Privacy Policy

Benzos ("we", "us", or "our") operates chat.benzos.uk, an AI chatbot platform that lets businesses create, deploy, and manage AI assistants across channels such as a website chat widget and Facebook Messenger. Data controller: Benzos — Benzo Labs. Contact for privacy matters: support@benzos.uk Website: https://chat.benzos.uk EU representative (GDPR Art. 27): because we are established outside the EU but offer our Service to people in the EU, an EU-based representative will be appointed where required by GDPR Article 27. Until then, privacy requests may be sent to support@benzos.uk and will be routed accordingly. [Placeholder: name + EU postal address of the appointed representative.]

We act in two different capacities, and this determines who you must contact: • As a processor — for the conversations you have with a chatbot operated by one of our business customers. The business (our customer) decides why and how your chat data is used and is the controller; Benzos only processes it on their instructions. If you chatted with a business's bot, that business is your first point of contact for data requests, though we also enable them (and, where technically possible, you) to export or erase that data. • As a controller — for our own platform accounts (business admins and their staff), billing, security logs, and website analytics that are not carried out on a customer's instructions. This part of the notice describes our own processing. Where we act as a processor, we act only on documented instructions from the controller and are bound by a Data Processing Agreement (Art. 28 GDPR).

We may collect the following categories of personal data: • Contact & identity data: name, email address, phone number, and Messenger profile information you choose to share with a bot. • Chat / conversational data: the messages you send and receive through our chatbots, including any files you upload. • Technical & usage data: device type, browser, IP address, timestamps, and interaction patterns needed to operate and secure the Service (e.g. rate limiting). • Account data (business users): company details, administrator credentials, and configuration settings provided by our business customers. • Payment & billing data (business users): handled by our payment provider; we store limited billing records such as invoices and token usage.

We process personal data only where a lawful basis exists under GDPR Art. 6(1): • Performance of a contract — to provide, operate, and maintain the Service, respond to your chat messages, and fulfil our agreement with business customers (Art. 6(1)(b)). • Legitimate interests — to secure the Service (fraud, abuse, and rate-limit prevention), to fix and improve the Service, and to defend legal claims. These interests are balanced against your rights (Art. 6(1)(f)). • Legal obligation — to comply with applicable law, accounting, and lawful requests from authorities (Art. 6(1)(c)). • Consent — for any specific processing we identify as consent-based (for example, optional product communications). You may withdraw consent at any time (Art. 6(1)(a)). We do not sell your personal data, do not use your personal messages to train external AI models without your consent, and do not use them for advertising.

The chatbots on our platform are AI systems. In line with the EU AI Act (Regulation (EU) 2024/1689, Art. 50), you are informed that you are interacting with an AI system — this is shown to you at the start of your very first interaction with a bot and whenever an AI (rather than a human agent) is handling the chat. Your messages are processed by the AI model provider configured for the relevant bot in order to generate a reply. Where a bot is operated by one of our business customers, that customer chooses the provider and is responsible for the processing instructions. We do not use our chatbots to make decisions that produce legal effects or similarly significantly affect you on a solely automated basis. You can ask to be transferred to a human agent at any time. If your message asks for a human, the conversation is routed to a live operator instead of the AI.

We are established outside the EU and use service providers in several countries. Where personal data is transferred outside the EEA, we rely on an appropriate transfer mechanism under GDPR Chapter V — in the first place the European Commission's Standard Contractual Clauses (SCCs, Decision (EU) 2021/914/EC), accompanied by a Transfer Impact Assessment (TIA) and supplementary technical and contractual measures (encryption in transit and at rest, access minimisation). Some AI model providers we support — including DeepSeek — are located in third countries for which no adequacy decision exists. Where such a provider is used, this is disclosed to the business customer, who chooses whether to enable it, and transfers are governed by the safeguards described above. Where you chat with a bot that uses such a provider, your message content is transmitted to that provider to generate the reply. You can request more detail about safeguards for a specific transfer at support@benzos.uk.

