Who we are
Botardo AG ("Botardo", "we", "us") runs this website and the Botardo bot-detection service. When the snippet runs on a customer's website, that customer is the controller of the personal data processed there, and we act as their processor under a Data Processing Addendum.
There is one exception. We also use what we see across all our customers' websites to keep detection working. For that use we are a controller ourselves, as described under How we use it.
What we collect
From visitors on customer websites
- Interaction data: how the visitor moves, taps, scrolls and types on the page. This is timing and position only, never what they type.
- Device and browser data: technical details of the device and browser, such as its type and version, language, time zone, screen and hardware.
- Connection data: the IP address, standard request headers, the address of the page the visitor is on (without its query string), and technical details of the connection.
- Session data: a random session ID our server assigns, and the scores and decision we work out for it.
From people who contact us or join the waitlist
- Your name, work email and message.
From console users
- Account fields: name, work email and organization.
- A hash of your password, never the password itself.
- Billing: held by Stripe. We receive only a customer ID.
What we never collect
We never read form data. That means no field values, no typed text, no clipboard contents, no request bodies and no query-string values. That goes for every field on every page, password and payment fields included.
The snippet loads no ad pixels, social trackers or session-replay tools, and we don't use what it collects for advertising or marketing, ours or anyone else's.
How we use it
- To score the session when a website asks for one, and to challenge the visitor when we can't tell either way.
- To detect abuse across our customers' websites.
- To improve detection. We train and test our global model only on traffic from customers on the Standard plan. Traffic from Pro customers never goes into it. It trains only that customer's own model.
- To protect our own service from abuse.
Interaction data is only ever used to tell people from bots, never to work out who someone is.
Legal basis
We rely on two lawful bases under GDPR Art. 6:
- Legitimate interest (Art. 6(1)(f)): protecting websites from automated abuse such as fake signups, credential stuffing, card testing, scraping and form spam, both for each customer and across all of them.
- Contract (Art. 6(1)(b)): for console accounts, the processing needed to provide the service you signed up for.
The snippet reads information from the visitor's device. Under EU ePrivacy rules that can need the visitor's consent, depending on how a website uses it. Each customer decides how this applies on their own website, and our Data Processing Addendum covers it.
We produce a score and a suggested decision; we don't block anyone. What happens to a request is up to the website that receives it.
How long we keep it
- Raw signals from the browser and the connection: deleted seven days after the session starts. They're stored in daily batches, so a day's data is gone within about eight days.
- Tokens: expire two minutes after they're issued and can be used once. We keep the session and token records only as long as we need them for verification and abuse prevention.
- Contact and waitlist messages: until we've dealt with them, or until you ask us to delete them.
- Console account data: for the life of the account, then deleted promptly once it's closed.
- Backups: encrypted, and purged on a rolling basis.
Because raw signals only last a week, we usually can't look up an older visit, even if you ask us to. Deletion is permanent and we have no way to recover deleted data.
Your rights
Depending on where you live, you have the right to access, correct, delete, port, or restrict the processing of your personal data. For console accounts and messages you've sent us, email [email protected].
If you visited a website that uses Botardo, that website is the best place to start, since we don't know who you are. We'll help them answer, and you can also write to us directly.
Ask for a copy of the personal data we hold about you.
Have us delete your data. Backups are purged on a rolling schedule.
Get your account data in a machine-readable format.
Fix inaccurate account data.
Object to processing based on legitimate interests.
Lodge a complaint with your local data protection authority.
Children
Botardo is a B2B product. The console isn't directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, email [email protected] and we'll delete it.
International transfers
All customer data is hosted on European bare-metal hardware, with an encrypted standby. For transfers from the EEA or UK we rely on Standard Contractual Clauses.
Changes to this notice
We'll post material changes on this page with advance notice before they take effect and email account admins. Editorial changes (typos, link updates) we'll just fix.
Contact us
Privacy questions, data subject requests, or anything else: [email protected].