Privacy policy

Qwickbot is an AI assistant that answers questions from a company's customers, collects contacts and books appointments on the company's behalf. atrigen.rs stands behind AtriBot and is referred to in this policy as “we”.

This policy covers the qwickbotai.com website, the client app at app.qwickbotai.com and the AI assistant that runs on our clients' websites and channels such as WhatsApp, Instagram and Messenger. It is written in line with the Law on Personal Data Protection of the Republic of Serbia, referred to below as the Law.

We have not appointed a data protection officer because the Law does not require us to. For any question about your data, write to us at kontakt@qwickbotai.com.

The Law distinguishes between the controller, who decides why and how data is processed, and the processor, who processes data on the controller's behalf. Our role depends on whose data it is.

• We are the controller for the data of visitors to this website, for data from the contact form and newsletter and for data about our clients' accounts.
• We are the processor for conversations the assistant has on a company's website or channel. For that data the company is the controller, and we process it only on its instructions and only to provide our service to it.

If you wrote to the assistant on a company's website, that company decides about your data, so please contact it first for access, correction or deletion. If you contact us instead, we will forward your request to the company without delay and help it respond. Our relationship with companies that use Qwickbot, including processing data on their behalf, is also governed by the Terms of use.

When you open this website, your browser sends the technical data it sends to every website, such as your IP address, browser and device type, the page address and the time of the visit. This data is processed by our hosting provider so the website can load and stay protected from attacks and abuse. The legal basis is our legitimate interest in running the website securely.

We don't use visitor analytics, advertising pixels or social media plugins that track visitors. Fonts are loaded from our own website, so your browser doesn't send requests to other companies because of them.

The data this website stores in your browser is described under Cookies and local storage.

Contact form

When you write to us through the form, we receive your name, email and website address or company name, and your phone number and message if you enter them. We use this data to reply to you and to agree on a trial or cooperation. The legal basis is taking steps at your request before entering into a contract, and for other questions our legitimate interest in replying to people who contact us.

Messages from the form reach us by email. We use your IP address only to limit the number of messages from the same address and keep it for no longer than one hour. We keep the correspondence while we are in contact, and if you don't become a client we delete it no later than one year after the last message.

Newsletter

For the newsletter we keep your email address and the time you subscribed, together with the IP address and browser details you subscribed from, as proof that the subscription was yours. The legal basis is your consent. You can unsubscribe at any time using the link in the newsletter or by writing to kontakt@qwickbotai.com, after which we stop sending it. Withdrawing consent doesn't affect the lawfulness of sending before the withdrawal. We keep this data until you unsubscribe.

For companies that use Qwickbot we open an account in the app at app.qwickbotai.com. There we process the following data.

• Names and emails of the people who use the account, the company name, website address and the details needed for invoicing.
• Assistant settings and knowledge base content, such as website texts, price lists and documents you give us.
• Access credentials for connected accounts, for example Google Calendar, which are stored encrypted.
• Data about logins and account use, such as time, IP address and browser, and records of important actions, for example changes to settings.

You sign in with a link sent to your email, with your Google account or with a passkey. When you sign in with Google we use and store only your name and email address. For a passkey we store only the public part of the key, and your fingerprint or face never leaves your device.

The legal basis is our contract with the company, our legal obligations related to accounting and our legitimate interest in protecting accounts from unauthorised access. We keep this data while the cooperation lasts. Records of logins and important actions are deleted automatically after 90 days, and invoices and other accounting records are kept for as long as accounting law requires.

This part is for people who write to the assistant on a company's website or channel. The company is the controller of this data, so its own privacy policy explains why it collects it and how long it keeps it. We process it on the company's behalf, as described here.

What data we process

• The messages you write and the assistant's replies.
• Details you write in the conversation yourself, such as your name, phone number and email address.
• Images and documents you send, if the company uses that feature.
• On websites, your IP address, country, browser, the page you are writing from and the page that referred you to it.
• On WhatsApp, Instagram and Messenger, the phone number or account identifier that the network passes to us.
• Details of an appointment you book, such as your name, contact, service and time.

Why we process it

• So the assistant can answer your question based on the information the company gave it.
• So the company receives your contact and the full conversation and can get back to you. The company sees your contact in its account and may also get an email notification.
• So the assistant can add an appointment to the company's calendar when you ask for one.
• To prevent abuse, for example by limiting the number of messages from one address and recognising attempts to make the assistant do something it shouldn't.

The system automatically estimates how specific a request is, for example whether you left a contact and asked about a price or an appointment, so the company knows whom to contact first. This estimate isn't used for decisions that have legal effects on you or affect you significantly.

AI models

To write a reply, the assistant sends an AI model provider your message, earlier messages from the same conversation and the parts of the company's knowledge base that relate to your question. Images and documents are sent to a model that can read them. We don't send your IP address or device details, but the model sees everything you wrote in the conversation.

We don't use your messages to train AI models. AI model providers process them under their own terms, and some of them may keep them for a limited time or use them to improve their services. That's why you shouldn't write health information, payment card numbers, passwords or other sensitive data to the assistant.

The assistant is an AI program, not a person. Its answers may be inaccurate or incomplete, so please check important details such as prices, appointments or terms directly with the company.

How long we keep it

We keep conversations, contacts and appointments while the company uses Qwickbot or until the company deletes them in its account. When the cooperation ends, we delete them within 30 days. Images and documents from conversations are deleted automatically after 30 days.

