Privacy Policy

• Provide and improve the bot detection service
• Generate analytics dashboards for your account
• Maintain and update the bot catalog
• Send product and security notifications (you can opt out)
• Comply with legal obligations

We do NOT sell your data or your users' data to third parties.

Traffic telemetry is retained for 90 days by default on all plans. Account data is retained for the lifetime of your account plus 30 days after deletion. You can request earlier deletion at any time.

Records of changes made to an account or a site — who changed what, and when — are kept as an audit trail for as long as the account exists, including changes made through the Claude connector. An audit trail that expired would not be one.

We share data only with:

• Hosting infrastructure (cloud providers running our servers)
• Aggregated abuse signals (an IP address or TLS fingerprint, never linked to your identity or your site) with other Botscope customers, and vice versa. This processing is currently disabled platform-wide; once active, each site can turn sharing off independently at any time in its protection settings ("Community reputation" under Core Engine).
• Payment processors (for billing — we do not store card data)
• Legal authorities when required by law

A site owner can connect a Google Ads account and, separately, a Meta pixel. Neither is required, and nothing below happens without it.

• Google Ads, through Google's consent screen: we read the account's campaigns and conversion actions; add and remove IP exclusions for invalid clicks; retract the conversion of an order our verdict marked as a bot, when the owner switched that on; and, when the owner chose a click-import conversion action, upload a lead from a person as a conversion — its click id (gclid, gbraid or wbraid) and the time of the submission, nothing about the person. The refresh token is stored encrypted and deleted when the account is disconnected.
• Meta, with a Conversions API token the owner creates for their own pixel: we send a lead from a person as the event BotscopeVerifiedLead — its fbclid, the time of the submission and the landing page address, nothing about the person. The token is stored encrypted and deleted when the owner removes the integration.
• A lead from a bot, a suspect or a submission without a click id is never sent anywhere. Form contents are never sent to us at all: a site's backend checks a submission with a token, not with the form.

Our Claude connector and plugin let you ask Claude about web crawlers, and — if you sign in — about your own sites. Tool calls go to mcp.botscope.io, which forwards them to the Botscope API.

• Catalogue questions need no Botscope account and carry only the tool parameters: a bot name or slug, a search term, a User-Agent string with an optional IP address to check it against published ranges, or a robots.txt intent. The IP is used for that comparison and is not stored.
• Nothing about your conversation with Claude is sent beyond those parameters. The catalogue API does not write what you asked to its application log; the web server's access log records request paths under its normal retention.
• Questions about your own sites ask you to sign in on botscope.io first, where you choose which permissions to grant: list sites, read traffic summaries, read policies, and — optionally — change an agent's policy. Those calls send the site identifier and the tool parameters, and return aggregates. They never return your visitors' IP addresses or query strings.
• The connector can make one kind of change, and no other: one agent's policy on one site, with that permission granted and a role on the site that allows it. That change is written to the site's audit log — who changed which agent, from what to what — and kept as part of the account's audit trail.

All data is encrypted in transit (TLS 1.2+) and at rest. API keys are hashed. We conduct regular security reviews and follow responsible disclosure practices.

Depending on your jurisdiction (GDPR, CCPA, etc.), you may have the right to access, correct, export, or delete your data. To exercise any of these rights, use the contact form and pick "Privacy request".

The Botscope dashboard uses a single session cookie for authentication. We do not use tracking or advertising cookies. Our agent does not set cookies on your visitors' browsers by default (the session token is optional and configurable).

We'll notify registered users by email of any material changes. Continued use of the service after notification constitutes acceptance.