Privacy Policy
Effective June 21, 2026.
Plain-language summary
ProBot is a free, open-source AI chatbot that turns your resume into a conversational representative. The shortest version of this policy:
- We collect the minimum needed to give you an account and run your bot - typically your email, your display name, your profile image (if you signed in with Google or GitHub), and the content you upload.
- Your LLM API key is kept encrypted with envelope encryption. It is never logged in plaintext.
- We do not sell your data. We do not share it for advertising. We do not read individual conversations or leads for any purpose other than security or your explicit support request.
- Use the in-app Settings → Security & privacy → Delete account button. We schedule the deletion immediately and give you a 7-day grace period during which you can cancel via the link we email you (or by visiting the “Undo deletion” page directly). After the grace period elapses your account, bots, knowledge bases, conversations, leads, encrypted keys, and audit logs are permanently removed by our nightly purge job.
- Email us at vishalpatil.imp@gmail.com if you cannot access the dashboard. We will trigger the same scheduled-deletion flow on your behalf and confirm via email.
Who operates ProBot
ProBot is operated by Vishal Patil, an individual, non-commercial maintainer of an open-source project. There is no company, no investors, and no employees behind it. For all privacy, data-access, or deletion requests, the operator is the data controller and is reachable at vishalpatil.imp@gmail.com.
Data we collect
We collect only what the product needs to function. Concretely:
Account data
Email address, display name, and (optionally) a profile image. These come from your sign-in provider (Google, GitHub) or from the form you complete during password sign-up. We also assign you a username so your bot can have a public URL.
Bot content
Resume PDFs, LinkedIn URLs, portfolio links, and any text you add as knowledge. This is chunked, embedded into vectors, and stored so your bot can answer questions about you.
Conversations and leads
When a visitor chats with your bot, the messages are stored so you can review them later in your dashboard. If a visitor provides their email and name as a lead, those are stored too - visible only to you, the bot owner.
Authentication tokens
Session cookies and OAuth tokens for as long as you remain signed in. We do not log the contents of your sessions.
What we do NOT collect
Your LLM API key is kept encrypted with envelope encryption and never logged in plaintext. We do not run analytics or behavioural trackers. We do not collect your IP address for marketing. We do not buy data about you from anyone.
Google Sign-In data
This section explains, specifically and in plain English, how ProBot handles data obtained when you sign in with Google.
What we request from Google
ProBot requests only the standard OpenID Connect scopes: openid, email, and profile. We do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service.
What we store from Google
Your email address, your display name, your profile image URL, and the provider account ID Google issues. These fields populate your ProBot account and let you sign in again next time.
How we use Google data
Strictly to authenticate you and to display your own account information back to you (e.g. your name on your dashboard). We do not use Google data for advertising. We do not train AI models on Google user data. We do not transfer it to anyone for unrelated purposes.
Limited Use compliance
ProBot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access
You can revoke ProBot's Google access at any time from your Google Account permissions page. Revoking access prevents future sign-ins but does not delete the account data already stored with ProBot - for that, request deletion as described below.
How we use your data
We use the data we collect only to:
- Create and maintain your account, and let you sign back in.
- Power your bot: chunk and embed your uploaded content so it can be retrieved when a visitor asks a question.
- Show you your own dashboard: bots, conversations, leads, notifications.
- Send you account-related email (magic-link sign-in, lead notifications you have opted into). We do not send marketing email.
- Investigate and prevent abuse, fraud, or violations of the Terms of Service.
Third-party services
ProBot relies on a small number of third-party services to function. Each is named here so you can review their own privacy policies if you wish:
- Supabase - managed PostgreSQL hosting for your account data, bot content, and conversations.
- Vercel - application hosting and edge networking.
- Google and GitHub - optional OAuth sign-in providers.
- Resend - transactional email delivery for magic-link sign-in and notifications.
- Your chosen LLM provider (Anthropic, OpenAI, Google AI Studio, etc.) - invoked from your own browser using your own API key, never proxied through our servers.
We do not sell, rent, or share your personal data with any third party for their own purposes. Data passes to these services only insofar as needed for them to perform their function for you.
Storage & retention
Account data and bot content are retained for as long as your account exists. Conversations and captured leads are retained for as long as the associated bot exists.
If you delete a bot, its conversations, leads, knowledge chunks, and any stored encrypted LLM key are removed immediately. If you delete your account, all of the above plus your account record are scheduled for permanent deletion after a 7-day grace period during which you can undo the request via the email link we send. After the grace period our nightly purge job removes the data permanently and sends a completion email to confirm. The full elapsed window from request to total erasure is at most 30 days.
We may keep minimal records longer where required by law - for example, a record that an account existed and was deleted on a given date, for audit purposes.
Your rights & deletion
Depending on where you live, you may have rights under laws such as the EU/UK GDPR, the California CCPA, the Maryland Online Data Privacy Act, or similar regimes - including the right to access, correct, port, restrict, or delete the personal data we hold about you, and to withdraw consent.
The fastest way to delete your account or download your data is from the dashboard: Settings → Security & privacy exposes both an “Export my data” button (JSON of every row associated with your account) and a “Delete account” button that kicks off the 7-day grace period described above. To exercise any of these rights via email instead, write to vishalpatil.imp@gmail.com from the address associated with your account; we will trigger the same flow on your behalf and confirm completion within 30 days.
You can also disconnect Google or GitHub sign-in from the provider's own account settings, which prevents future sign-ins through that provider.
Security
Data is transmitted over HTTPS. Account passwords (when used) are hashed with bcrypt. LLM API keys are envelope-encrypted at rest and never logged in plaintext. No system is perfectly secure, however, and we cannot guarantee absolute security. If you become aware of a vulnerability, please report it to vishalpatil.imp@gmail.com.
Children
ProBot is not directed at and not intended for use by anyone under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data to ProBot, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. When we do, we will update the “Effective” date at the top of the page. For material changes that affect how we handle your personal data, we will notify signed-in users via the dashboard before the change takes effect.
Contact
Privacy questions, data-access requests, deletion requests, or anything else covered by this policy: vishalpatil.imp@gmail.com. ProBot is governed by the laws of the State of Maryland, United States.