Privacy Policy

1. Who We Are

cellbot is operated by Ampliflow Ltd, registered in England and Wales under company number 16384356. Our registered office is 221 Haunch Lane, Birmingham, B13 0PJ, United Kingdom. We provide an AI-powered platform for tech repair & tech sales businesses.

Privacy contact: Ampliflow Ltd
Contact: hello@cellbot.chat

When we are a controller or processor

We are the controller when we decide why and how to process information about website visitors, account holders, business contacts, affiliates, billing, support, security, and our own service operations. When a repair shop uses cellbot to handle its customers' enquiries, bookings, repairs, messages, or connected inbox, the shop is normally the controller and Ampliflow Ltd acts as its processor. The shop is responsible for its own privacy notice and lawful basis; we process that data under the shop's instructions and the data processing terms in our Terms of Service.

2. What Data We Collect

We collect and process the following categories of personal data:

• Shop account and business contact data — account-holder and staff names, work contact details, role, shop details, subscription, support requests, and account settings
• Customer data — name, email address, phone number (collected during repair bookings via the chat widget)
• Device information — device brand, model, and repair type for quoting and booking purposes
• Repair history — repair status, timeline events, parts used, and completion dates
• Payment data — payment amounts and statuses (card details are tokenised by our payment processor and never stored on our servers)
• Conversation transcripts — messages exchanged with our AI chat assistant during repair enquiries
• Analytics data — page views, session data, and feature usage (collected only with your consent)
• Photos/videos — device images uploaded for diagnosis purposes
• Account access request data — name and email address (collected when you request access help via our website dialog)
• Technical and security data — IP address, device and browser information, timestamps, authentication and audit events, error details, and identifiers used to secure and operate the Service

We receive data directly from you; from the shop whose widget or communications you use; from authorised staff; from integrations the shop connects; from payment, messaging, authentication, and support providers; and from referral links or analytics technologies where permitted. Account, contact, billing, and core repair-booking data is needed to provide the requested service or enter into a contract. Optional uploads, marketing choices, analytics, and affiliate tracking are not required.

3. How We Use Your Data

We use personal data for the following purposes:

• Repair bookings — to process your repair request, generate quotes, and schedule appointments
• Communication — to send repair status updates via SMS, WhatsApp, or email. WhatsApp messages are only sent to customers who have opted in to receive WhatsApp communications. You can opt out at any time by replying STOP or by contacting the shop directly
• AI chat — to power our conversational AI assistant that helps you with repair enquiries
• Analytics — to improve our platform and understand usage patterns (with your consent)
• Customer portal — to provide secure access to your repair status and history
• Account access requests — to send account or access code support and respond to access enquiries
• Account and subscription administration — to create accounts, provide paid features, manage billing, support users, and enforce our terms
• Security and legal compliance — to prevent fraud and abuse, investigate incidents, keep records, and respond to lawful requests
• Affiliate administration — to attribute a referral where optional tracking is accepted, calculate commission, and prevent affiliate fraud

4. Legal Basis for Processing (GDPR Art. 6)

Where we act as controller, we rely on the following bases. Where we act as a processor, the relevant shop determines the lawful basis and we act on its documented instructions.

• Contract performance — account creation, subscriptions, support, affiliate participation, and delivery of features requested by the account holder
• Legitimate interests — securing and improving the Service, preventing fraud and abuse, supporting users, keeping proportionate business records, and administering referrals and payments. We balance these interests against the rights of affected people
• Consent — optional analytics, affiliate referral tracking, and marketing communications where consent is required. You may withdraw consent at any time without affecting earlier lawful processing
• Legal obligation — financial records retention, responding to data subject requests, and complying with lawful regulatory or court requirements

5. Third-Party Services

We use the following categories of third-party processors. Specific processor names are available on request at hello@cellbot.chat.

6. Cookies

We use the following types of cookies:

• Necessary cookies — authentication, security, consent preference, and user-requested promotion or access cookies. These are required for the requested function and cannot be disabled through our controls.
• Analytics cookies — pseudonymous analytics cookies for understanding site usage. These use opaque visitor and shop identifiers, not names or email addresses, and are only set with your explicit consent.
• Affiliate referral cookies — a first-party referral code used to attribute a signup and commission. It is set for up to 90 days only if you accept optional cookies.

You can accept or reject optional cookies and change or withdraw your preference at any time through the Cookie Settings control in the site footer. Withdrawal removes unattached acquisition and referral cookies and stops further optional capture.

