Botpress procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ c) Unless otherwise agreed in writing by Botpress, Customer Data, including Conversation Data, may be processed at a different location and on different infrastructure than their hosting location. ” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Botpress may monitor and audit Customer’s and its Authorized Users’ Use of the Software for analytics purposes (as detailed in Section 9.3 - Analytics Data) and for the purpose of ensuring compliance with the terms of this Agreement. Any such monitoring or audit may be carried out by Botpress or a third party authorized by Botpress, at its own expense. If Botpress’ monitoring or audit reveals that Customer’s or any Authorized User’s Use of the Software is in breach of this Agreement, including any Use in breach of any applicable laws, Botpress may immediately suspend and discontinue the Software Services to Customer or to one or several Authorized User(s), at Botpress sole discretion and without advance notice to Customer. Botpress shall notify Customer of such suspension as soon as reasonably possible, which notice shall set out the circumstances of the suspension. If Customer rectifies the situation to Botpress’ satisfaction, then Botpress will reinstate the Software Services. If Customer does not rectify the situation within a reasonable period of time, then it shall be deemed a material breach of this Agreement and Botpress shall be entitled to terminate this Agreement in accordance with Section 11. ” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ b) Unless otherwise agreed in writing by Botpress, the Botpress Infrastructure hosting Customer Data and the Software may be physically located anywhere in the world, at Botpress’ discretion; ” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “If you are in the European Economic Area, VeraSafe can be contacted in addition to Botpress’ DPO, only on matters related to the processing of personal data. To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031. ” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Customer is solely responsible for adequate Customer Data back-up. Botpress will use reasonable efforts to ensure the availability and integrity of Customer Data uploaded to the Botpress Infrastructure. Botpress may create backup copies and use other methods to this end, but the Software Services do not include backup services for Customer Data and accordingly, the Customer shall ensure that Customer Data is available outside of the Botpress Platform. ” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain your personal data only as long as it's necessary for the intended processing purposes or, as the case may be, until you or our Customer request that we destroy it. The retention duration is determined by the reasons for collecting personal data and using the information and/or as mandated by relevant laws. Botpress has operations in multiple countries. Some data relating to the use of the Service and the Website, email automation, support requests and payments are processed by our service providers through facilities that may be located in other jurisdictions. Therefore, your personal data may be accessed or transferred outside your country of residence. Personal data about End-Users collected through the Service (such as Conversation Data) is stored electronically by our service providers on servers located in the United States or other locations determined by the relevant Customer. We ensure that the transfer of such Personal Data is made in a secure manner, with appropriate safeguards concerning the nature of the personal data being transferred. In case of transfers of personal data outside the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate transfer mechanisms and are compliant with the EU-US, UK-US and/or Swiss-US Data Privacy Framework self-certification program operated by the US Department of Commerce. Please refer to the “ Information for individuals in the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland ’’ section for more information. Data generated from Google Analytics is stored on servers controlled by Google. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We share personal data collected through the Service about End-Users with our Customer controlling the Customer Bot with which the End-User interacts. The Customer is the controller with respect to such personal data. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Schedule 1 - List of Service Providers (Subprocessors) Data collected through the Website ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use Hotjar services on the service. Hotjar provides information about the behaviour of service visitors. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ OpenAI is used to process user text inputs to generate text responses. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Google Analytics processes analytics information about usage of Botpress cloud services. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Mixpanel is used to collect product and Website usage analytics, which is used to improve the service. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Data gathered from the Website is processed through Salesforce software services for marketing purposes. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The linkedin tags collect some information about events on the Website, such as pages visited or products viewed. Sharing data with Linkedin allows the customization of our advertising campaigns on Linkedin. Data collected by Linkedin is used in conformity with Linkedin’s Data Privacy Policy. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We only share personal data in the manner described in this statement. Your personal data may be disclosed to the categories of recipients below for the following purposes: ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Botpress will provide information about third-party hosting providers in its Sub-Processor List. