Legal
Botpoison and the GDPR
Effective date: 17 October 2026
Botpoison wears more than one hat under the GDPR, and which one applies depends on whose data it is and what it is used for.
For your account, your billing and your support emails, we decide the use of the data. We are the controller.
For what your visitors send through the forms you protect, you decide the use of the data and we act on your instructions. You are the controller and we are the processor.
For training and evaluating Botpoison's models on content sent to Classify, we decide the purpose, so we are the controller again.
Disclaimer: Botpoison does not provide legal advice. This page describes what Botpoison does. If you need advice on your own obligations, ask someone qualified to give it.
Privacy Policy
Please refer to our Privacy Policy to learn more about:
- What we collect and why
- What we don't collect
- How we store your data
- Where we store your data
- How we secure your data
Definitions
Controller
The party that decides why and how personal data is used.
Processor
A party that uses personal data on a controller's behalf.
Subprocessor
A vendor a processor brings in to help do that job.
Data subject
The person the data is about.
Botpoison as a data controller
We decide the use of the data we hold about you as our customer. Our Privacy Policy gives the full picture.
Botpoison as a data processor
We have a lawful basis for the processing we do. We run privacy risk assessments whenever we need to make a significant change.
When you protect a form with Challenge, we process the following personal data of your visitors on your behalf:
- IP address
- Browser type (the user agent)
- Referring website addresses
- The address of the page the protected form appears on
- Request headers the browser sends: accepted languages and encodings
- Approximate location and network, derived from the IP address: country, region, time zone and network operator
We keep these records until you delete the project or the workspace they belong to.
When you send content to Classify, we process it on your behalf:
- The content of the form submission or message you send, which can include names, email addresses, phone numbers and free text
Classify scores the content with Botpoison's own model, on our own infrastructure, hosted by Amazon Web Services in Ireland. To answer the request we keep the verdict, its score, the model that produced it and the time. We may also use the content to train our models, as described below.
It is your responsibility as a data controller to ensure that any personally-identifying information you collect via our service is GDPR-compliant. If you use Classify, your own privacy notice should say that a provider screens submissions for spam and may use them to improve its models.
Botpoison is not to be used to collect:
- Children's personal information
- Personal health information
- Personal criminal history
Free text can carry such information whatever the form asks for. Do not send content from forms built to collect it to Classify.
Botpoison as a data controller for model training
We train Classify models to recognise spam. Content sent to Classify may be used to train and evaluate Botpoison's models.
For that training, Botpoison decides the purpose, so we act as a controller rather than a processor. Our lawful basis is our legitimate interest in detecting spam and abuse. Content is masked before it is used for training: the part of an email address before the @, phone numbers and IP addresses are replaced.
If you filled in a form on a site that uses Botpoison and want to object to this use, write to support@botpoison.com.
Data Processing Agreement
Our Data Processing Agreement is the Article 28 contract between you and us. It forms part of our Terms of Service, applies to every customer at no extra cost, and needs no signature.
Where the data is stored
We run Botpoison from Belgium. Everything we hold is stored in Ireland, in the European Economic Area, so storing it does not transfer it out.
Some of the vendors we use sit outside the European Economic Area. Our subprocessors page lists where each vendor is and the transfer safeguard that applies to it.
Subprocessors
The subprocessors page is the live list. We update it at least 30 days before a new vendor starts handling personal data, so you have time to object.
We do not notify you individually. It is your responsibility to check that page for changes.
Rights
Under GDPR, you have the following rights:
- Get a copy of the personal data we hold about you
- Have it corrected when it is wrong or incomplete
- Have it deleted, unless the law requires us to keep it or we need it for a legal claim
- Limit what we do with it while a question about it is open
- Object to us relying on our legitimate interests, including the use of content for model training
- Receive it in a structured, machine-readable file
- Withdraw your consent to product updates at any time
- Know who else receives it
Email support@botpoison.com to use any of them. We answer within one month. If a request is complicated we may take longer, and we will tell you inside that first month if so.
If a visitor to your form contacts us about data we process for you, we point them to you. You are the controller of it, so the answer is yours to give. We will help you give it.
Complaints
Please contact us first. You may also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), or to the authority where you live or work.
Changes to this page
When a change matters to you, we post it on this page at least 30 days before it takes effect. We do not notify you individually. It is your responsibility to check this page for changes.
Questions
Have any questions, comments, or concerns about this policy, your data, or your rights with respect to your information?
Please get in touch by emailing us at support@botpoison.com, and we'll be happy to answer them.
Botpoison is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. Enterprise number BE 0799.398.081.