Your rights

Send requests to access, correct or delete conversation data to the company you talked to. If you don't know which company it was or you get no reply, write to us at kontakt@qwickbotai.com, tell us where and when you wrote to the assistant and which number or account you used, and we will forward your request to the company.

We don't sell data or give it to others for their marketing. We share it only with those we need to provide the service, and only to the extent they need it.

• Cloud infrastructure providers whose servers run the website, the app and the database, store files and search the knowledge base. The database with conversations is located in Europe.
• AI model providers, which write the assistant's replies and read images and documents.
• An email delivery provider, through which we send login links, notifications about new contacts and appointments and replies to messages.
• WhatsApp, Instagram and Messenger and the services that connect them to Qwickbot, when the assistant replies on those channels. Messages then also pass through their systems, under their terms.
• The company's Google Calendar, when the company connects its calendar and the assistant books an appointment.
• The company whose assistant had the conversation, which sees conversations, contacts and appointments in its account.
• Accountants and legal advisers, when needed, under a duty of confidentiality.
• Public authorities, only when the law requires it and based on an order from the competent authority.

We provide the list of service providers we use on request. We notify companies that use Qwickbot in advance when we add a new provider or replace an existing one.

Some of the providers listed above process data outside Serbia, in European Union countries, the United States and the People's Republic of China. Our infrastructure provider has servers around the world, so data in transit may also be processed on the server closest to the user.

European Union countries are on the list of countries with an adequate level of personal data protection. For the United States, adequate protection exists only for transfers to companies that have joined the Data Privacy Framework between the EU and the US, and the People's Republic of China is not on the list. Where there is no adequate protection, we rely on the safeguards set out in the Law when the provider offers them, and otherwise on the exception that allows a transfer necessary to provide a service the person has requested. You can learn more about the safeguards for a specific transfer at kontakt@qwickbotai.com.

Cookies and local storage are small records a website leaves in your browser. We use only those without which the website and the service wouldn't work the way you asked, so we don't ask for consent for them. We don't use cookies for tracking, analytics or advertising.

• This website remembers in local storage whether you chose the light or dark theme, until you delete it.
• Our hosting provider may set the __cf_bm and cf_clearance cookies on this website and when the assistant runs. They last only a short time and serve only to protect against automated attacks.
• The assistant on client websites keeps a conversation identifier in local storage so the conversation doesn't disappear when you reload the page. It lasts at most 24 hours, or 30 minutes after your last message. It also remembers whether you have seen the greeting message and whether the message limit has been reached. The assistant itself doesn't set cookies.
• The client app uses a session cookie that keeps you signed in for 30 days, and short 10 minute cookies while you log in.

You can delete cookies and local storage in your browser settings. The website will then forget your theme, the assistant will start a new conversation and the app will ask you to sign in again.

We keep data only as long as we need it for the purpose we collected it for, or as long as the law requires us to keep it.

• Messages from the contact form are kept while we are in contact, and if you don't become a client, for no longer than one year after the last message.
• Your newsletter email address is kept until you unsubscribe.
• Client account data is kept while the cooperation lasts and deleted within 30 days after it ends.
• Conversations, contacts and appointments are kept while we work with the company or until the company deletes them, and deleted within 30 days after the cooperation ends.
• Images and documents from conversations are deleted after 30 days.
• Records of logins and important account actions are deleted after 90 days.
• Invoices and other accounting records are kept for the periods required by law.

The database has backups, so deleted data disappears from them within 30 days of deletion.

• All communication with the website, the app and the assistant goes over an encrypted connection.
• Access credentials for connected accounts are additionally encrypted in the database with a separate key for each company.
• Each company's data is kept separate from other companies' data, and each company's knowledge base has its own index.
• Signing in to an account works without a password, using an email link, a Google account or a passkey, and sessions expire on their own.
• Only authorised members of our team have access to data, and only when it is needed for support or for running the service.
• We log logins and important account actions so we can spot unauthorised access in time.

No system is completely immune to attacks. If a data breach occurs that could put your rights at risk, we will notify the Commissioner and you when the Law requires it, and the companies whose data we process without undue delay.

For data for which we are the controller, you have the following rights.

• The right to know whether we process your data and to get a copy of it.
• The right to ask us to correct inaccurate data and complete incomplete data.
• The right to ask us to delete data when there is no longer a basis for processing it.
• The right to ask us to restrict processing, for example while we check whether the data is accurate.
• The right to receive the data you gave us in a common electronic format and pass it to another controller.
• The right to object to processing based on legitimate interest. If you object to receiving the newsletter or other marketing messages, we always stop.
• The right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
• The right not to be subject to a decision made solely by automated means if it has legal effects on you. We don't make such decisions.

Send your request to kontakt@qwickbotai.com. We reply without delay and no later than 30 days. When a request is complex or there are many requests, we may extend this by another 60 days, and we will tell you so within the first 30 days. Exercising your rights is free of charge. If we can't reliably confirm who sent a request, we will ask for additional proof of identity.

If you believe we process your data in breach of the Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, www.poverenik.rs. You also have the right to judicial protection.

If the EU General Data Protection Regulation also applies to the processing of your data, you have the same rights under it, including the right to lodge a complaint with the supervisory authority in the country where you live or work.

Qwickbot is intended for businesses. The assistant on client websites is not intended for people under 15. If we learn that a child under 15 has given us data without parental consent, we delete it.

We update this policy when the service or the law changes. The date the current version took effect is shown at the top of the page. We notify companies that use Qwickbot of significant changes by email at least 15 days before they take effect.

For any question about this policy or your data, write to us at kontakt@qwickbotai.com.