This policy tells you exactly what IAM.bot collects, why, who can see it, how long we keep it, and how to export or delete it. If you have a question not answered here, email privacy@iam.bot.
1. Who we are (Controller)
The data controller is Inkwell Technology Studios, the company behind IAM.bot. Contact: privacy@iam.bot.
2. What we collect and why
Account data — name and email address, for authentication and communication. Legal basis: contract performance.
Conversation data — messages you send to IAM.bot and its replies. Stored in your private memory graph (Neo4j AuraDB), scoped to your identity only. Legal basis: contract performance; your explicit consent to memory storage.
soul.md / identity graph — the values, projects, and context you provide. Stored encrypted, accessible only to you and the model processing your requests. Legal basis: explicit consent.
Usage signals — which surfaces (WhatsApp, web, Claude, etc.) you connect and when. Used only to route your sessions correctly. Legal basis: legitimate interest (service delivery).
Technical logs — IP address, timestamps, error traces. Retained 30 days, used only for security and debugging. Legal basis: legitimate interest (security).
3. What we do NOT collect
We do not sell, rent, or license your data to third parties.
We do not use your conversations to train shared models.
We do not build advertising profiles or cross-product profiles.
We do not use your data for automated adverse decisions (credit, insurance, employment).
4. Who can see your data
You — always, via export.
The AI model processing your request — in-context only, scoped to your session, governed by our data processing controls.
Subprocessors — Neo4j AuraDB (graph storage, EU/US), Anthropic (Claude model inference, US), Google Cloud (infrastructure, US/EU). Full list at security.html#subprocessors.
Law enforcement — only when legally compelled; we will notify you unless prohibited.
5. Retention
Conversation data: retained as long as your account is active.
After account deletion: all personal data deleted within 30 days from our systems; we will confirm deletion by email.
Technical logs: 30 days.
Backups: purged within 90 days of deletion request.
6. Your rights
Depending on your jurisdiction (GDPR, CCPA, UK GDPR, and others), you have the right to:
Access your data
Correct inaccurate data
Delete your data ("right to be forgotten")
Export your data in a portable format
Restrict or object to processing
Withdraw consent at any time (without affecting lawfulness of prior processing)
Lodge a complaint with your supervisory authority
To exercise any right: email privacy@iam.bot. We will respond within 30 days.
7. Export your data
You can request a full export of your soul.md, memory graph, and conversation history at any time by emailing privacy@iam.bot with the subject "Data Export Request." We will deliver a machine-readable archive (JSON + Markdown) within 7 business days.
In-product export controls are coming in a future release.
8. Delete your account
To delete your account and all associated data: email privacy@iam.bot with the subject "Delete My Account." We will confirm deletion within 30 days and purge all backups within 90 days.
9. Transfers
Your data may be processed in the United States and European Union. For EU/UK users, transfers to the US are governed by Standard Contractual Clauses (SCCs) with our subprocessors.
10. Education / students (FERPA)
If IAM.bot is deployed in a school or university context, your institution's data processing agreement governs student education records. IAM.bot does not share student data with third parties for commercial purposes. FERPA rights are preserved. For COPPA: IAM.bot is not directed at children under 13 and we do not knowingly collect data from children under 13.
11. Changes to this policy
We will notify you by email at least 14 days before any material change. The updated policy will be posted here with a new effective date.