Privacy Policy
Last updated 2026-08-17
BusinessBots ("we", "us") is the data controller for personal data collected through the Sorted platform at https://automation.baseuse.xyz. This policy explains what we collect, why, and your rights under UK GDPR / EU GDPR.
1. What we collect
From you (the business owner)
- Account details: name, email, password (hashed, never stored in plain text)
- Business details: business name, location, description, industry
- Billing details: handled directly by Stripe — we store a Stripe customer reference, not card numbers
- OAuth tokens for connected channels (WhatsApp, Instagram, LinkedIn, Google Business Profile), encrypted at rest
From your leads and customers (processed on your behalf)
- Phone numbers and message content sent via WhatsApp
- Names, where provided in conversation
- Engagement data from social posts (aggregate metrics only — not individual follower data)
For this category, you (the business) are the data controller and we act as your data processor. A Data Processing Agreement is available on request — legal@automation.baseuse.xyz.
2. Why we process this data
- Contract performance — providing the Service you've subscribed to
- Legitimate interest — service improvement, fraud prevention, security monitoring
- Legal obligation — tax and accounting records
- Consent — marketing communications, which you can opt out of at any time
3. Who we share data with
We share data with the following sub-processors, each engaged under appropriate safeguards (Standard Contractual Clauses where data leaves the UK/EU):
We do not sell personal data to third parties.
4. How long we keep data
Account and business data is retained for the life of your subscription plus 90 days after cancellation, after which it is deleted unless a longer period is required for legal or tax purposes. Lead/conversation data follows the same retention unless you request earlier deletion.
5. Your rights
Under UK/EU GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (editable directly in Settings for most fields)
- Request deletion of your account and associated data
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent for marketing communications at any time
To exercise any of these rights, email privacy@automation.baseuse.xyz. We respond within 30 days as required by law.
6. Security
OAuth tokens and payment credentials are encrypted at rest. Access to production data is restricted to authorized personnel. We recommend enabling a strong, unique password for your account.
7. Cookies
See our Cookie Policy for details on cookies and similar technologies used on this site.
8. Supervisory authority
If you're unsatisfied with how we've handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.
9. Contact
Data protection queries: privacy@automation.baseuse.xyz