Privacy Policy
Last updated: March 19, 2026
1. Overview
TamaleBot is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights. TamaleBot operates as an open-core platform: the agent runtime is open source (Apache 2.0), and the managed cloud service is subject to this policy.
2. Data We Collect
| Data Type | What | Purpose | Retention |
|---|---|---|---|
| Account Data | Email address, account ID | Authentication, communication | Until account deletion |
| Agent Configuration | Agent name, model, system prompt, integration settings | Service operation | Until agent deletion |
| API Keys | LLM provider keys (encrypted) | Agent operation (BYOK model) | Until agent deletion |
| Conversation Data | Messages sent to/from agents | Agent operation, audit trail | Configurable (default: 30 days) |
| Usage Metrics | Message counts, API calls per agent | Billing, rate limiting, analytics | 12 months |
| Page Views | Anonymized page view counts | Service improvement | 90 days |
3. Data We Do NOT Collect
- We do not use cookies for tracking or advertising
- We do not share data with third-party advertising networks
- We do not sell your data to anyone
- We do not train AI models on your agent conversations
4. How We Store Data
- Agent data: Stored in isolated Cloudflare Containers with encrypted storage (R2). Each agent runs in its own container with no access to other agents' data.
- API keys: Encrypted and injected as environment variables at runtime. Never logged or stored in plaintext.
- Account data: Stored in Cloudflare KV with access restricted to authenticated requests.
- Audit trails: Signed, append-only logs stored in per-agent SQLite databases within containers.
5. Third-Party Services
TamaleBot uses the following third-party services:
- Cloudflare: Infrastructure (Workers, Containers, R2, KV). Data is processed in Cloudflare's global network. See Cloudflare's Privacy Policy.
- Resend: Transactional email (login codes, deploy notifications). Only your email address is shared. See Resend's Privacy Policy.
- LLM Providers: When your agent processes messages, the content is sent to your chosen LLM provider (Anthropic, OpenAI, Google, etc.) using your API key. Review their privacy policies for details on how they handle data.
6. Your Rights
You have the right to:
- Access: View all data associated with your account
- Correction: Update your account information
- Deletion: Delete your account and all associated data
- Export: Request an export of your data
- Objection: Object to data processing for legitimate interests
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
7. Self-Hosted Users
If you self-host the TamaleBot open-source runtime, no data is sent to TamaleBot or any third party. All data remains on your infrastructure. This privacy policy applies only to the managed cloud service (tamalebot.com).
8. Children
TamaleBot is not intended for use by children under 13. We do not knowingly collect data from children under 13.
9. Changes
We may update this policy from time to time. Material changes will be communicated via email. The "last updated" date at the top reflects the most recent revision.
10. Contact
Privacy questions? Email [email protected].