Privacy Policy.
Last updated 25 August 2026
1. Who we are
SixtyBot (“SixtyBot”, “we”, “us”) provides a subscription software platform that lets marketing and web agencies generate personalised, interactive demonstrations of AI assistants for their own prospective clients.
SixtyBot is operated by James Chudleigh, trading as SixtyBot, a sole trader. For any privacy matter, contact privacy@sixtybot.com.
This policy covers sixtybot.com and the SixtyBot application, including demo pages we host on your behalf.
2. The two roles we act in
This distinction matters, because different rules apply to each.
We are a controller for information about our own customers — the agencies who hold a SixtyBot account. We decide why and how that information is used.
We are a processor for information an agency collects through the demos it creates using SixtyBot. That includes the contact details left by people who fill in the enquiry form on a demo. The agency is the controller of that information; we process it on their instructions in order to provide the service. Our customers should have their own privacy notice covering it, and a data processing agreement is available on request from privacy@sixtybot.com.
3. What we collect
3.1 Account and billing information (we are controller)
- Name, email address and password (passwords are handled by our authentication provider and stored only as a hash — we never see them)
- Agency or business name, and an optional contact phone number
- A device recognition hash: a salted, one-way hash of your IP address and browser user-agent, used to recognise devices you sign in from. We do not store the raw IP address for this purpose.
- Subscription status, plan, renewal dates and invoice history
- Card details are never sent to or stored by us. Payments are handled entirely by Stripe; we hold only a Stripe customer reference and the status Stripe reports back.
3.2 Information you give us about a prospective client (we are processor)
When you create a demo you supply a business’s website address and optionally its Facebook, Instagram or Google Business Profile link. We then retrieve publicly available information about that business — page content, images, a screenshot of the site, and its public Google rating and review count — and use it to generate a personalised demo and a private Opportunity Report.
We do not attempt to access anything behind a login, a paywall, or otherwise non-public.
3.3 Information collected through demos (we are processor)
- Enquiry details, where a visitor chooses to submit them: business name, contact name, email address, phone number, an optional message, and whether they ticked the contact-consent box
- Engagement events, which are not linked to an identified person: that a demo was viewed, a chat or voice conversation was started, which feature tabs were explored, and whether a call-to-action was opened
- Conversation content: messages typed into a demo’s chat, and speech during a voice conversation
3.4 Voice conversations
Voice runs in the visitor’s own browser using their microphone, and only after they choose to start it. It is not a telephone call, and we place no calls and send no text messages to anyone at any time. Audio is processed in real time by our voice provider (ElevenLabs) to produce the assistant’s replies.
Our voice provider processes the audio under its own terms in order to return a reply, and its handling of that audio is governed by its own privacy policy.
4. Why we use it, and our legal bases
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the platform and your account | Performance of a contract |
| Taking payment and preventing fraud | Contract; legal obligation; legitimate interests |
| Generating demos and Opportunity Reports | Contract (with our customer) |
| Recognising your devices for account security | Legitimate interests (securing accounts) |
| Enforcing usage limits and preventing abuse | Legitimate interests (protecting the service) |
| Service emails (verification, password reset, billing) | Contract |
| Improving and debugging the service | Legitimate interests |
Where we rely on legitimate interests, we have considered the impact on you and believe our interests do not override your rights. You can object at any time — see section 8.
We do not sell personal information, and we do not use it for automated decision-making that produces legal or similarly significant effects.
5. Who we share it with
We use the following processors. Each acts on our instructions under contract.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | United States |
| Vercel | Application hosting and analytics | US / global edge |
| Stripe | Payment processing and subscription billing | US / global |
| ElevenLabs | AI voice conversations | US |
| Vercel AI Gateway (routing to model providers) | Generating demo content, chat replies, business summaries | US |
| Upstash | Rate limiting and short-lived caching | See section 6 |
| ScreenshotOne | Capturing a screenshot of a public website | See section 6 |
| Google Maps Platform | Public business rating and review counts | US / global |
We also disclose information where we are legally required to, or to establish or defend legal claims.
6. International transfers
Several of the providers above are based in, or process data in, the United States. Where personal information leaves the UK or EEA we rely on appropriate safeguards — such as the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or a provider’s certification under the EU–US Data Privacy Framework.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and billing records | While your account is open, then six years — the period UK tax law generally requires financial records to be kept |
| Demos and generated content | While your account is open, or until you delete the demo |
| Enquiry details captured through a demo | On our customer's instructions; deleted when the demo or account is deleted, or on request |
| Engagement events | 24 months |
| Device recognition hashes | Until the device is revoked or the account is closed |
8. Your rights
Depending on where you live, you may have the right to access your information, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent where we rely on it.
UK and EEA. You have these rights under UK and EU GDPR. You can also complain to the Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.
United States. Depending on your state — including California, Colorado, Connecticut, Virginia and others — you may have rights to know, delete, correct and obtain a copy of your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act. We will not discriminate against you for exercising any right.
Australia. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988. You may access and correct your information, and complain to the Office of the Australian Information Commissioner (oaic.gov.au).
If your details were captured through a demo created by one of our customers, that agency controls the information. Contact them first; if you contact us we will pass your request to them and assist as required.
To exercise any right, email privacy@sixtybot.com.
9. Security
We use encryption in transit, database-level access controls that isolate each customer’s data, hashed credentials, and hashed rather than raw device identifiers. Access to production systems is limited to those who need it.
No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.
10. Cookies and similar technologies
We use cookies that are necessary for the service to function — keeping you signed in, and remembering your display currency preference. We also use privacy-friendly product analytics to understand aggregate usage.
11. Children
SixtyBot is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.
12. Changes
We will post any changes here and update the date above. If a change materially affects how we use your personal information, we will tell account holders directly.
13. Contact
privacy@sixtybot.com · James Chudleigh, trading as SixtyBot.