GDPR & Data Subject Rights

This page applies to any data subject whose personal data flows through JestBot: the account holders and agents who use the dashboard and agent panel, and the end visitors who chat with a widget or fill out its pre-chat lead form. For our general data-handling practices, see our Privacy Policy; this page focuses specifically on how to actually exercise your rights, step by step.

Under GDPR, the roles differ depending on whose data is involved:

• For account holder and agent data, JestBot is the data controller — we decide why and how that data is processed to run the platform.
• For widget visitor and lead data, the business that owns the bot is generally the data controller (they decide what to collect and why), and JestBot acts as a data processor on their behalf, processing that data only to power the bot and platform features.

This distinction determines who you should contact first — see Sections 6–7.

• Account holders: name, email, hashed password or Google auth identifier, billing details processed via Razorpay
• Agents: name, email, login credentials, performance stats (assigned/resolved/missed conversations, points) tied to their account
• Leads/visitors: name, email and/or phone submitted via a bot’s pre-chat form, verification status, and the content of their conversation with the bot
• Widget session metadata: hashed IP address, domain, referrer, and country (where available, e.g. behind Cloudflare)

For account holders and agents, we process data under the legal basis of contract (it’s necessary to provide the service you’ve signed up for) and, for analytics, legitimate interest in improving the product. For widget visitor/lead data, the legal basis is set by the bot owner as controller — typically consent (via the pre-chat form) or their own legitimate interest in responding to a customer inquiry.

Under GDPR/UK GDPR, you have the right to:

• Access — get a copy of the personal data we hold about you and how it’s used
• Rectification — correct inaccurate or incomplete data
• Erasure (“right to be forgotten”) — request deletion of your personal data, subject to any legal retention obligations (e.g. billing records for tax purposes)
• Restriction — ask us to limit how your data is processed in specific circumstances, such as while a dispute about its accuracy is resolved
• Portability — receive your data in a structured, commonly-used, machine-readable format, and have it transmitted to another controller where technically feasible
• Objection — object to processing based on legitimate interest, including analytics processing
• Withdraw consent — where processing is based on consent (e.g. a lead form), withdraw it at any time without affecting the lawfulness of processing before withdrawal

You can access and correct most of your own data directly from Dashboard → Settings without needing to file a formal request. Deleting your account from Settings → Account cascades and permanently removes your bots, documents, conversation history, and leads — this fulfills an erasure request without needing to contact support, though billing transaction records may be retained separately for a limited period as required for tax/accounting compliance, consistent with GDPR’s allowance for retention where legally required.

Agent accounts are created and managed by the account holder who added you to their team. To access, correct, or request deletion of your agent data, you can contact that account holder directly, or contact JestBot and we’ll assist in routing the request appropriately, since the account holder controls team membership.

If you’ve chatted with a JestBot-powered widget or submitted its lead form, your data is controlled by the business that owns that bot, as explained in Section 2 — JestBot processes it on their behalf as a processor. To exercise a data right over that conversation or lead record, you can either:

• Contact the business directly (they control the data and can action most requests themselves), or
• Contact JestBot via the process in Section 10, and we’ll route the request to the relevant bot owner and assist as processor in fulfilling it, including performing deletion at the infrastructure level once instructed.

Where personal data is transferred outside the EU/UK — for example, to our hosting infrastructure or, where you’ve enabled BYOK, to a model provider located outside the EU/UK — we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s own equivalent certifications, consistent with GDPR’s requirements for international transfers. See our Subprocessors page for the specific providers involved.

Submit a request via the contact page with subject line “Data Subject Request,” the specific right you’re exercising, and enough detail to locate your data — your account email if you’re an account holder or agent, or the bot/domain you interacted with if you’re a visitor or lead.

We aim to respond within 30 days, as required under GDPR (extendable by a further two months for complex requests, with notice to you explaining why). We may ask for reasonable verification of your identity first — such as confirming access to the email address on file — to avoid disclosing personal data to the wrong person.

If you’re not satisfied with how we’ve handled your request, you have the right to lodge a complaint with your local data protection supervisory authority — for example, your national Data Protection Authority within the EU, or the ICO in the UK. We’d appreciate the chance to resolve any concern directly first via the contact process above.