Privacy Policy · Behbot

Who is responsible

The controller of your personal data is the operator of Behbot, a registered sole proprietor (individual entrepreneur) in Ukraine (see the Terms of Service). This policy covers the website behbot.online and the account dashboard. Contact for anything about your data: [email protected]. We answer within 30 days.

What we collect and why

We collect only what the Service needs. The table lists each kind of data, why we use it, the legal basis and how long we keep it.

Data	Why	Legal basis	Retention
Account: email address, password (stored only as a salted hash), first and last name if you add them (both optional), the version of the Terms you accepted and when, and when the account was created and its email confirmed	To create and secure your account, sign you in and send account emails; your name is shown in your account	Performance of the contract	While the account exists; see Retention and account deletion
If you sign in with Google: your Google account ID, email address, whether Google has verified it, and your first and last name if your Google profile has them. Google also sends your full name and a link to your profile picture; we do not store them	To create your account or sign you in to the account with the same email, and to fill in your name when the account is created	Performance of the contract	While the account exists
Jobs: domain, search queries, country, language, device, CTR, number of clicks and views, period, result pages, time on site, prices, the reserved and charged amounts and the status	To run and bill your jobs and show them in your account	Performance of the contract; accounting obligations	While the account exists
Attempt results: type, query, status, number of tries, timing, result page and position, the address and title Google displayed, the page a click landed on, time on site, duration, error codes and technical error details	To report results to you, settle each job and investigate failures	Performance of the contract	While the account exists
Reports from our executor: the full record of each attempt and job result as received	To reconcile billing and investigate questions about a job	Legitimate interest: accurate billing	90 days
Balance and its activity (top-ups, reservations and returns of unspent reservations); cryptocurrency payments: asset, network, amount, our deposit address, status, times and transaction id; deposits as reported by Binance: Binance record id, transaction id, asset, network, amount, our deposit address and the sending address	To credit payments, bill jobs and keep financial records	Performance of the contract; legal obligations	While the account exists; deposit records then stay without the sending address and without a link to you
Contact form and email correspondence: your name (optional), email address and message and, if you are signed in, your account email	To answer you; a contact form message is emailed to our support mailbox with your address as the reply-to address	Legitimate interest; performance of the contract	As long as needed to handle the matter and for a reasonable period afterwards
Keyed hashes (HMAC) of your IP address, email address or account ID; the values themselves are not stored for this purpose	Limits on sign-in, registration, password reset, email confirmation, password change and contact attempts	Legitimate interest: preventing abuse	For the length of the limit window, at most 2 days
Session: a random identifier in a cookie and, on our servers, who is signed in and any Google sign-in in progress	To keep you signed in	Performance of the contract	30 days, or until you sign out
Email confirmation and password reset links (stored only as SHA-256 hashes)	To confirm your address and let you reset your password	Performance of the contract	Valid for 24 hours and 30 minutes respectively; deleted after expiry or one day after use
Technical logs: IP address, time, requested address, response status and size, referring page and browser user agent of each request to the website; application logs of billing, payment and job events; error reports	To operate and secure the Service and to investigate faults, fraud and abuse	Legitimate interest: security and reliability	A limited period needed for operations and security, then deleted

We may also use any of the data above to enforce our Terms, prevent and investigate fraud and abuse, comply with legal obligations, establish or defend legal claims and, in aggregated or anonymised form, to improve the Service. We do not use your data for automated decisions that have legal or similarly significant effects on you.

Job data, Google and your website

Jobs are run by our executor, software we operate on our own infrastructure. It receives the job parameters (domain, queries, country, language, device and the plan of attempts) together with an identifier that links the job to your account, runs the attempts and reports each result back to the website.

To run an attempt, your query is sent to Google from a browser session in the chosen country and, for a click, your website is opened. Attempts run through third-party proxy networks in that country, and captchas shown by Google may be passed to a captcha-solving service. These parties see only the technical traffic of the attempt; neither Google, nor these providers, nor your website receive your email address, name, IP address or any other account data from us. Visits reach your website from the addresses of the proxies used.

Search queries are not meant to contain personal data. Do not enter names, contact details or other information about individuals as queries: queries are sent to Google and stored in your job history. Where a domain or a query nevertheless relates to an identifiable person, we process it only to provide the Service to you, and you are responsible for having a lawful basis to submit it.

Analytics

There is no advertising, no tracking pixels and no social media plugins on the website. The only analytics is Cloudflare Web Analytics: a script added by Cloudflare counts page views and measures page speed without cookies, local storage or fingerprinting. It records the page address, the referring site, your country, browser, operating system and device type; visits are counted by referrer, not by identifying you. The data goes to Cloudflare and is shown to us only in aggregate. The legal basis is our legitimate interest in understanding how the website is used.

Apart from this script and the Turnstile check on the registration and contact forms, the website loads scripts and fonts only from its own domain.

