GreekChatbots Privacy Policy

1. Who is responsible for this service

GreekChatbots is operated by PIKIS AGENTS. Business address: Εριφύλης 5-9, Agios Dimitrios, Greece. For privacy questions, requests, or complaints, contact info@pikistech.gr.

In many cases, the owner of a specific chatbot may also act as an independent controller for the messages, appointment requests, and contact details submitted by visitors to that chatbot.

2. Information we collect

• Account data: email address, hashed password, account verification state, and account identifiers.
• Chatbot setup data: assistant name, persona, greeting, uploaded files, design choices, training text, URLs, and deployment settings.
• Visitor conversation data: text messages, transcripts, generated replies, and session identifiers.
• Audio or video data: recordings or media streams when microphone, camera, transcription, or voice reply features are enabled.
• Contact and scheduling data: names, phone numbers, appointment details, and messages submitted through chatbot tools.
• Technical data: browser-supplied time zone, cookie values, local storage identifiers, and basic server logs.

3. How we use the information

• To create, configure, host, and improve chatbots.
• To generate chatbot prompts from website content or manually provided knowledge.
• To answer visitor questions and provide text, audio, or video responses.
• To create, find, and delete appointments when calendar features are enabled.
• To forward visitor messages to the chatbot owner by email when contact-email features are enabled.
• To maintain session continuity, reduce abuse, troubleshoot issues, and monitor service quality.

4. Cookies, local storage, and session handling

The service uses cookies and browser local storage to keep chat sessions working. The current implementation uses identifiers such as chat_session, client_id, and local storage keys for chat session tracking, consent state, and client continuity.

Public chatbot pages currently display a consent banner before continued use. If a visitor clears a session, session cookies and stored browser identifiers may be removed, although short-lived runtime memory or logs may persist temporarily for operational reasons.

5. AI, speech, email, and calendar providers

Depending on the selected configuration, data may be sent to third-party service providers that help deliver chatbot functionality.

• Google Gemini for prompt generation and chatbot responses.
• OpenAI or OpenRouter when those model providers are enabled.
• Soniox for speech-to-text and text-to-speech features.
• Google Calendar for appointment creation, lookup, and deletion when the owner connects a calendar.
• Gmail SMTP for sending verification or owner-notification emails.
• Redis, if enabled, for session storage.

If Google Calendar is connected, the application may store OAuth tokens and the connected account email needed to access calendar event tools. Calendar events created by the appointment tools currently use the internal event title format name-phone.

6. Website crawling and uploaded training material

When a user asks the platform to crawl a website, the service retrieves and processes content from the supplied URL, may combine text from multiple pages, and may send that text to an AI model to create or refresh chatbot knowledge.

Uploaded files, manually entered training text, and crawled material may be stored in the chatbot workspace to support future prompt generation, previewing, deployment, and editing.

7. Retention

GreekChatbots chat-session cookies and session identifiers are configured to expire after approximately one hour of inactivity. If a chatbot owner clears a chat session, the active session record for that chatbot session is deleted when the clear action is processed.

Account records, chatbot configuration data, training files, generated prompts, deployment assets, and workspace files are retained while the related account or chatbot remains active. Google Calendar OAuth tokens are retained until the chatbot owner disconnects Google Calendar or the related chatbot workspace is deleted. Verification emails and owner-notification emails remain in the configured mailbox until deleted by the mailbox owner. Operational logs and diagnostic traces remain on the active server until rotated, overwritten, or manually removed during maintenance. Manual backup copies, if created by the operator, are retained until they are replaced or deleted.

8. Legal bases and user rights

Depending on the context, processing may rely on consent, contract performance, legitimate interests, or compliance with legal obligations. If GDPR, UK GDPR, or similar laws apply, users may have rights to access, correct, delete, restrict, object to, or port their data, and to withdraw consent where consent is the legal basis.

If CCPA/CPRA or similar laws apply, users may have rights to know, delete, correct, and limit certain uses of personal information, subject to applicable exceptions.

9. Google user data disclosure

If Google Calendar features are enabled, GreekChatbots uses information received from Google APIs only to identify the connected Google account and to create, find, and delete calendar events requested through the user-facing appointment features. GreekChatbots does not use Google API data for advertising and does not sell Google API data.

10. International transfers and security

Service providers may process data in countries outside the visitor's own jurisdiction. GreekChatbots uses HTTPS for the public service and supported third-party API connections, bcrypt hashing for account passwords, server-side sessions, SameSite=Lax session cookies, per-user and per-chatbot workspace separation, account-gated dashboard access, scoped Google OAuth token storage per chatbot workspace, and an 8 MB upload limit for user-submitted files. No method of transmission over the Internet or electronic storage is completely secure.

11. Contact

Privacy requests and questions about GreekChatbots can be sent to info@pikistech.gr. We may ask for reasonable information to verify the identity of the requester before acting on a privacy request.