Privacy Notice

Effective Date: October 14, 2026

1. Information We Collect

Account Information

• Username
• Email address
• Password (hashed; we never store plaintext passwords)

Credentials and Content You Store

• API keys, tokens, and secrets you choose to save in your vault
• Bot tokens and their associated metadata (name, description)
• Notes, documents and other content you add to your Brain or Studio

Usage Information

• When you use the BotVault website, our analytics provider PostHog records the pages you visit (pages in your Brain and Google-related pages only by page type, never the note, person or account shown), account events such as signing up, signing in, starting checkout, plan and subscription changes and reaching a plan limit, basic device and browser information, and your IP address. See section 6.
• An audit log of actions in your account (for example, credentials accessed, Google accounts connected or disconnected)

Google Account Data (if you connect a Google account)

• OAuth access and refresh tokens (encrypted with AES-256-GCM)
• Your Google email address, used to identify the connected account (it is shown as the account's name in BotVault and recorded in your audit log)
• The list of permissions (OAuth scopes) you granted

What BotVault does with your Google data

• Your bots and apps. BotVault's main purpose is to hand the access token for your connected Google account to the bots and apps you authorize in your vault (including AI assistants you connect through BotVault's MCP server). Your bots and apps then call Google directly. The Gmail, Calendar, Drive, Contacts, Sheets or Docs data they request goes from Google to them and does not pass through or get stored on BotVault's servers. Each bot or app only gets the permissions you granted.
• Diagnostics (only when you run it). To show you that each permission works, BotVault calls Google on your behalf only when you run a test, and shows the result on screen. Examples:
  • the number of labels, messages and contacts
  • a few label, calendar and file names
  • your profile name
  • your vacation auto-reply status
  • for "Read Existing File", a short excerpt (up to 280 characters) of a Doc or Sheet you choose

  Write tests create clearly marked "[BotVault Test]" items: a draft, a message to yourself, a filter, an event, a file, a contact, a spreadsheet or a document. Append and insert tests add one marked row or line to a file you pick, then remove it. By default BotVault deletes test items immediately (a message sent to yourself is moved to Trash). If you turn on "Keep test items", their links are remembered only in your browser so you can remove them later with "Clean up". BotVault does not store test results or the content it reads during a test on its servers.

• Tasks (only when you click). BotVault calls Google on your behalf to do what you ask on the Tasks page and shows the result on screen. Email, file, contact, Sheet and Doc content is passed to your browser only and is not stored.
• Brain daily agenda (optional, off unless you enable it). If you give BotVault's Brain access to a Google account, BotVault reads that day's events from your primary calendar once a day. It saves a daily agenda note in your Brain with each event's start time, title and up to five attendee names (or email addresses when no name is set). The note is encrypted with AES-256-GCM. It is kept until you delete it or delete your account. Turning off the Brain's access or disconnecting the Google account stops new agenda notes; existing notes stay until you delete them. Agenda notes are never used by BotVault's AI features.

BotVault does not otherwise read or store the content of your Gmail messages, calendar events, Drive files, contacts or documents.

BotVault does not send Google user data to any AI model provider. Bots and AI apps you connect to your vault yourself receive only the access you give them (see "Your bots and apps" above).

2. How We Use Your Information

• To create and manage your BotVault account
• To securely store and serve your credentials to your authorized bots and apps via our API
• To auto-refresh Google OAuth tokens so your integrations remain active
• To run Diagnostics checks you start and, if you enable it, to create your Brain daily agenda from your Google Calendar
• To provide the Tasks page, where you read, reply to, label, archive and trash email, manage Gmail filters, view and schedule calendar events, search and read Drive files, save notes to Drive, manage contacts, and add a row to a Sheet or text to a Doc you pick, each only when you click
• To provide the AI writing features you choose to use (these never use Google user data)
• To provide audit logs of activity within your account
• To understand how the BotVault website is used and to improve it (website analytics, see section 6)

We do not use your information for advertising or to build advertising profiles, and we do not sell it. We do not send Google user data to our analytics provider.

3. How We Store and Protect Your Data

• All sensitive credentials (API keys, tokens, secrets), including Google OAuth tokens, are encrypted at rest using AES-256-GCM. So is your Brain daily agenda.
• Passwords are cryptographically hashed and never stored in plaintext.
• BotVault is not a zero-knowledge system: our servers can decrypt your data, but only to provide the service to you (for example, to hand a token to your authorized bot or to run a feature you use).
• Our database is hosted on Turso, and the application is hosted on Vercel. Your data is stored and processed in the United States.
• All data is transmitted over HTTPS/TLS.

