Privacy & data.
How the application handles information. The business operating a chatbot is responsible for its visitor privacy notice and requests.
What is stored
Account email and a password hash; chatbot settings; uploaded sources and extracted knowledge; conversation messages; and visitor details collected through configured lead fields. Provider API keys are encrypted in the database. Bot knowledge, settings, and conversations are scoped to individual bots.
When content goes to an AI provider
Local Ollama processing runs on the deployment. If a bot uses a configured cloud provider, its relevant source excerpts, messages, or source samples may be transmitted for responses, embeddings, persona generation, and context analysis. That provider’s retention and processing terms also apply. Do not upload secrets or unnecessary sensitive personal information.
Google actions and owner recaps
A chatbot may offer email delivery or meeting booking when its owner connects Google and enables those actions. The visitor reviews the recipient and booking details and must explicitly confirm before Xedbot calls Gmail or Google Calendar for those requested actions. Separately, an owner may enable automatic conversation recaps for a selected bot. When enabled, captured lead details and a discussion recap are emailed to that bot’s connected Google account after the chat ends or becomes idle. The widget discloses this before visitors chat. OAuth tokens, short-lived action payloads and results are encrypted in Xedbot. Delivered email, calendar invitations and events are also processed and retained by Google under the connected account’s settings.
Browser storage
The studio uses session storage for the signed-in session and local storage for the chosen color theme. The widget stores a random browser identifier so returning visitors can reopen recent chats; it expires after three days of inactivity. The widget also remembers whether a visitor completed or skipped its optional lead form. No advertising tracking is added by this interface.
Control and deletion
Account holders can export a bot’s visitor data and erase stored conversations, visitor profiles, action records and recap delivery records from Privacy & data. Pause the bot before erasing visitor data. Google events and delivered mail must be managed in the connected Google account. Deleting a bot also removes its sources, settings, vectors, lead fields and encrypted Google connection. Visitors should contact the business operating the chatbot to request access or deletion.
Retention and backups
Chat messages, action records and recap delivery records are available for up to three days and are regularly removed from the active database after that period. Lead details shared through configured fields are retained for up to 90 days. Uploaded knowledge remains until removed. Encrypted backup copies follow a separate lifecycle; deleting active records does not rewrite existing backups.
AI accuracy and sensitive information
AI responses may be incomplete or incorrect. Avoid sharing sensitive information in chat and verify important answers with the business. Prompt instructions reduce unwanted behavior but cannot guarantee every model response.
For Xedbot account or privacy enquiries, contact the Xedbot team.