running a secure, working service (Art. 6(1)(f)), legal obligations (Art. 6(1)(c)), and your consent where we ask for it (Art. 6(1)(a)).

5. Data from Google and AI drafting

Botti only accesses Google data after you connect your Google account and grant permission. Data & permissions explains exactly what we ask for, in plain words.

• We use Google data only to show you your locations and reviews, draft replies, publish replies you have approved, and build your reports.
• To draft a reply, we send the text of the review, the reviewer's first name as shown on Google, and your voice settings to our AI provider (see section 6). The provider processes this to return a draft and does not use it to train its models.
• We do not transfer Google data to anyone else, except the service providers listed in section 6 that we need to run Botti, when required by law, or as part of a merger or acquisition with notice to you.
• People at AHB GmbH do not read your Google data, except with your explicit permission (for example when you ask for support), when needed for security, or when required by law.

Botti's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who receives data

We use service providers who process data for us under contract. They may only use it to provide their service to us.

We may also disclose data to authorities or courts where the law requires it.

7. Data outside Switzerland

Your account and reviews are stored in the European Union. Some providers above process data in the USA, notably Google and our AI provider when drafting a reply.

Where a country does not have data protection recognised as adequate by Switzerland (or the EU), we rely on the Swiss-U.S. Data Privacy Framework for certified recipients, or on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission.

8. Cookies

These cookies are necessary for the website to work, so we do not ask for consent. If we ever add analytics or other optional cookies, we will ask first.

9. How long we keep data

• Account, Google data, settings and drafts: for as long as your account is active. After you cancel, we delete them within 30 days.
• Google access tokens: deleted as soon as you disconnect Google, in Botti or in your Google account.
• Audit trail: for as long as your account is active, then deleted with it.
• Invoices and accounting records: 10 years, as required by Swiss law.
• Server logs: 30 days, unless needed longer to investigate a security incident.
• Support messages: up to 2 years after the conversation ends.

10. Security

We protect data with encryption in transit (HTTPS), encryption of Google access tokens at rest, strict access control, and regular backups. No system is perfectly secure, but we will tell you without undue delay if a breach affects your data.

11. Your rights

You can ask us:

• whether we process data about you, and for a copy of it;
• to correct inaccurate data;
• to delete your data, or to stop processing it;
• to hand over data you gave us in a common electronic format;
• to object to processing based on our legitimate interests.

You can export or delete your account data from Botti's settings at any time, and disconnect Google in Botti or at myaccount.google.com/permissions.

Write to [email protected]. We may ask you to prove your identity, and we answer within 30 days.

If you believe we handle your data unlawfully, you can complain to the Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, to your local data protection authority.

If you are a reviewer and want your review data removed: we process it for the business you reviewed, so please contact that business first. We will help them answer your request.

12. Automated decisions

Botti does not make decisions about people that have legal or similarly significant effects. Drafts are generated automatically, but whether a reply is published is decided by the business, either directly or through rules it sets.

13. Changes

We update this policy when our service or the law changes. The date at the top shows the latest version. For significant changes, we will tell account holders by email before they take effect.

If the language versions of this policy differ, the English version prevails.