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Freshdesk provides help desk services. Freshdesk processes all data provided by users for technical support purposes. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Intercom is used to provide live support to visitors of the service and the Website. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share personal data with service providers that allow us to provide our services more efficiently. We only share personal data with service providers that agree in writing to keep personal data confidential and which implement security and personal data protection measures comparable to our own. A list of our service providers processing personal data is available in Schedule 1 of this statement. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Your personal data might undergo processing, transfer, or disclosure in the United States and other countries where our affiliates and service providers operate or have servers. We ensure that the recipient of your personal data maintains an adequate level of protection. This is achieved through arrangements such as back-to-back agreements with standard contractual clauses or other approved transfer mechanisms, as sanctioned by the European Commission or the relevant data protection authority. If you are a Customer, we strongly advise initiating a Data Processing Agreement (DPA) with us. You can find our DPA by clicking here or visiting our legal portal. This document constitutes a formal agreement that acknowledges Botpress’ GDPR compliance and assists you in upholding GDPR standards in its utilization of Botpress as a data processor. A signed copy of our DPA can be obtained by contacting [email protected] Botpress is committed to implementing appropriate technical and organizational measures to ensure the security and confidentiality of your personal data. This includes protecting data against unauthorized or unlawful processing, accidental loss, destruction, or damage. Botpress has appointed a Data Protection Officer (DPO) who is responsible for ensuring compliance with data protection laws and regulations, including GDPR. You may reach out to the DPO by email at [email protected] VeraSafe has been appointed as Botpress’ representative in the European Union for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use Google Analytics services on the Website and on our software platform. Google Analytics provides information about the behaviour of Website visitors, including through the use of cookies which allow Google to collect information about certain events on the Website such as the pages you visit, the length of a session or the products you view; Data collected by Google is used in compliance with Google’s privacy policy. Botpress does not use data obtained through the Workspace API to develop, improve, or train generalize AI and/or ML models. Facebook Inc. We use a “Facebook Pixel” on the Website. Our Facebook Pixel allows Facebook to collect some information about events on the Website, such as pages visited or products viewed. Sharing data with Facebook allows the customization of our advertising campaigns on Facebook. Data collected by Facebook is used in conformity with Facebook’s Data Privacy Policy. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Customer agrees that the Software may be hosted by a third-party service provider, that the Botpress Infrastructure may be provided in whole or in part by a third-party service providers and that the Customer Data may be hosted and processed by a third-party service providers as set forth in the Proposal. Customer acknowledges ant agrees that : ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use Hubspot services in connection with the Website. Hubspot processes information about website traffic and visitors’ profiles for marketing purposes. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ With regard to accountability for onward transfers, Botpress acknowledges its duty regarding the processing of personal data received and subsequently transmitted to our service providers. We maintain accountability according to the Frameworks if a service provider handles personal data covered by this statement in a manner inconsistent with the Frameworks. This remains true unless Botpress can demonstrate that we are not responsible for the incident that led to the damages. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use Hotjar services on the Website. Hotjar provides information about the behaviour of Website visitors. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Azure is used to find information on websites and to help generate text responses. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ AWS hosts our cloud services and all Customer Data. AWS processes analytics information about usage of the Botpress cloud services. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ In alignment with our commitment to upholding robust data protection measures when transferring personal data from the EEA or UK to the United States, we actively engage in the EU-US Data Privacy Framework ("EU Framework"), the UK Extension to the EU Framework ("UK-US Framework") and the Swiss-US Data Privacy Framework ("Swiss-US Framework") (collectively the "Frameworks"). The following US-based entity is fully compliant with the Frameworks: Botpress Inc, 131 Continental Dr, Suite 305, Newark, DE 19713 United States Botpress Inc. adheres fully to the Frameworks. Botpress is certified by the US Department of Commerce in relation to the processing of personal data received from the EEA, UK and Switzerland. We are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) for the purposes of the Frameworks. In cases of any discrepancies between the terms stated in this statement and the Frameworks, the Frameworks shall take precedence. For more information about the Frameworks and to access our certification details, please visit https://www.dataprivacyframework.gov/ . ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share your personal data with the Botpress family for the purposes outlined in this statement. Other Third Parties If required by law: We may also disclose personal data to third parties if expressly permitted or required to do so by law or if we are compelled to do so by a competent authority. We may disclose personal data in connection with legal proceedings if necessary to protect our rights or those of our Users or to meet national security or law enforcement requirements. Transfer of business: If the sale or restructuring of all or part of our business is contemplated, we may disclose personal data to the persons or organizations involved before and after the transaction, whether or not the transaction actually takes place. In such a case, these persons or organizations commit to us to maintain the confidentiality of personal data so disclosed and to use the same exclusively to evaluate the feasibility of the transaction and in accordance with this statement if the transaction is completed. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ c) Enterprise Plan: means the Customer subscribed to the paid version Software Services through a Botpress sales representative; ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ In consideration of the Software Services, the Customer agrees to pay Botpress the Usage Fees provided for in the Plan selected when subscribing to the Software Services or the fees set forth in the Proposal, as the case may be. Botpress may modify the Usage Fees by providing at least 30 days advance notice to the Customer, including by posting modified fees to the Botpress Website. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ a) By the usage limits imposed by the subscription selected by the Customer, if any, including ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Customers under the Community (Free) Plan or Self-Serve Plan do not benefit from a service level commitment and any technical support will be provided at Botpress’ discretion. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ The Software Services may be offered to the Customer in the form of a subscription plan comprising usage limitations. Where applicable, the Software Services are limited: ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Fees payable in consideration of Professional Services shall be as agreed between the Customer and Botpress. Absent an agreement on fees, Botpress shall be entitled to charge for Professional Services authorized by the Customer based on Botpress’ current rates for similar services. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ (i) limits based on the number of messages processed monthly through the Software Services (ii) limits based on the maximum amount of Usage Fees authorized by the Customer. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Botpress may provide Authorized Users using the Software under the Community (Free) Plan and Self-Serve Plan with technical support during Business Hours at Botpress’ discretion. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ b) Self-Serve Plan: means the Customer subscribed to the paid version Software Services through the Botpress Website; ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ If a Customer subscribed to an Enterprise Plan, Botpress shall provide the Software Service in accordance with Botpress Standard SLA. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Botpress may provide Professional Services to the Customer in Botpress’ entire discretion. Except as otherwise provided in a Proposal, Botpress shall have no obligation to provide Professional Services to the Customer. Unless a written agreement is entered into by Botpress and the Customer regarding Professional Services, this Section 7 shall govern all Professional Services provided by Botpress. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ a) Community (Free) Plan: means the free version of the Software Services. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Certain Usage Fees based on usage of the Software Services are billed in arrears, at the end of Customer’s billing period, while other Usage Fees are billed in advance at the beginning of the Customer’s billing period depending on the subscription plan and options selected by the Customer. A Proposal (if applicable) may establish a different billing arrangement. Customer may limit its monthly spend for Usage Fees billed in arrears by using the features of the Software. Some features of the Software Services will not be available once the spend limit is reached. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ From time to time, it will be necessary for Botpress to perform maintenance on the Botpress Infrastructure and/or the Software. Such maintenance includes routine maintenance to ensure the continued provision of the Software Services through the continued operation of the Botpress Infrastructure or upgrading, updating or enhancing the Software or Botpress Infrastructure. Botpress shall use its commercially reasonable efforts to perform such maintenance at such times to minimize the impact of any downtime of the Software to Customer. To the extent Botpress is able, Botpress shall notify Customer in advance of any scheduled maintenance by posting a message on the website or by sending an e-mail to the designated Customer of the scheduled maintenance time and the anticipated duration of such maintenance. ” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ a) To the features included in the subscription selected by the Customer, if applicable. ” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.