Who we are
MotherBot is operated by Thinkbix Technologies Private Limited, a company registered in India. Throughout this page, “MotherBot”, “we” and “us” refer to that entity.
We act as the Data Controller for personal data collected through our website, our marketing activities and our own customer accounts.
For personal data processed through the MotherBot platform on behalf of our customers — for example their contacts’ WhatsApp messages — we act as a Data Processor, and our customer is the Data Controller. Our Data Processing Addendum governs that relationship, with the transfer terms below.
Legal entity: Thinkbix Technologies Private Limited
Trading as: MotherBot
Registered in: India
Address: Baner Business Bay, Baner, Pune, Maharashtra 411045, India
Data protection contact: hello@motherbot.io
Legal Bases for Processing
We process personal data under the following legal bases (Article 6 GDPR):
What Personal Data We Collect
- Account data — name, email address, password (hashed), organization name.
- Billing data — payment method details (tokenised by Razorpay, our payment processor — we never store card numbers), billing address, invoices.
- Usage data — features used, actions taken, timestamps, API requests.
- Communication data — messages you send to our support team.
- Technical data — IP address, browser type, device identifiers, cookies (see Cookie Policy).
- WhatsApp contact data — phone numbers and message content processed on behalf of our customers (as Data Processor).
Data Retention
| Data Type | Retention Period |
|---|---|
| Account, contacts and messages | While the account exists. Erased from live systems as soon as you delete the account, and from backups as they expire |
| Call details | 14 days |
| Team activity records | 90 days |
| Support chats | 48 hours |
| Billing and tax records | 8 years (Indian company and GST law) |
Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights:
Right of Access (Article 15)
You have the right to request a copy of all personal data we hold about you, and information about how we process it.
→ Email hello@motherbot.io from the address on your account.
Right to Rectification (Article 16)
If the data we hold about you is inaccurate or incomplete, you have the right to request we correct it.
→ Update your details in account Settings or contact support.
Right to Erasure / 'Right to be Forgotten' (Article 17)
You can request that we delete your personal data where there is no compelling reason for us to continue processing it.
→ Delete your account yourself in Settings → Security → Delete account, or email hello@motherbot.io.
Right to Restrict Processing (Article 18)
You can ask us to restrict how we process your data in certain circumstances, for example if you contest its accuracy.
→ Email hello@motherbot.io.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another controller.
→ Export your contacts and reports from the app, or email hello@motherbot.io for a copy of the rest.
Right to Object (Article 21)
You can object to us processing your data for direct marketing purposes, or where we rely on legitimate interests as our legal basis.
→ Email hello@motherbot.io.
Rights re: Automated Decision-Making (Article 22)
You have the right not to be subject to decisions made solely by automated processing that produce significant effects on you.
→ MotherBot does not use solely automated decision-making for consequential decisions.
We will respond to all rights requests within 30 days. In complex cases we may extend this by a further two months — we'll inform you if this is the case. We may need to verify your identity before processing the request.
International Transfers and Sub-processors
MotherBot is based in India. Our main database is in India (Mumbai) and our application servers are in Singapore. The full list of sub-processors and where they are is in our Data Processing Addendum.
When personal data is transferred from the EU or EEA to us, the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) apply between you and us: Module Two where you are the controller and we are your processor, and Module One where we are a controller. For transfers from the UK, the UK Addendum to those Clauses applies. They are incorporated into our agreement by reference. Write to hello@motherbot.io for a signed copy.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction, including:
- Encryption in transit (HTTPS/TLS) and encryption of the database and file storage at rest
- Passwords and extension access tokens stored only as one-way hashes
- Role-based access for team members, and optional two-step verification
- Staff access to production data is need-to-know only, and recorded
- Hosting with providers that hold independent security certifications (see our sub-processor list)
- A breach response plan: we notify supervisory authorities within 72 hours where GDPR requires, and affected people without undue delay
Lodging a Complaint
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority:
- EU/EEA: your national Data Protection Authority (list at edpb.europa.eu)
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- India: the Data Protection Board of India, under the DPDP Act 2023
We encourage you to contact us first at hello@motherbot.io so we have the opportunity to resolve your concern.