We share personal data only as necessary: • With the business that operates the chatbot you are messaging, so that it can serve you. • With our sub-processors — hosting infrastructure, database and storage providers, email delivery, and AI model providers — under contract. • With professional advisers, or where required by law, regulation, or valid legal process. • In connection with a merger, acquisition, or sale of assets, with notice where required. An up-to-date list of our sub-processors and the safeguards applying to them is available on our Sub-processors page: https://chat.benzos.uk/subprocessors

We retain personal data only as long as necessary for the purposes described above: • Conversation / chat messages — kept for the retention period configured for the relevant bot or our default period (currently up to 24 months from the last activity), unless deleted earlier at your or the controller's request. • Business account data — for the duration of the account and then for as long as required for legal and accounting purposes. • Security / rate-limit logs (including IP address) — for a short period (currently up to 30 days) for security and abuse prevention. • Billing records — as required by tax and commercial law. When retention expires, data is deleted or irreversibly anonymised. We erase chat data sooner on a valid erasure request (see Your Rights below).

Subject to applicable law, you have the right to: access your data (Art. 15); rectify inaccurate data (Art. 16); erase data ("right to be forgotten", Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing based on legitimate interests (Art. 21); and not to be subject to solely automated decisions (Art. 22). Where processing is based on consent, you may withdraw it at any time. How to exercise your rights: email support@benzos.uk. We will verify your request and respond within one month, extendable by two further months for complex requests, and will tell you if we do so. If your request relates to a conversation with a business's chatbot, we will forward it to that business as controller and assist it as processor. You also have the right to lodge a complaint with the data protection authority in your country of residence (a list is available on the EDPB website) or, where an EU representative has been appointed, with the authority in the representative's Member State.

We keep tracking to a minimum. • Strictly necessary storage: our chat widget stores a conversation identifier and an unread-count in your browser's localStorage so that your chat is preserved when you navigate or refresh a page. This storage is necessary to provide the chat service you requested and does not require consent under the ePrivacy Directive (Art. 5(3)). We do not store your name, email, or message content in your browser's localStorage for this purpose. • No advertising or third-party tracking cookies are set by the widget or the platform, and we do not run advertising or cross-site profiling. • If we ever introduce optional cookies (for example analytics), we will ask for your consent first and let you refuse.

We implement appropriate technical and organisational measures (GDPR Art. 32) including encryption in transit, access controls and tenant isolation, rate limiting, password and authentication policies, and regular dependency updates. No method of transmission or storage is 100% secure; we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority without undue delay and within 72 hours where required (Art. 33), and inform affected individuals where the risk is high (Art. 34).

When you use our chatbots on Facebook Messenger, your interaction is subject to this Privacy Policy, the Meta Platform Terms, and Meta's own privacy policy. We receive messaging data through Meta's Messenger Platform APIs solely to deliver and respond to your conversations, and we comply with Meta's Platform Terms and Messenger Platform Policies, including requirements on data use, storage, and deletion.

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal data from children. If you believe we have collected information from a child, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Where changes affect processing carried out on the instructions of a business customer, we will also inform that customer.

If you are in Georgia, the Law of Georgia on Personal Data Protection (No. 3144, adopted 14 June 2023, in force since 1 March 2024) also applies. It is closely aligned with the GDPR, so the rights and obligations described above apply in the same way. The following Georgia-specific points supplement this policy: • Supervisory authority — the supervisory authority for personal data protection in Georgia is now the State Audit Office of Georgia (the functions previously exercised by the Personal Data Protection Service were transferred to it with effect from 2 March 2026). You may lodge a complaint there, or with the authority in your country of residence. • Withdrawal of consent — where processing is based on your consent, you may withdraw it at any time, and we will stop the processing within 7 working days of receiving your request. • Data protection officer — where the law requires us to appoint a Data Protection Officer (for example, because of systematic monitoring), the officer's identity and contact details will be published on this page and registered with the supervisory authority. [Placeholder: DPO name + contact once appointed.] • Special representative — where Georgian law requires a special representative to be appointed and registered with the supervisory authority, we will do so before processing. [Placeholder: representative details.] • Data breach — we keep a record of all data-security incidents and notify the supervisory authority without undue delay where the incident poses a risk to your rights and freedoms.

For any question, request, or concern about this Privacy Policy or your data: Benzos Privacy Team Email: support@benzos.uk Web: https://chat.benzos.uk EU representative: [to be appointed — see Section 1] Data Protection Officer: [to be appointed — see Section 15]