Cookies

We use only cookies that are needed for the website to work and stay protected. No consent banner is shown because none of them is used for tracking or advertising. The website does not use local storage.

Cookie	Purpose	Lifetime
`bb_session`	Keeps you signed in and holds a Google sign-in that is in progress; HttpOnly and SameSite=Lax. It is not set while you only browse public pages	30 days
`__cf_bm`	Set by Cloudflare, when its bot protection is on, to tell visitors apart from automated requests	30 minutes
`cf_clearance`	Set by Cloudflare to remember that you passed a security check so it is not shown again	Set by Cloudflare, 30 minutes by default

The Turnstile check on the registration and contact forms runs in a frame from Cloudflare’s own domain; any cookies or storage it uses there belong to Cloudflare and serve only to tell people from bots.

Who else processes your data

We do not sell personal data or share it for advertising. We share it only with providers that are needed to run the Service, each for its own purpose:

Recipient	Purpose	Data it receives
Cloudflare	DNS, proxy and content delivery in front of the website; Web Analytics; Turnstile, the check against automated submissions on the registration and contact forms	Your IP address and connection metadata for every request; page views as described under Analytics; for Turnstile, signals from your browser and, when we verify the check, your IP address
Google (Google LLC, United States)	Sign-in with Google, only if you choose it	Google confirms your identity and sends us the data listed above; we never receive your Google password, and Google learns that you signed in to Behbot. Google’s own privacy policy applies to the sign-in
Binance	Holds our deposit addresses and receives your top-ups; we read the deposit history with a read-only key to credit your balance	The blockchain transaction, including the sending address and the amount
Our email provider	Delivers account emails to your address and contact form messages to our support mailbox	Your email address and the content of the email
Telegram	Private notifications to the operator about new accounts and errors	The email address and creation time of each new account; error reports, which may include the IP address, browser user agent, page address and referring page of the request that caused the error
Our hosting provider	Runs the servers and the database of the Service and our executor	The data described in this policy, stored on our behalf
Proxy networks and a captcha-solving service	Used by our executor to run attempts in the chosen country	Only the technical traffic of attempts, as described under Job data; no account data
Authorities and professional advisers	Only where the law requires it or to establish or defend legal claims	What the request or the claim requires

If you use the “Open in Trust Wallet” or “Open in MetaMask” links or wallet QR codes on the payment page, your device opens a link on that wallet’s domain carrying our deposit address, the network and the amount. We send these wallets nothing ourselves.

International transfers

We are based in Ukraine, and some of the providers above operate in other countries, including the United States. Where a transfer of personal data requires safeguards under the law that applies to you, we rely on the provider’s standard contractual clauses or other safeguards available under that law.

Retention and account deletion

The retention period of each kind of data is shown in the table above. You can delete your account in your profile once none of your jobs is running. Deletion removes your account, jobs with their attempts and executor reports, balance activity and payments at once.
Records of incoming deposits (Binance record, transaction id, asset, network, amount and our deposit address) stay without the sending address and without a link to your account, as accounting requires.
After deletion we keep a minimal record for as long as we operate the Service: your email address, the first and last name from your profile, the balance remaining at deletion, the deletion date and whether the account had top-ups or jobs. We use it only to prevent the address from being registered again, to answer questions about the deleted account and to handle disputes.
Operator notifications, logs and correspondence are kept only as long as they are needed for operations, security and the matter concerned.
Any data may be kept longer where it is needed to comply with a legal obligation, to resolve a dispute or to establish, exercise or defend legal claims.

How data is protected

All traffic is encrypted with TLS. Passwords are stored as salted bcrypt hashes, and email confirmation and password reset links as SHA-256 hashes; none of them can be recovered from the database. Rate limits work on keyed hashes rather than on IP or email addresses. Sessions are kept on our servers, and changing your password signs you out on your other devices. Forms are protected against cross-site requests, the website ships a strict Content Security Policy, the interfaces between the website and our executor are not reachable from the internet, and our key to Binance can only read deposit data, not move funds. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as the law requires.

Your rights

Depending on the law that applies to you (including the GDPR for residents of the European Economic Area and the Ukrainian data protection law), you can:

access the personal data we hold about you and receive a copy in a portable format;
ask us to correct inaccurate data;
ask us to delete your data or restrict its processing, where we have no overriding legal obligation to keep it;
object to processing based on legitimate interest;
lodge a complaint with your data protection authority.

To exercise these rights, email [email protected] from your account email address. You can see your jobs, balance activity and payments in your account at any time, change your name in your profile, change or set your password on the security page and delete the account in your profile.

Emails we send

We send only service emails about your account: email address confirmation, password reset links and notices that your password was changed or set. We also reply to messages you send us and may write to you about your account, payments, jobs or changes to these documents. We do not send newsletters or marketing emails, and we do not share your address with anyone for marketing.

Children

The Service is intended for adults and businesses. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy when the Service changes. The "Last updated" date at the top shows the current version. For material changes we notify you by email or with a notice on the website before they take effect.