Privacy Policy

Version 2026-10-09

1. Controller

DM Butler

This policy covers our website and your DM Butler account. For the messages of your customers that DM Butler handles for you, you are the controller and we are your processor under the Data Processing Agreement.

2. What we process and why

• Account: phone number, name, workspace details, sign-in records. To provide the contract (Art. 6(1)(b) GDPR).
• Billing: legal name, address, VAT ID, invoices and payments. To perform the contract and meet tax retention duties (Art. 6(1)(b) and (c)); invoices are kept for up to 10 years.
• Consent records: which terms you accepted, when and from which IP address, to prove it (Art. 6(1)(c) and Art. 7(1)).
• Pre-registration: your phone number and optional business details, only to tell you when we launch (Art. 6(1)(b), steps before a contract). Deleted after launch or on request.
• Contact form: your name, phone number and message, to answer you (Art. 6(1)(b) or (f)). Deleted 12 months after the request is closed.
• Product news by email: only if you opted in (Art. 6(1)(a)). You can withdraw at any time in your profile or through the link in each email.
• Security logs: IP address and request metadata to protect the service (Art. 6(1)(f)), kept for up to 90 days.

3. Cookies

We only use cookies that are strictly necessary: the session cookie, a security token, your language choice and your light/dark preference. We use no advertising or analytics cookies, so no consent banner is needed.

4. Artificial intelligence

Customer messages and your approved knowledge are sent to the AI providers listed below to generate replies. They may not use this data to train their models. Your customers are told that they are talking to an AI assistant.

5. Recipients and transfers

We use these service providers (sub-processors). Transfers outside the EU/EEA are based on an adequacy decision or the EU Standard Contractual Clauses.

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time with effect for the future. You can export your data and delete your workspace yourself under Settings → Data, or contact us. You may also complain to a data protection supervisory authority, in particular in your EU country of residence.

7. Children

DM Butler is a service for businesses and is not directed at anyone under 18. We do not knowingly collect data of children for our own purposes.

8. Security

Data is encrypted in transit; channel tokens and payment keys are also encrypted at rest. Access is limited to staff who need it and is logged.