Privacy Policy

The privacy of your data — and it is your data, not ours — matters to us. Here's what we collect, what we don't, and why.

Identity & access

When you sign up for CupBots, we ask for your WhatsApp number. That's it. We use it to run your bot and send you messages. We don't ask for your name, address, or shoe size.

When you pay for a plan, Stripe collects your payment information. We never see your credit card number. We store a Stripe customer ID so we can manage your subscription.

Your messages

When you chat with your bot, those conversations are stored on the server running your bot instance. For hosted plans, that's a server we manage for you. Your messages are isolated from every other customer. We don't read them, we don't mine them, we don't use them to train anything.

Messages are sent to AI providers (like Anthropic or Google) to generate responses. These providers have their own privacy policies, but none of them use your data for model training when accessed via their APIs.

Analytics

We use Umami for website analytics. It's privacy-focused, open-source, and doesn't use cookies. We see aggregate numbers — how many people visited a page, which country they're from — not who you are or what you clicked. We don't track you across the web. We don't build profiles. We don't sell data to advertisers. We never have and never will.

What we don't collect

We don't collect anything we don't need. We don't install tracking pixels. We don't use Facebook's SDK or Google Analytics. We don't fingerprint your browser. There's no retargeting. There are no third-party ad scripts on this site.

When we access your data

We don't look at your bot's data unless you ask us to (for support or debugging), or unless we're compelled to by law. If a government authority approaches us with a valid legal order, we'll comply — but we'll push back on overly broad requests.

Data location

CupBots OU is incorporated in Estonia, in the European Union. Your data may be processed on servers located in the EU, US, or Singapore depending on your plan and region. We choose providers that comply with GDPR regardless of where they're located.

Data retention

We keep your data for as long as your account is active. When you cancel your plan, we keep your data for 30 days in case you change your mind, then we delete it. If you want it gone sooner, just tell us.

Your rights

You can request a full export of your data at any time. You can also request deletion. We'll respond within a few days, not a few weeks. Message us on WhatsApp and we'll handle it.

Third-party services we use

• Stripe — payment processing. Their privacy policy.
• WhatsApp / Meta — messaging delivery. Their privacy policy.
• Anthropic — AI responses. Their privacy policy.
• Hetzner / DigitalOcean — server hosting.

Changes

If we change this policy in a meaningful way, we'll announce it and give you time to review. We won't sneak changes past you.

Questions?

Message us on WhatsApp. We're real people and we'll give you a straight answer.

CupBots OU, Tallinn, Estonia. EU company registration.