Privacy policy

This explains what personal data Botlight collects, why, and your rights. Botlight is run by the operator of Botlight in the United Kingdom, which is the data controller. Contact: abishek.abi07@gmail.com.

What we collect

• Account: your email address, used to sign you in with a magic link and to contact you about your account.
• Webflow connection: an access token for the Webflow sites you authorise (stored encrypted), the site names and URLs you import, and the published pages and CMS items we read from them to build your llms.txt.
• Generated files: the llms.txt and llms-full.txt we produce. These are served publicly at your hosted URL by design.
• Billing: your plan and subscription status. Card details are handled entirely by Stripe and never reach our servers.
• Usage: sync history, AI usage (how many AI requests and tokens your account uses), and counts of AI crawler visits to your hosted file by crawler name and day. We do not store visitor IP addresses for these counts.
• Free grader: the website address you enter and the resulting report. Your IP address is stored only as a salted hash, to rate-limit scans.
• Cookies: only the essential cookies that keep you signed in. We do not use advertising or analytics cookies.

Why we use it

• To provide the service you asked for: generating, hosting and refreshing your files, and running billing (contract).
• To keep the service secure and prevent abuse, such as rate-limiting the grader (legitimate interests).
• To email you about failed syncs or a broken Webflow connection. You can turn these alerts off on the Billing page (legitimate interests).
• To understand usage and plan pricing, using aggregated AI usage and crawler counts (legitimate interests).
• To meet legal and tax obligations, such as keeping invoices (legal obligation).

Who we share it with

We use these service providers (processors) to run Botlight. They only process data on our behalf.

• Supabase: database and sign-in (hosted in London, UK).
• Vercel: application hosting and delivery of your hosted files.
• Stripe: payments and subscriptions.
• Anthropic: AI text generation. When AI enhancement is turned on for a site, excerpts of your page content are sent to Anthropic to write descriptions and section names. The free grader sends the scanned site's title, description and findings. Anthropic does not use API inputs to train its models by default.
• Inngest: background job scheduling (job data contains site identifiers, not page content).
• Resend: sending sign-in and alert emails.
• Webflow: the platform you connect; we read your published content through its API.

We do not sell personal data. Some providers are based outside the UK; where they are, transfers rely on the UK International Data Transfer Addendum or an adequacy decision.

How long we keep it

• Removing a site deletes its imported content, generated files, history and counts.
• Disconnecting Webflow deletes the stored access token.
• If you ask us to delete your account, we delete your data except what we must keep by law (for example invoices, typically six years).
• Grader scan records (site address, report, hashed IP) are kept to enforce rate limits and cache results. Ask us if you want yours removed.

Security

Webflow access tokens are encrypted at rest. Data is protected in transit with HTTPS, and access to the database is restricted by row-level security so accounts can only read their own data.

Your rights

Under UK GDPR you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent where we rely on it. Email abishek.abi07@gmail.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, tell you by email.