AFPConnectPrivacy Policy
What we collect when you use AFPConnect and AFP.bot, why, and the choices you have.
Last updated October 29, 2026
Who we are and what this covers
AFPConnect and AFP.bot are run by BotPro Technologies (“we”, “us”). This policy covers afpconnect.com, afp.bot, the apps at app.afpconnect.com and app.afp.bot, and the bots you make and use there (together, “AFP”).
It explains what we collect, why, who helps us run AFP, and the choices you have. If you have a question, ask us through the Support page in your account (app.afpconnect.com/support).
What we collect
Your account
Your email address, an optional name, and the record of how you signed in. Passwords and one-time sign-in codes are handled by Amazon Cognito; we never see or store your password. You can add a display name, a short bio, a profile photo and notification preferences.
Your bots
What you give a bot: its name, face, voice, skills and settings. If you upload a photo for a bot’s face, we keep it and use AI models to read it and draw the face.
Conversations and memory
The messages you exchange with your bots and in rooms, and the images and files you send. A bot can remember things you tell it so it can help you later; you can see, edit and delete those memories, or turn memory off.
Accounts you connect
If you connect an account such as Gmail, Outlook or Google Calendar, the connection is held by a connection service (see “Who helps us run AFP”). We keep the account’s name and an identifier, not your password. When you ask your bot to do something with that account, we use access granted by the service to read or change only what the task needs, such as finding emails or saving a draft.
Websites your bot uses for you
If you sign in to a website for your bot, you sign in on the real website yourself. We keep that website’s session (its cookies and site storage), sealed for that bot and that site, so the bot can continue there. We never store the password. Files the bot downloads for you are kept so you can open them.
Voice
If you talk to your bot by voice, your browser connects directly to OpenAI’s real-time voice service, which also transcribes what you say. We do not keep recordings.
Text messages
If you add a phone number to text your bot, we keep the number, whether you verified it, when you agreed to receive texts, and when you opted out, along with the messages.
Businesses and their websites
For a business account we keep the business’s details, its websites, the bots it publishes and what they know about the business. People who chat with a business’s bot on its website are not asked to sign in; we know them only by a random identifier stored in their browser.
Usage and logs
We record how much each bot uses AI models, so we can enforce limits and, later, bill fairly. Our servers keep technical logs to run AFP securely and fix problems. We record important actions, such as a change a bot made to your email after you approved it, so you and we can see what happened.
We do not use advertising or analytics trackers, and we do not collect your precise location.
How we use it
- To run AFP: to sign you in, run your bots, keep your conversations, and do the tasks you ask for.
- To keep you in control: to ask for your approval before a bot sends, buys, deletes or changes something on your behalf, and to show you what it did.
- To keep AFP safe: to prevent abuse, enforce limits, and investigate problems.
- To support you, and to tell you about changes to your account or to AFP.
We do not sell your personal information, and we do not share it for advertising. We do not use your conversations, memories or connected accounts to train AI models. Your personal memories and connected accounts are never used when your bot works for a business, or when a bot is shared or lent to someone else.
AI models
Your bots run on AI models from Anthropic (Claude) and OpenAI. To answer you, we send them what the task needs: your message, the conversation so far, relevant memories, and the content your bot reads for you. They process it to give us a response; under their API terms, they do not use it to train their models.
AI can be wrong. Check important answers before you rely on them.
Who helps us run AFP
We share information with these providers only so they can run parts of AFP for us:
| Provider | What they do |
|---|---|
| Amazon Web Services | Servers and database (in the United States), sign-in (Cognito), backups, and email to bots’ own addresses |
| Cloudflare | Hosts our websites and apps, stores photos and bot images, and protects our servers |
| Anthropic, OpenAI | AI models, web search, voice and images |
| Composio, Pipedream, Arcade | Hold the accounts you connect, such as Gmail or Outlook |
| Twilio | Text messages, if you use them |
We may also share information when the law requires it, to protect people from harm or to protect AFP, or as part of a merger or sale of our business, in which case this policy continues to apply to it.
What you share
Some things are shared because you choose to share them: a link to chat with your bot, a room you invite people to, or a business bot that answers visitors on your website. Whoever you share with can see what you shared with them. You can stop sharing at any time.
Cookies
We use only the cookies AFP needs to work. We do not use advertising or analytics cookies.
| Cookie | Why | How long |
|---|---|---|
afp-session, afp-auth, afp-pending | Keep you signed in | 12 hours, or 30 days if you choose to stay signed in |
afp-csrf | Protect your account from forged requests | 2 hours |
afp-visitor | Lets a business’s bot continue your chat on its website | 180 days |
afp-guest | Lets you join a room you were invited to | 30 days |
afp_workspace, afp_last_website, afp-theme, afp-text-size | Remember your choices | Up to 1 year |
How long we keep it
We keep your account information while you have an account. Some things are deleted sooner:
- Images you attach in a chat: 1 day if never sent, 30 days after sending.
- Files a bot downloads for you: 30 days.
- Email sent to a bot’s own address: 30 days.
- Website sessions you signed in to for a bot: after 30 days without use.
- Database backups: 14 days.
When you delete a conversation, a memory or a bot, we delete it; deleting a bot also deletes its memories and website sessions. Copies in backups are removed as those backups expire. We may keep records of important actions longer, for security and legal reasons.
Your choices and rights
- See, edit and delete your bots, conversations and memories in the app, and turn memory off.
- Disconnect any connected account at any time; we ask the connection service to remove it.
- Sign out of every device at once.
- Ask us for a copy of your information, to correct it, or to delete your account and its information, through the Support page in your account (app.afpconnect.com/support).
Depending on where you live, you may have further rights over your personal information, such as the right to object or to complain to a data protection authority. We will not treat you differently for using them.
Security
We protect your information with encryption in transit, separated data for each account, strict access controls, and approvals before bots take consequential actions. No system is perfectly secure; if something goes wrong that affects your information, we will tell you as the law requires.
Children
AFP is not for children. You must be at least 18 years old to use it, and we do not knowingly collect information from anyone younger. If you believe a child has given us information, tell us and we will delete it.
Changes and contact
If we change this policy, we will update the date at the top, and tell you in the app or by email before a significant change takes effect.
For any privacy question or request, contact BotPro Technologies through the Support page in your account (app.afpconnect.com/support).