1. Who we are
Ultimo Bots is operated by Ultimo Bots GmbH, Stegmattstrasse 11, 6033 Buchrain, Switzerland. For any privacy question, write to build@ultimo-bots.com.
This policy explains how we handle personal data from two groups:
- Agent owners, who build and run AI agents on our platform.
- Website visitors, who chat with those agents.
We follow the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
2. What we collect
From agent owners
Name, email, hashed password, optional company name, IP address, browser and device information, the website content or files you upload for training, your agent configuration, subscription and billing data, usage logs, and support conversations.
From website visitors
Chat messages, timestamps, browser and device data, IP address, referring URL, and anything a visitor chooses to enter, such as name, email or phone number.
From connected Webflow sites
If you install our Webflow app, Webflow gives us an access token for the sites you authorize, your Webflow account email and name, and the IDs and domains of those sites. We use them only to create or find your Ultimo Bots account, to list your sites in the dashboard, to name your first agent after the site you pick, to add our chat script to the site you pick and remove it again, to see when a site was last published so the dashboard can tell you a change is waiting, to publish a site when you click "Publish site" in the dashboard, to check every hour that the access is still valid, and to make sure the script answers only on the domains of your authorized site. The token is stored encrypted and is never sent to your browser.
When you disconnect Webflow in the dashboard, we remove our chat script from your sites' custom code (it leaves the live site when you publish) and unlink Webflow from your Ultimo Bots account. So that you can connect again without approving the app in Webflow again, we keep the token encrypted for at most 30 days, usable only from the browser you disconnected in and only for the same account, and then delete it; to end the app's access at once, uninstall it in Webflow. If you uninstall or revoke the app in Webflow, the token stops working immediately, our hourly check notices it within about two hours and we delete the token then. Your Ultimo Bots account and agents stay until you delete them. After a disconnect or an uninstall we keep only the IDs of those sites, marked as closed, so your agent no longer answers there.
Who is responsible: agent owners are the data controllers for their visitors’ data and are responsible for informing visitors and obtaining any required consent. Ultimo Bots GmbH acts as a data processor on their behalf.
3. Why we process it
- To run and improve the platform.
- To let owners manage and measure their agents.
- To build new features and improve our AI.
- To keep the service secure and reliable.
- To meet legal and accounting obligations.
- To provide onboarding, support and service notifications.
4. Legal basis
- Performance of our contract with you.
- Our legitimate interests, such as analytics, security and product development.
- Legal obligations, such as accounting.
- Your consent, where the law requires it (for example cookies or marketing).
5. Who we share it with
We never sell or rent personal data. We share the minimum needed with trusted subprocessors that help us run the service:
- Microsoft Azure – hosting, infrastructure and storage.
- Stripe – subscription billing and payments.
- OpenAI (or an equivalent provider) – to generate agent replies.
- Google Workspace – internal communication, onboarding and support.
- Analytics tools – to monitor performance and usage.
We may change subprocessors, as long as they meet FADP and GDPR requirements and sign the appropriate agreements (DPAs and, where relevant, SCCs).
6. How long we keep it
We keep personal data only as long as needed for the purposes above, including legal compliance and dispute resolution. Some data may be kept after an account is closed where the law requires it.
7. How we protect it
- Encryption of data in transit and at rest.
- Access controls and activity logging.
- Role-based access and firewall protection.
- Secure cloud infrastructure on Microsoft Azure.
If a data breach occurs, we notify affected users as required by law.
8. Your rights
Under the GDPR and FADP you can:
- Access and correct your data.
- Request deletion, restriction or portability.
- Object to certain processing.
- Withdraw consent where processing is based on it.
Website visitors should contact the relevant agent owner directly. Owners can reach us at build@ultimo-bots.com.
9. Cookies
We use cookies and similar technologies for login sessions, analytics and security. You can disable cookies in your browser, and consent banners appear where required.
10. International transfers
Your data may be processed outside Switzerland or the EU by our subprocessors. Where it is, we rely on appropriate safeguards such as DPAs and Standard Contractual Clauses.
11. Updates
We may update this policy from time to time. For material changes we will notify you by email or in the platform, so it is worth checking back now and then.
12. Contact
Ultimo Bots GmbH
Contact: Robert Klöpsch
Stegmattstrasse 11, 6033 Buchrain, Switzerland
build@ultimo-bots.com
Meta advertising measurement
We use the Meta Pixel from Meta Platforms Ireland Limited on our website and portal to measure page visits, clicks to Wix, completed registrations, checkout starts and confirmed Wix trial starts. Measurement starts automatically without an opt-in prompt. Previous choices stored by the former Meta consent dialog are not used by this version. Meta receives technical connection data, browser identifiers (_fbp, _fbc), event timestamps and event categories. We do not deliberately send names, email addresses, passwords, authentication tokens or customer content. Meta may associate events with your account and process information outside your country. Advertising attribution and event deduplication records are retained for up to 90 days. Browser settings and tracking blockers can restrict measurement. Other services are described separately in this policy.