Botpress

Botpress states it does not use Conversation Data or End-User data for training, but explicitly uses aggregated Analytics Data and Usage Data for algorithm/model development. Free and paid tiers both subject to same analytics practices, but language around 'aggregated' data and model training creates moderate ambiguity about what constitutes protected vs. usable data.

“[Privacy] 'We do not use Conversation Data or other End-User personal data for any other purpose, which includes analytics and algorithms and model improvements or training.' BUT [ToS] 'Training and developing algorithms or models' is listed as permitted use of Analytics Data.”

Customer owns Customer Bots (section 8.3), but Botpress retains broad rights to use feedback without restriction and owns all Improvements to the Software. Professional Services deliverables are owned by Botpress unless they are Customer Bots. License scope is somewhat limited but feedback clause grants unrestricted usage rights.

“[ToS] 'Customer authorizes Botpress to use the Feedback without restriction' and 'Botpress is authorized to use or disclose...the Feedback for any purpose whatsoever, in any way whatsoever, on any medium whatsoever, anywhere in the world.'”

Botpress shares data with service providers under written confidentiality agreements and lists sub-processors in Schedule 3 of DPA. However, language permits sharing with 'Affiliates' and 'service providers' broadly, and sub-processor list is maintained on Trust Center (not fully transparent in documents). Analytics data may be used for product improvement without explicit customer consent restrictions.

“[Privacy] 'We share personal data with service providers that agree in writing to keep personal data confidential' and [DPA] 'Botpress maintains an up-to-date list of Sub-Processors on its Trust Center.'”

ToS states data may be deleted 30 days after termination, but DPA permits retention where required by law or on backup systems (which are 'securely isolated' but retention period unclear). Privacy Policy states data retained 'only as long as necessary' but does not specify concrete timeframes. Backup retention practices are vague.

“[ToS] 'Botpress may permanently delete Customer Data thirty (30) days after the termination of this Agreement.' [DPA] 'Botpress may retain copies of Personal Data where required by applicable law, or where Personal Data has been archived on back-up systems, which data will be securely isolated...and deleted in accordance with applicable deletion practices.'”

Botpress explicitly states that Customer owns all Intellectual Property Rights in Customer Bots (section 8.3), with Botpress assigning any IP rights created by its employees or subcontractors. This is a clear, enterprise-friendly ownership model with no vendor claims to generated outputs.

“[ToS] 'As between Customer and Botpress, Customer shall exclusively own the Intellectual Property Rights in and to Customer Bots. If Intellectual Property Rights in or to Customer Bots are initially owned by Botpress...Botpress agrees to assign to Customer any such Intellectual Property Rights as they are created.'”

DPA references GDPR compliance, Standard Contractual Clauses, and Data Privacy Framework self-certification, but no explicit SOC 2, ISO 27001, or HIPAA certifications mentioned in provided documents. Security measures are detailed in Schedule 2 of DPA, but formal third-party certifications are not explicitly claimed.

“[DPA] 'we rely on appropriate transfer mechanisms and are compliant with the EU-US, UK-US and/or Swiss-US Data Privacy Framework self-certification program' and [Privacy] 'Botpress has put in place organizational, physical and technical measures to secure the personal data...which you can find in Schedule 2 of our Data Processing Agreement.'”