Privacy Policy

Effective 19 September 2026 · Last updated 12 October 2026

This policy explains what personal data BotConfirm handles, why, and what rights you have. BotConfirm is operated by BMH DIGITAL LTD ("we", "us"), a company registered in England and Wales under number 16338088, with its registered office at 24-26 Arcadia Avenue, FIN0000, London, N3 2JU, United Kingdom.

1. Who this policy covers

These groups of people interact with BotConfirm:

• Merchants — businesses that create a BotConfirm account to confirm, ship and follow their orders. For merchant account data, we are the data controller.
• Team members — people a merchant invites to its account, such as call center agents. Their account data is handled like merchant data.
• Customers — people who placed an order with a merchant and whose order is handled through BotConfirm. For customer data, the merchant is the data controller and we act as their data processor, handling the data only to provide the service to the merchant.
• Visitors of botconfirm.com.

2. Data we process

Customer data received from the merchant's store or sheet:

• Name, phone number, delivery address and city of the person who placed the order
• Order details: products, quantity, amount, currency, order number, order date and any note on the order
• Order status (for example pending, confirmed, cancelled, shipped, delivered, returned), including the delivery status reported by the carrier
• Where the order came from (for example the ad platform in the order link), when the store provides it

Messaging data:

• The messages exchanged between the merchant and the customer on WhatsApp through BotConfirm: confirmation messages, chatbot and team replies, and files such as images or voice notes
• The customer's replies and when they were received
• Delivery status of messages (sent, delivered, read) as reported by WhatsApp
• Tags and notes the merchant adds to a customer

Call center data: the result of each call to a customer and the notes the agent writes.

Merchant account data:

• Business name, contact name, email address and phone number
• Names, email addresses and roles of team members
• The WhatsApp Business numbers connected to BotConfirm
• Store and carrier connection details (for example API keys or a webhook secret)
• What the merchant sets up in BotConfirm: automation rules, chatbots, message templates, products, stock and ad spend figures

Billing data: the merchant's plan, payment status, invoices and billing contact details. Card details are entered on a page run by Stripe and handled by Stripe. We never receive or store card numbers.

Technical data: like most web services, our servers may record technical data such as IP addresses and the time of each request, to keep the service running and secure.

We do not use advertising or tracking cookies, on botconfirm.com or on the BotConfirm dashboard. The website sets one cookie, bc_site_lang, to remember the language you chose. The dashboard keeps your sign-in session in your browser's storage.

3. Why we process it

• To send order confirmation and follow-up messages to customers on the merchant's behalf, and to record the customer's answer against the right order
• To let the merchant's team chat with customers and call those who did not answer
• To send parcels to the carrier the merchant chooses and bring back their delivery status
• To show merchants their orders, stock, confirmation and delivery rates, and message history
• To charge the subscription for the merchant's plan
• To operate, secure and troubleshoot the service
• To communicate with merchants about their account

Our legal basis for processing merchant data is the performance of our contract with the merchant and our legitimate interest in running the service. Customers' data is processed on the merchant's instructions; the merchant is responsible for having a lawful basis to contact its customers about their orders and to share their details with its carrier.

4. The providers we rely on

To provide the service, we share data with these providers, and only with the data each one needs:

• Supabase, which runs our database, account sign-in and file storage. Our database is hosted in the European Union (Paris, France).
• Meta Platforms, which operates WhatsApp. Messages are sent and received only through the official WhatsApp Business Platform, so the customer's phone number and the message content go through Meta. Meta's handling of messages is governed by the WhatsApp Business Terms.
• 360dialog GmbH (Germany), an authorised WhatsApp Business Solution Provider, which relays messages between BotConfirm and WhatsApp when the merchant connects its number through 360dialog.
• Stripe, which processes subscription payments. Stripe receives the merchant's billing details and handles card data.
• The carriers the merchant connects, today Ozon Express, Ameex, Sendit, Cathedis and Digylog in Morocco. When the merchant sends a parcel, we give that carrier the customer's name, phone number, address and city, the amount to collect and the order note.
• The tools the merchant connects: its Shopify or WooCommerce store, and its Google Sheets through Google. Order data moves between BotConfirm and these tools as the merchant sets up.

We do not sell personal data and we do not share it with anyone else, except where the law requires it.

5. International transfers

BotConfirm serves merchants in Morocco and other countries. Data may be processed in the United Kingdom, the European Union, Morocco (by the carriers the merchant uses) and, through Meta and Stripe, in other countries where they operate, including the United States. Where data leaves the UK or EU we rely on the safeguards provided by our providers, including standard contractual clauses.

6. How long we keep data

• Order and message records are kept while the merchant's account exists, so the merchant can consult its history
• When a subscription ends, the account and its data stay in place, so the merchant can come back to it. Only the paid plan stops
• A merchant can ask us at any time to delete its account and its data, including customer records. We do so within 30 days, unless we must keep some of it to comply with the law
• A merchant can ask us to delete specific customer records at any time
• Billing records are kept as long as tax and accounting law requires

7. Security

Data is transmitted over encrypted connections (HTTPS). Access to the systems that store data is restricted to the people who need it to run the service. Merchant credentials and API keys are stored separately from application code and are never shared.

8. Your rights

Under UK and EU data protection law you can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive a copy of it. If you are a customer of a merchant, the quickest route is to contact that merchant; you can also contact us and we will assist. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

If you no longer want to receive WhatsApp messages from a merchant, reply to that merchant's message asking to stop, or block the number in WhatsApp.

9. Children

BotConfirm is a business service and is not directed at anyone under 18. We do not knowingly process children's data.

10. Changes to this policy

We may update this policy as the service evolves. The date at the top shows the latest version. Significant changes are communicated to merchants by email.