Privacy Policy

Summary

• What we collect: your email address, a salted password hash, an optional display name, and the title, URL, description, and favicon of each AI assistant page you choose to save. See Section 1.
• What the extension reads: only the title, URL, description, and favicon of the supported AI platform page you are on, and only when you open the popup or save. It never reads chat messages, form inputs, cookies, or credentials, and it is inactive on every other website. See Section 1.2.
• How we handle it: we use it to run your account and saved library, process billing, answer support requests, prevent abuse, and — only with your opt-in — send product updates. We do not sell personal information and we do not use your data to train AI models. See Section 2.
• How we store it: in Supabase (PostgreSQL, United States), encrypted at rest and in transit. Your extension sign-in tokens are stored locally in chrome.storage.local on your own device and are never sent anywhere except to Supabase to authenticate you. See Section 7.
• Who we share it with: only four service providers that operate the Service — Supabase, GoHighLevel, Vercel, and Upstash. Never with advertisers, data brokers, or marketing analytics platforms. See Section 3.
• How long we keep it, and how to delete it: while your account is active; delete your account from Settings or by emailing support@mybotbin.com and we remove it from our database and our CRM. See Sections 5 and 6.

1. Information We Collect

1.1 Information You Provide

When you create a MyBotBin account, we collect:

• Email address
• Password (stored as a salted hash; we never see or store the plaintext)
• Optional display name

When you save an AI assistant to your library, we collect the title, URL, description, and favicon/OG image of the page you saved, plus any tags or folder assignments you create.

1.2 Information Collected by the Chrome Extension

The MyBotBin Chrome extension runs a content script on 17 supported AI platform hosts, covering 13 AI platforms — the exact list is in the extension's manifest file and is shown by Chrome before you install. On those pages, when you open the popup or save an assistant:

• We read the page title, URL, page description, and favicon/OG image
• We do not read chat messages, form inputs, cookies, credentials, or any other page content
• The scripting permission is used as a fallback to inject the content script when the declarative script does not activate due to single-page-app navigation timing
• The storage permission is used to keep your Supabase authentication tokens (access_token and refresh_token) in chrome.storage.local. These tokens persist until you sign out of the extension or uninstall it.

The extension does not activate or read any data on websites other than the supported AI platform hosts. In particular, it never reads the text of your prompts, the model's replies, or any other conversation content. Descriptions come from the page's own og:descriptionor meta name="description" tag, or from an assistant or project's published description — never from a message. The extension's build refuses to package a release whose content script references conversation markup, so this is enforced rather than promised.

The extension also holds permission for mybotbin.com itself. That permission exists solely so the extension can call our own API to save an assistant and to receive your sign-in session; no content script runs on our site, and the permission grants the extension no access to any other website.

1.3 Infrastructure-Level Data

Our hosting providers automatically log certain data when you access the Service:

• Vercel logs request timestamps, IP addresses (used for rate limiting), and HTTP response codes
• Supabase logs database operations performed against your account

The MyBotBin application itself does not run analytics tracking (we do not use Google Analytics, PostHog, or similar services on the application surface), and we do not track browser type, operating system, page view history, or referring URLs as application-level data.

2. How We Use Information

We use the information we collect to:

• Provide and maintain your account and saved library
• Process subscription billing and changes
• Respond to support requests
• Send you product updates and offers, only if you have opted in (you can change this anytime in Settings)
• Detect and prevent abuse, fraud, and security incidents
• Comply with legal obligations

We do not sell your personal information. We do not use your data to train any AI model.

3. Data Sharing — Third-Party Service Providers

We share limited data with the following processors strictly to operate the Service:

Supabase (database and authentication)

• Data shared: all account data (email, hashed password, saved assistants, folders, tags, subscription state)
• Purpose: primary database and authentication backend
• Privacy policy: https://supabase.com/privacy
• DPA: Standard Data Processing Addendum executed; available on request.

GoHighLevel (CRM and payment processing)

• Data shared: email, first name, last name, subscription status (free/pro), subscription events (upgrade, cancellation, refund)
• Purpose: account management, billing operations, and customer support workflows
• When transmitted: at signup, subscription upgrade, subscription cancellation, refund, and account deletion
• Privacy policy: https://www.gohighlevel.com/privacy-policy
• DPA: in place or being executed

Vercel (hosting)

• Data shared: all HTTP request data, including IP addresses
• Purpose: application hosting and serverless function execution
• Privacy policy: https://vercel.com/legal/privacy-policy

Upstash (rate limiting)

• Data shared: request identifiers (typically IP address or hashed user identifier) and request counts
• Purpose: abuse prevention via rate limiting
• Privacy policy: https://upstash.com/trust/privacy.pdf

We do not share your data with advertisers, data brokers, or marketing analytics platforms.

4. Geographic Availability

MyBotBin is currently available only outside the European Economic Area (EEA), the United Kingdom, and Switzerland. Visitors from these regions are redirected to a notice page and cannot create accounts. If you reach the application from outside these blocked regions and later relocate, please contact us at support@mybotbin.com. This Privacy Policy and our Terms of Service remain publicly accessible from every region.

We are working on expanding availability to additional regions and will publish updates here.

5. Data Retention

• Account data and saved assistants: retained while your account is active
• Account deletion: when you delete your account, your data is removed from Supabase and the corresponding contact record is permanently deleted from GoHighLevel
• Vercel infrastructure logs: retained per Vercel's standard retention (typically 30 days)

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Export your data — available from the Settings page in the application; export is delivered as a JSON file containing your assistants, folders, tags, and settings. Extension-stored authentication tokens are not included — they exist only in your local browser storage and are cleared on sign-out.
• Correct inaccurate data via your account settings
• Delete your account and all associated data via the Settings page or by contacting support@mybotbin.com

To exercise any of these rights, use the in-app controls or email support@mybotbin.com. We aim to respond to all requests within 30 days.

7. Data Storage and Security

Account data, saved assistants, folders, and tags are stored in a Supabase PostgreSQL database hosted in the United States. Application code runs on Vercel's United States infrastructure. Rate-limiting counters are held in Upstash. The Chrome extension stores only your Supabase access_token and refresh_token, in chrome.storage.local on your own device; these are cleared when you sign out of the extension or uninstall it, and they are transmitted only to Supabase to authenticate your requests.

We use industry-standard security measures including:

• TLS encryption for all data in transit (HSTS-enforced)
• Encryption at rest for Supabase-hosted data
• Hashed passwords (we never store plaintext passwords)
• Rate limiting on authentication and write endpoints
• Content Security Policy headers
• Restricted CORS allowlist (extension and main domain only)

No system is perfectly secure. If you believe your account has been compromised, contact support@mybotbin.com immediately.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us so we can delete it.

9. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated via email to active accounts.

10. Contact

For privacy questions, requests, or concerns:

• Email: support@mybotbin.com
• Mailing address: 18047 Beach Blvd, Suite 1087 Huntington Beach, CA 92648, USA