In short
- We collect what the service needs to run: your account, what you build, and what your automations process on your behalf.
- Hosting, AI inference and email run with providers in the European Union.
- Data from accounts you connect, such as Google, is used to run the automations you set up — nothing else.
- We do not sell personal data, do not use it for advertising, and do not train general-purpose AI models on your content.
- Exklamera AB keeps broad rights to operate, secure and improve botfleets with this data. They are set out below, together with their limits.
1. Who we are
botfleets, a BIFF.ai product, is provided by Exklamera AB, a company registered in Sweden. Exklamera AB is the controller of the personal data described here, except where section 10 says it acts on your behalf. In this policy "we", "us" and "our" mean Exklamera AB.
Contact for anything in this policy: hello@biff.ai.
2. What this policy covers
The public site at www.botfleets.com and its waitlist, the botfleets console at app.botfleets.com, the botfleets bot in Discord, and the emails botfleets sends. Cookies on the public site have their own page: the cookie policy.
3. The data we handle
| Category | What it is |
|---|---|
| Waitlist | Your email address and when you signed up. |
| Account | Your name, email address, workspace and team membership, plan, and sign-in sessions. A password is stored only as a salted hash; a sign-in link is stored only as a hash. |
| What you build | Automations, prompts, steps, schedules, fleet boards and instructions, drafts, and the history and output of runs. |
| Credentials you entrust to us | API keys and other secrets, and the sign-in tokens of accounts and servers you connect. They are kept on our server, are never shown back to anyone, and are removed from what a run records. |
| Connected-account data | What your automations read or write in the accounts you connect — for example email, calendar entries or files in a Google account — as far as the steps you set up require. |
| Chat | Messages you exchange with the botfleets bot in Discord, with your Discord user ID and display name. Older messages are condensed into a summary. |
| Technical data | IP address, browser type, times of requests, and logs of errors and of what the service did. |
| Analytics | On the public site only, and only if you accept it: Google Analytics. See the cookie policy. |
Most of this you give us directly. Some comes from the services you connect, at your instruction, and some is produced by the service as it runs.
4. Why we use it, and on what legal basis
- To provide botfleets — create and run your automations, deliver their results, keep your account working. Basis: our contract with you.
- To keep it secure and reliable — prevent abuse, investigate incidents, find and fix faults. Basis: our legitimate interest in a safe, working service.
- To improve it — measure what works, and learn technical lessons from how automations behave. Basis: our legitimate interest in developing the product.
- To talk to you — service and security notices, and replies to your requests. Basis: our contract with you and our legitimate interests. News sent to the waitlist rests on your consent, which you can withdraw at any time.
- To understand visits to the public site — analytics. Basis: your consent.
- To meet legal obligations — bookkeeping, and lawful requests from authorities. Basis: legal obligation.
5. What Exklamera AB may do
To provide botfleets and to build a business around it, Exklamera AB reserves the rights below. They are broad on purpose. Each is bounded by the limits that follow and by the law.
- Operate. Store, copy, transmit and otherwise process everything described in section 3 as needed to run botfleets, including through the providers in section 7.
- Look when it is needed. Access account data, run records, logs and chat history where that is needed to give support, investigate an incident, find a fault or stop abuse.
- Improve. Analyse how botfleets is used and how automations behave, and use what we learn to develop, test and improve botfleets and other Exklamera AB products.
- Keep what is no longer personal. Create statistics, aggregated data and general technical lessons from the use of botfleets. Once these no longer identify a person or an organisation they belong to Exklamera AB, which may use, keep and share them without limit in time.
- Choose our providers. Appoint, change and add providers that process data for us, on terms that protect the data and wherever the law allows.
- Reorganise. Transfer the data to a successor if Exklamera AB or the botfleets business is merged, sold, financed or restructured. The successor is bound by this policy until it gives you notice of a new one.
- Protect. Keep and disclose data where we believe in good faith that the law requires it, or where it is needed to establish or defend legal claims, to enforce our terms, or to protect the rights, property or safety of Exklamera AB, our users or others.
- Act on misuse. Suspend an account, stop an automation or remove content that we reasonably believe breaks the law, our terms or someone else's rights.
- Reach you. Contact you about the service, its security and changes to it; and about news and offers where the law allows it or you have agreed. You can opt out of news and offers at any time.
- Change this policy. As set out in section 13.
And their limits
- We do not sell personal data, and we do not use it for advertising.
- We do not use the content of your automations or of your connected accounts to train general-purpose AI models.