4. Third-Party Services

We use the following service providers to operate BotVault. They receive data only as needed to provide their service to us:

• Vercel: application hosting, serverless functions and file storage (Vercel Blob)
• Turso: database hosting
• Resend: account and notification emails, and support messages you send us
• LemonSqueezy: payments and subscriptions
• PostHog: website analytics (pages visited, account events such as sign-up, sign-in and billing changes, device and browser information, IP address, and the email address and username you sign up with). PostHog does not receive Google user data.
• OpenRouter: AI model routing for Studio's writing features. It passes requests to the model provider (currently Anthropic for text and Google for images). No Google user data.
• Anthropic: AI processing for Studio requests routed through OpenRouter (above), and classification of messages sent to BotVault's Slack assistant (message text only). No Google user data. The Slack assistant is currently available by invitation only.
• Google: the Google APIs you choose to connect

Services you connect yourself receive data only when you use a feature that needs them, under your own account with that service. Examples: your own Anthropic key, Slack, X, LinkedIn, Jira, Glean or Fireflies.

We do not sell, rent, or share your personal data with any third parties for marketing or advertising purposes.

5. Google API Services – Limited Use Disclosure

BotVault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide the features described above that you can see and use in BotVault: serving tokens to your authorized bots and apps, Diagnostics, the Tasks page, where you read, reply to, label, archive and trash email, manage Gmail filters, view and schedule calendar events, search and read Drive files, save notes to Drive, manage contacts, and add a row to a Sheet or text to a Doc you pick, each only when you click, and the optional Brain daily agenda.
• We transfer Google user data only to provide or improve those features and only with your consent (to the bots and apps you authorize). We may also transfer it for security purposes (for example, investigating abuse), to comply with applicable law, or as part of a merger, acquisition or sale of assets only after obtaining your explicit prior consent.
• We do not send Google user data to any AI model provider.
• We do not use or transfer Google user data for advertising, including retargeting or personalized or interest-based ads, and we do not sell it.
• We do not use Google user data to determine creditworthiness or for lending.
• We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.
• No person at BotVault reads your Google user data unless one of these applies:
  • you give us explicit permission for specific data (for example, a support request)
  • it is necessary for security purposes such as investigating abuse
  • it is required to comply with law
  • it is aggregated and anonymized for internal operations
• Google user data we store is protected in transit with TLS and encrypted at rest with AES-256-GCM.

6. Cookies and Analytics

BotVault uses essential cookies for sign-in (session cookies). We also use PostHog analytics. It sets its own cookie and local-storage entry to recognize your browser, and records the pages you visit (pages in your Brain and Google-related pages only by page type), basic device, browser and page-load performance information, and your IP address. Our servers also send PostHog account events such as sign-up, sign-in and billing changes. PostHog does not record your screen or your clicks (no session recording, no click tracking) and does not receive Google user data. When you sign up, we also send PostHog your email address and username so we can understand how accounts are used. We do not use advertising cookies or advertising trackers.

7. Your Rights

You have the right to:

• Access your stored data at any time through your BotVault dashboard.
• Update your account information and stored credentials.
• Delete your account and all associated data. Account deletion is permanent and removes all your credentials, bot tokens, connected Google accounts, Brain notes (including agenda notes), Studio content and audit logs. To also remove BotVault from your Google account, visit your Google Account permissions. To delete your analytics data held by PostHog, email us.
• Revoke Google access at any time by disconnecting your Google account from BotVault (this also asks Google to revoke BotVault's access) or via your Google Account permissions.
• Export your data upon request by contacting us.

8. Data Retention

• Account data: we keep your data for as long as your account is active. When you delete your account, your data is permanently deleted from our live systems.
• Backups: our database provider keeps rolling backups for up to 10 days, so deleted data may remain in those backups for up to 10 days before it is permanently removed.
• Brain agenda notes: kept until you delete them or your account. Disconnecting a Google account stops new notes but does not delete existing ones.
• Diagnostics: results are not stored on our servers.
• Tasks: Google content is not stored on our servers; your activity log keeps only the action and a one-way reference, no content.
• Analytics: data is kept in PostHog until we or you ask for it to be deleted.

9. Children's Privacy

BotVault is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. If we make material changes, we will notify you via email or through a notice on our website. The "Effective Date" at the top of this page indicates when the notice was last revised.

11. Contact Us

If you have questions or concerns about this Privacy Notice or your data, please contact us at:

Email: privacy@mybotvault.com

BotVault is a personal project by Martin Mexia. This service is not operated by a registered company.