7. Data Retention

• Active accounts— data is retained for the duration of the shop owner's subscription
• Acquisition attribution — consented first-touch attribution that has not been attached to a shop expires after 90 days. Once attached, it is retained with the shop account and removed through account erasure.
• Deleted accounts — data is deleted within 30 days of account closure or app uninstallation from active systems, then expires from routine backups under our backup cycle unless law requires longer retention
• Conversation transcripts (including WhatsApp messages) — retained for 12 months from creation, then automatically purged. Note: our messaging partner may retain WhatsApp message logs for up to 13 months independently per their retention policy
• Financial records — records needed for tax and accounting are retained for at least 6 years from the end of the financial year they relate to, and longer where law, an enquiry, or a dispute requires it
• Account access request data — retained until you request deletion, or up to 90 days after your enquiry is closed

8. Your Rights (GDPR Articles 12-23)

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate personal data
• Right to erasure— request deletion of your personal data ("right to be forgotten")
• Right to data portability — receive your data in a structured, machine-readable format
• Right to restrict processing — request limitation of how we use your data
• Right to object — object to processing based on legitimate interests or direct marketing
• Rights related to automated decision-making — our AI provides repair quotes but does not make decisions with legal or significant effects
• Right to withdraw consent — withdraw consent at any time where consent is the basis for processing

9. How to Exercise Your Rights

You can exercise your rights by:

• Emailing us at hello@cellbot.chat
• If you booked through a Shopify-powered shop, contacting the shop directly — they can submit a data request through Shopify which we process automatically

We respond without undue delay and normally within one month. Where the law allows an extension for a complex or numerous request, we will explain this within the first month. We may need proportionate information to verify identity. Rights are not absolute and we will explain any lawful exception.

10. International Data Transfers

Some of our third-party processors (for AI, payments, authentication, and messaging) operate outside the United Kingdom. Where we initiate a restricted transfer, we use an applicable lawful mechanism, which may include:

• UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where applicable
• The UK International Data Transfer Agreement
• The UK Addendum to the EU Standard Contractual Clauses

Where required, we also complete a transfer risk assessment and apply supplementary safeguards. Contact us for further information about the mechanism relevant to your data.

Analytics data is processed within the EU (Frankfurt, Germany).

11. Data Security

We implement appropriate technical and organisational measures including:

• Encryption in transit (TLS 1.2+) and at rest
• Multi-tenant data isolation (each shop's data is logically separated)
• HMAC-SHA256 webhook signature verification
• Magic-link authentication for customer portal access
• Regular security updates and dependency auditing

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered shop owners of material changes via email. The "last updated" date at the top of this page indicates the most recent revision.

13. Complaints

Please contact us first if you have a concern so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk

14. AI and Automated Processing

cellbot uses artificial intelligence to provide the following services:

• AI chat assistant — answers customer repair enquiries, provides quotes from your pricebook, and guides customers through booking. The AI never fabricates prices; all quotes are pulled directly from your configured pricebook.
• Vision-based damage assessment— customers can upload photos of their device, which are analysed by our AI provider's vision model to identify the device and assess visible damage. Photos are processed via the API and are not stored permanently.
• cellbot Copilot — a staff-facing assistant that helps shop owners search customers, look up repairs, check pricing, and view business statistics using natural language.

How AI data is handled:

• Data sent to our AI provider is processed via their API and is subject to their enterprise privacy commitments. API data is not used to train their models.
• Conversation transcripts are stored in our database for 12 months (see Section 7) to allow shop owners to review interactions. They can be deleted on request.
• The AI does not make decisions with legal or significant effects on individuals. All repair quotes are advisory and subject to in-person technician confirmation.

15. Shopify Merchant Data

When you connect the cellbot Shopify integration, we collect and process the following merchant data:

• Store information — your shop name, domain, and Shopify store ID to identify and connect your account
• Access tokens — OAuth access tokens issued by Shopify, stored securely and used only to create draft orders and manage the widget on your behalf
• Draft orders — we create draft orders in your Shopify store when customers book repairs through the widget
• Order confirmation data — Shopify sends us an orders/paid webhook notification when orders are paid. While the webhook payload may include customer details (name, email, shipping address), cellbot only processes the order ID, draft order reference, and payment status to update the corresponding repair job. We do not extract, store, or use any customer personal data from this webhook beyond what is necessary to match the payment to a repair job.

How we use this data: Merchant data is used solely to operate the cellbot widget within your Shopify store and create draft orders for repair bookings. When a customer completes checkout on Shopify, we receive a payment confirmation webhook to update the repair status.

Data retention:All merchant data is automatically deleted within 30 days of app uninstallation. This is enforced via Shopify's mandatory shop/redact GDPR webhook, which triggers full deletion of your shop record and all associated data.