- People at Exklamera AB look at your content only for the purposes above, and at no more of it than the purpose needs.
- Technical lessons shared across the platform are checked first: anything specific to your organisation stays inside your account.
- Nothing in this policy limits the rights the law gives you. They are in section 11.
6. Data from Google accounts you connect
When you connect a Google account, botfleets receives the access you approve on Google's own screen, and uses it only to run the automations you have set up and to show you their results. You can withdraw it at any time in the console's Connect view or in your Google account's security settings.
botfleets' use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use this data for advertising, do not sell it, and do not use it to develop, improve or train generalised AI or machine-learning models. It is passed to an inference provider only where a step of your automation asks a model to work on it. People at Exklamera AB do not read it unless you ask us to for support, it is necessary for security or to comply with the law, or it has been aggregated and anonymised for internal operations.
7. Who else handles the data
We use the providers below to run botfleets. Each processes data on our instructions and only for the task named.
| Provider | What it does for us | Where |
|---|---|---|
| OVH SAS | Hosts the application and its database. | France |
| Berget AI | Managed AI inference: the text a step sends to a model. | Sweden |
| Scaleway SAS | Managed AI inference, and delivery of the emails botfleets sends. | France |
| Sign-in to the Google accounts you connect, through Google's APIs. Analytics on the public site, with your consent. | Ireland, United States | |
| Discord | Carries your conversation with the botfleets bot when you use it, and operational alerts to our team, which can include an account's email address. | United States |
| Web search providers | Receive the text of a search made while drafting an automation or answering a question — the query only, not who asked. | European Union, United States |
Beyond these, your data goes where you send it: to an inference endpoint of your own if you configure one, to the servers and tools your automations call, and to the recipients of what they deliver. Those are your choices, under those parties' terms.
We may also disclose data as described under "Reorganise" and "Protect" in section 5.
8. Transfers outside the European Union
The service itself runs in the European Union. Where a provider is outside the EU or EEA — Discord and Google are United States companies — the transfer rests on a safeguard the GDPR recognises, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
9. How long we keep it
- Your account and what you build — for as long as the account exists.
- Run history — the most recent 500 runs of each automation; older runs are removed automatically.
- Chat with the bot — recent messages as written; older ones only as a summary.
- Decision records — what you asked the bot, or asked it to draft, and how that request was routed: for 30 days, to measure how well the service decides. They never contain what your automations read from a connected account.
- Credentials — until you remove them, disconnect the account, or close your botfleets account.
- Waitlist — until you ask to be removed or the waitlist is closed.
- Backups — overwritten on a seven-day cycle.
- Logs — for a limited period, as needed for security and fault-finding. The public site's web server log (address, browser type, page and time of each request) is kept for 30 days; the only thing derived from it is a daily count of visitors, told apart as people, AI agents and crawlers.
When you close your account or ask us to delete it, we delete the account and what it holds without undue delay; copies in backups are overwritten within seven days after that. We may keep what the law requires us to keep, and what is needed for legal claims, for as long as that need lasts. Data that no longer identifies anyone may be kept indefinitely.
10. Other people's data in your automations
Your automations may process personal data about other people — the senders of email in a mailbox you connect, for example. You decide what is processed and why, and you are responsible for having the right to do so. For that data Exklamera AB acts on your behalf: we process it to run your automations as you have configured them, with the security described here, and with the rights in section 5 that operating the service requires.
11. Your rights
Under the GDPR you may ask us to:
- give you a copy of your personal data, and tell you how we use it;
- correct data that is wrong or incomplete;
- delete your data;
- restrict or stop a particular use of it, including any use that rests on our legitimate interests;
- hand your data over in a portable form;
- stop relying on a consent you gave, at any time and without affecting what was done before.
Write to hello@biff.ai. We answer within one month, and may ask you to confirm who you are first. If you are not satisfied you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the data-protection authority where you live.
12. Security
Connections to botfleets are encrypted. Passwords are stored only as salted hashes. Credentials you entrust to us are never returned by the service and are removed from run records. The server is hardened and access to it is limited to the people who need it. No system is perfectly secure; if a breach affects your data we will tell you and the authority as the law requires.
botfleets is made for people at work and is not directed at children under 16.
13. Changes to this policy
We may change this policy as botfleets and the law change. The version and dates at the top of this page always say which text is in force. If a change materially affects how we use your personal data, we will tell account holders by email or in the console before it takes effect where that is practical. Earlier versions are available on request.