HotBot · legal
Privacy policy
This policy covers the HotBot app. The velkos.org website is covered separately, by the website privacy policy.
Last updated 28 July 2026
This is a draft. It has not been reviewed by a lawyer, and parts of it are out of date — it names infrastructure the app no longer runs on, mentions payment processing that does not exist yet, and does not name the AI providers that handle your messages. Treat it as a statement of intent, not as a finished policy. If anything here matters to you, email luka.velimirovic@velkos.org and ask.
Introduction
PREDUZEĆE ZA PROIZVODNJU PROMET I USLUGE VELKOS DOO EXPORT-IMPORT KOSOVSKA MITROVICA (“Velkos”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use HotBot, our AI-powered communication and conversation-coaching application (“Service”). By using the Service, you consent to the practices described in this Privacy Policy.
Information we collect
Personal information
We collect the following personal information when you create an account or use the Service:
- Email address and name
- Account credentials
HotBot is free and takes no payments, so we collect no payment or card details at all. If that changes, this policy will say so before it does.
Conversation data
When you use HotBot, you may enter text or other content (“Conversation Data”). This information is collected only to:
- Process your AI requests
- Generate responses and coaching insights
- Sync your conversations across devices
- Allow you to revisit your history within the app
We do NOT use your Conversation Data to train, fine-tune, or improve AI models. Your conversations are never included in training datasets.
Usage data
We may collect technical information automatically, such as:
- Device type
- Operating system
- App version
- Crash logs
- Basic analytics (session duration, feature usage)
This data is used solely to maintain and improve the Service.
How we use your information
We use collected data to:
- Provide and operate the Service
- Sync your account and conversations across devices
- Process AI requests in real time
- Personalize your user experience
- Communicate with you
- Diagnose and resolve technical issues
We do not sell your data or share it with advertisers.
Data storage and security
HotBot runs on the following infrastructure:
- Application servers and the PostgreSQL database are hosted on Railway, in the European Union
- Data is encrypted in transit using TLS
- Authentication is handled by Firebase Authentication
- Uploaded images are stored in Firebase Storage
- Access is restricted to authorised personnel only
Subprocessors and third-party services
HotBot depends on the following third parties. The AI providers are listed first because they are the ones that receive the text of your conversations.
- Google (Gemini) — generates replies, reads screenshots you upload, and produces coaching text
- Anthropic (Claude) — generates replies and selects the writing examples used to shape them
- OpenRouter — routes reply generation to further AI models on our behalf
- Railway — application hosting and the database
- Firebase — sign-in, image storage, and push notifications
- Sentry — error reporting
- PostHog — product analytics
Which AI provider handles a given request depends on how the app is configured at the time, so assume any of those listed may receive it. We do not permit them to train their models on your content. These providers may process data in the EU, EEA, UK or United States; their own privacy policies are on their respective sites.
International data transfers
Because our infrastructure is cloud-based, your data may be processed outside your country of residence. We rely on GDPR-compliant Data Processing Agreements and Standard Contractual Clauses where required. By using the Service, you consent to these transfers.
Data retention
We retain your data while your account remains active.
- Conversation Data is stored until you delete it or delete your account
- Analytics data may be retained for up to 24 months
- Backup copies may exist for up to 30 days
Your rights
Depending on your location, you may have the right to:
- Access your personal data
- Correct inaccurate information
- Request deletion of your data
- Export your conversation history
- Withdraw consent
You can request these through in-app settings (where available) or by contacting luka.velimirovic@velkos.org.
Account deletion
If you delete your account:
- Your personal information is removed from active systems
- Your Conversation Data is permanently deleted
- Backups containing your data are removed automatically within 30 days
Deletion cannot be undone.
Children's privacy
The Service is not intended for individuals under the age of 16. We do not knowingly collect information from children. If such data is discovered, we will delete it promptly.
Changes to this policy
We may update this Privacy Policy periodically. Changes take effect upon posting. Significant changes may be communicated via email or in-app notification.
Contact us
For any questions about this Privacy Policy, or to exercise your rights over your personal data, contact us at luka.velimirovic@velkos.org. Our registered seat is Kralja Petra I 167, 38220 Kosovska Mitrovica, Serbia.