Privacy Policy
Dilot helps businesses with their customer contact: a chatbot on their website and an assistant that reads messages from customers and suggests replies. Dilot is a product of Identiden. This policy explains which data is processed, why, for how long, and what your rights are.
1. Who is responsible
There are two situations:
- You chat with a business's chatbot, or you send a business a message (e-mail, Facebook Messenger, Instagram, a comment on a post or an advertisement). Then that business is responsible for your data. Identiden processes it on that business's behalf, as a processor, and only to make Dilot work for that business.
- You have an account with Dilot yourself (your business is a client). Then Identiden is responsible for that account's data.
2. Which data
- Chats on a website: what you write in the chat, the page you chat on, the language, and a code for your device derived from your IP address and browser without storing them. Whether a chat is kept is the business's choice: in full, as a summary only, or not at all.
- When you ask to be contacted: the name, e-mail address, phone number and anything else you fill in on the form. It is sent to the business by e-mail.
- Messages you send a business, when that business has connected its e-mail, Facebook Page or Instagram account to Dilot: the message, attachments, your name and the profile or e-mail details the platform sends along, and comments on that business's posts and advertisements.
- Client accounts: name, e-mail address, an encrypted password and a log of changes.
3. What for
Only to provide the service: answer a question, suggest a reply to the business's staff, pass a conversation on to that staff, and show the business which questions are asked (statistics). Identiden does not sell data, does not use it for advertising and does not train AI models with it.
4. Facebook, Instagram and Microsoft
A business can connect its Facebook Page, Instagram account or mailbox (including Microsoft 365). This only happens with that business's explicit permission on Meta's or Microsoft's own screen, and can be withdrawn at any time. Dilot uses the data it receives through such a connection only for that business's customer contact, and follows Meta's and Microsoft's terms. When a connection is removed, the access keys are deleted immediately; what came in through it is deleted as described on the page Data deletion.
5. Who data is shared with
- AI services that read the text to write an answer: OpenAI, Anthropic and Google (Gemini) (United States). Under their terms they do not use data sent through their business API to train their models. Transfers outside the EU rely on the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.
- SMTP2GO, to send e-mails (such as a chat passed on to the business).
- MechanicWeb, the hosting provider of the server Dilot runs on. The server is in Germany, in the European Union.
- Google (Google Drive), where backups of the server are kept, so the service can be restored after a failure. Transfers outside the EU rely on the same basis as above.
- Google (Google Analytics), only when the business has switched on the direct link with its own Google Analytics and you allowed analytics on that website: see section 7. The business is responsible for what it does with it.
- No one else, unless the law requires us to.
6. How long
- Chats (in full or as a summary) and what you fill in on the contact form: for the period the business chose in its settings; after that they are deleted automatically. If the business chose no period, they are kept until the business deletes them or closes its account. A business can also delete chats itself.
- The original e-mails a business's assistant receives: the same period as that business's chats.
- Statistics: free text (such as summaries) is erased after 24 months; only numbers remain.
- The device code stored with a tracked action: erased after 24 hours.
- Data from a connected Facebook, Instagram or e-mail account: kept while the account is connected, under the business's settings; deleted no later than 30 days after disconnecting or after a request.
- Client accounts: until the account is closed.
- Backups: what was deleted can still be in a backup of the server made earlier. Backups are only used to restore the service.
7. Cookies and storage in your browser
The dashboard only uses a cookie to keep you signed in. The chatbot on a website keeps the conversation in your browser (local storage), so it does not disappear when you go to another page; it expires after 12 hours. When the business switches it on, the chatbot passes the opening and starting of a chat to the analytics the business already has on its website (such as Google Analytics or the Meta pixel) — only the name of that moment, never what you write.
When the business has switched on the direct link with Google Analytics, Dilot itself sends those moments (a chat opened, a chat started, and a tracked action such as an order after a chat, with its amount) to that business's Google Analytics account. The code Google Analytics had already placed in your browser goes with it, so the moment belongs to your visit. This only happens when you allowed analytics on that website and Google Analytics already runs there — without that consent nothing is sent. What you write in the chat is never sent.
8. Security
Data travels over the internet encrypted. Access keys and passwords are stored encrypted. Each business sees only its own data.
9. Your rights
You may see your data, have it corrected or deleted, object to its use and have it transferred. When it concerns a conversation with a business, you can also contact that business. E-mail us at info@identiden.nl; you get an answer within 30 days. If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
10. Changes
This policy can change. The date at the top says when it last did.