Customer data via Shopify: When customers interact with the cellbot widget on your store, their data (name, email, phone) is subject to the same protections described in Section 2 above. Shopify merchants can submit customer data requests through Shopify Admin, which cellbot processes automatically via the customers/data_request and customers/redact mandatory GDPR webhooks.

16. Google User Data (Gmail Integration)

cellbot offers an optional integration that lets shops, resellers, and refurbishers connect their Gmail account to sync inbound customer emails into their cellbot inbox and reply to customers directly from the cellbot dashboard. This section describes what Google user data we receive, how we use it, and how we protect it. cellbot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The Gmail integration is strictly opt-in. We do not access any Google user data unless a shop owner explicitly clicks “Connect Gmail” in the cellbot settings and grants consent on Google's OAuth screen.

OAuth scopes we request:

• https://www.googleapis.com/auth/userinfo.email — to identify the Google account that was connected and display its address in the settings UI
• https://www.googleapis.com/auth/gmail.readonly — to read inbound messages so we can match them to existing repair jobs or create new ones
• https://www.googleapis.com/auth/gmail.send — to send replies that the shop owner composes inside the cellbot dashboard

What data we receive from Gmail:

• Message metadata— sender address, recipient addresses, subject, date, message ID, and threading headers (In-Reply-To, References) used to group replies into a single repair conversation
• Message bodies— the plain-text and HTML body of inbound customer emails, used to extract repair details (device model, reported issue) and display the conversation inside the shop's repair view
• Attachments— photos or documents customers attach to repair enquiries, displayed alongside the repair so the shop owner can review them
• OAuth tokens— encrypted access and refresh tokens issued by Google, stored securely and used only to call the Gmail API on behalf of the connected account

How we use this data:Google user data is used solely to operate the features the shop owner has explicitly enabled — matching inbound emails to repair jobs, displaying conversations inside cellbot, and sending replies that the shop owner has composed and clicked “Send” on. We do not use Google user data for any other purpose.

How we do NOT use this data — Limited Use compliance: In accordance with the Google API Services User Data Policy Limited Use requirements, cellbot:

• Does not use Google user data to serve advertising of any kind
• Does not sell, rent, or trade Google user data to third parties
• Does notuse Google user data to train, fine-tune, or improve any generalised AI or machine-learning model. Inbound Gmail messages are parsed by deterministic code only — they are never sent to any AI provider for processing
• Does notallow humans to read Google user data, except (a) with the shop owner's explicit consent for support, (b) for security purposes such as investigating abuse, or (c) where required by law
• Does not transfer Google user data to third parties except as necessary to provide or improve user-facing features that are prominent in the cellbot UI, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users

Where the data is stored:Synced Gmail content is stored in our database hosted in the European Union (Frankfurt region). OAuth tokens are encrypted at rest. Access is restricted to the authenticated shop owner and their invited team members under cellbot's tenant-isolation model — no other cellbot customer can access your data.

Data retention:Synced email content becomes part of the customer's repair history inside cellbot and is retained for as long as the shop account remains active, so that shop staff can reference past conversations when handling future repairs from the same customer. You may delete individual emails, repairs, or customer records at any time from inside cellbot, or request bulk erasure of all data under your GDPR rights (see Section 8). When a shop account is closed, all synced Gmail content is permanently deleted within 30 days.

How to revoke access: You can disconnect the Gmail integration at any time from Settings → Email Accountsinside the cellbot dashboard. Disconnecting clears the OAuth tokens immediately and stops all further syncing. You can additionally revoke cellbot's access from your Google account at myaccount.google.com/permissions. To request deletion of historical synced email content from cellbot, contact us at hello@cellbot.chat and we will action the request within 30 days under UK GDPR Article 17.

17. Affiliate Referral Tracking

We use a first-party cookie (cellbot_ref) to track affiliate referrals. This cookie:

• May be set when you visit our website via an affiliate referral link
• Lasts for 90 days
• Is set only after you accept optional cookies; if you reject them, no cookie-based affiliate attribution is recorded
• Contains a pseudonymous affiliate referral code
• Is used solely to determine whether a commission is owed to the referring affiliate

Our affiliate programme platform processes affiliate personal data (name, email, and payment details) as a data sub-processor under Ampliflow Ltd's instructions. This data is used exclusively for programme administration, commission calculation, and payout processing.

18. Contact

For any privacy-related questions, contact us at:
hello@cellbot.chat
Ampliflow Ltd, 221 Haunch Lane, Birmingham, B13 0PJ, United Kingdom