Legal

Botpoison Privacy Policy

Effective date: 17 October 2026

We do not sell your personal data. We never have, and we do not plan to. We make money from customers who pay us.

This page covers two different things. It covers the data we hold about you as a Botpoison customer. It also covers the data our customers send us about the people who use their forms, which we handle on their behalf.

It tells you what we collect, why we collect it, who else sees it, and what you can ask us to do about it.

Who we are

Botpoison is run by Trampoline Software SRL, a company registered in Belgium under enterprise number BE 0799.398.081.

Our address is Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. Write to us at support@botpoison.com.

For data about our customers, we are the controller. For data our customers send us about their own visitors, we are a processor, and our Data Processing Agreement governs it. Our GDPR page lists that data.

What we collect and why

Your account

Your account holds your email address. We use it to create your account, sign you in, and write to you about the Service.

Product updates

If you opt in when you sign up or write to us, we record that choice and when you made it, and send you occasional product updates. You can withdraw your consent at any time.

Billing information

• An external PCI-compliant payment gateway ("Stripe") handles all credit card transactions. Card details are never stored or processed on our servers.
• Stripe keeps the record of each payment, including the last 4 digits of the card and the billing address. We keep a reference to that record and to your plan, for account history, invoicing and billing support.
• The billing address is used to calculate any sales tax due in the United States or VAT in the EU, and to print on your invoices.

IP addresses

We collect IP addresses to keep the Service and our customers' forms secure, and to apply the address rules a customer sets for their own forms.

Website and server interactions

When you use the website and the dashboard, our servers and error reports record technical information to keep the Service working:

• IP address
• Operating system
• Browser type
• Access times

We may publish aggregate statistics that identify no one.

Cookies and browser storage on botpoison.com

We run no analytics, no advertising tags and no tracking pixels on botpoison.com.

The dashboard keeps your sign-in and a few preferences in your browser's local storage, so that you stay signed in. You can clear it in your browser at any time, which signs you out. None of it follows you around the web, which is why you see no cookie banner here.

Browser storage on sites protected by Botpoison

Our script stores nothing in your browser.

Messages sent to Classify

Our customers can send a form submission or a message to Classify to learn whether it is spam. It can hold the name, email address, phone number and free text of the person who filled in the form. We process it on the customer's behalf, as a processor.

Botpoison's own model scores it on our own infrastructure, hosted by Amazon Web Services in Ireland, and it does not leave that infrastructure to be scored. To answer the request we keep the verdict, its score, the model that produced it and the time.

Training Classify models

We may use content sent to Classify to train and evaluate Botpoison's spam detection models. For that use we act as a controller, on the basis of our legitimate interest in detecting spam and abuse.

Before content is used for training, we replace the part of each email address before the @, phone numbers and IP addresses. Names and free text stay, so we treat it as personal data. We use it only to train and evaluate spam detection models, never for advertising, and we never sell it.

You may object to this use at any time by writing to support@botpoison.com.

Voluntary correspondence

When you write to us with a question or to ask for help, we keep that correspondence, including the email address. That gives us a history to refer to if you write to us again.

We also store any information you volunteer like surveys.

Sometimes when we do customer interviews, we may ask for your permission to record the conversation for future reference or use. We only do so if you give your express consent.

What we don't collect

We don't collect any characteristics of protected classifications including age, race, gender, religion, sexual orientation, gender identity, gender expression, or physical and mental abilities or disabilities.

We also don't collect any biometric data.

How we store your data

We use third party vendors and hosting partners to provide the necessary hardware, software, networking, storage, and related technology required to run the Service.

Where we store your data

We run Botpoison from Belgium. Your data is stored in Ireland.

Ireland is in the European Economic Area, so your data does not leave it when we store it. Some of the vendors on our subprocessors page are outside it.

How long we keep it

• Challenge and Classify records are kept until the customer deletes the project or the workspace they belong to.
• If we keep a masked copy of content sent to Classify to train and evaluate our models, we keep it for up to 3 years from collection.
• Support correspondence is kept for 3 years after the last message.
• A record of your consent to product updates is kept for 3 years after you withdraw it or close your account.
• Server logs are kept for 7 days.
• Error reports are kept by Sentry for up to 90 days.
• If you close your account, we delete the workspaces you own and everything in them straight away.

How we secure your data

• Encryption in transit
• Access to production data limited to a small number of authorised people, who are required to keep it confidential
• Monitoring and alerting on the production service

No service can promise perfect security, and we will not pretend otherwise. If something goes wrong, the section on data breaches says what we do.

Rights to your data

Although the Service owns the code, databases, and all rights to the Service's application, you retain all rights to your data.

If there is a data breach

We tell the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) within 72 hours of finding out, unless the breach is unlikely to put anyone at risk.

If the breach is likely to put you at serious risk, we tell you too. We do that as soon as we can, by email and by a notice in the dashboard. We tell you what happened, what data was involved, and what you can do.

When the breach involves data we handle for a customer, we tell that customer without undue delay. It is then their call whether to tell the people affected.

Who we share it with

We do not sell your personal data. We share it with the vendors that help us run the Service. They may only use it to do that job for us. They may not use it for anything of their own.

Our subprocessors page lists them, what each one does, where it is, and the transfer safeguard that applies to it.

We may also share data when the law requires it, or to protect the Service and the people who use it.

Your rights

You can ask us to:

• Show you the data we hold about you
• Correct it if it is wrong
• Delete it
• Send it to you in a file you can reuse
• Stop or limit what we do with it
• Stop sending you email

Email support@botpoison.com and we will reply within one month. Exercising any of these rights costs nothing and will never get your account treated worse.

If you think we have got something wrong, tell us first. You also have the right to complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).

Third party links

The Service may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party's site.

We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party site or service.

If you are in the EU or the UK

The GDPR gives you the rights listed above. Our GDPR page explains where we are the controller, where we are the processor, and how to exercise each right.

You may also complain to the authority where you live or work. Please contact us first, so we can try to fix it.

If you are in California

The CCPA gives you rights over your personal information, and we honour them. We do not sell or share it. Our California privacy page has the detail, including the statutory categories and how to make a request.

Children's privacy

Botpoison is not for children. We do not market it to anyone under 16, and our customers may not use it to collect data from children.

If you are a parent and think your child has given us data, write to us. We will remove it.

Changes to this policy

We update this page when the Service changes or the law does. The effective date at the top tells you which version you are reading.

When a change matters to you, we post it on this page at least 30 days before it takes effect. We do not notify you individually. It is your responsibility to check this page for changes. If you do not accept a change, close your account before it takes effect.

We never apply a new use of data to data we received before the change.

Questions

Have any questions, comments, or concerns about this policy, your data, or your rights with respect to your information?

Please get in touch by emailing us at support@botpoison.com, and we'll be happy to answer them.

Botpoison is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. Enterprise number BE 0799.398.081.