Security

How we look after your account and your shoppers’ conversations

What Botender does to keep dispensary accounts and shopper conversations safe, as the product runs today.

Shopper conversations

Conversations are kept as long as each account chooses, from 1 to 36 months (12 unless it changes it), then deleted automatically.
Your team can delete a shopper’s conversation on request, from the Inbox or the Leads tab: its messages, the contact details they left and any photos they sent.
Photos shoppers attach, such as an ID, are kept in private storage. Your team sees them through links that stop working after minutes, and they are deleted after 30 days.
Shopper IP addresses are used only to limit abuse, and kept in our rate-limit records no more than a day.
The chat sets no advertising or tracking cookies. Where a menu is searched through Jane’s menu API, a random device id kept in the shopper’s browser goes to Jane, as the privacy policy explains.

Row-level security is on for every table. A signed-in browser can read only its account’s name and plan, its members and the dispensaries it was given; everything else goes through our server, which checks who is asking first.
Team members see only the dispensaries and dashboard sections you give them, and the server enforces it, not only the dashboard.
Secret keys and passwords saved for a dispensary stay on the server: the dashboard shows only that one is saved. Two are shown to the team that uses them: the Jane search-only key, and the lead webhook’s signing secret, to owners and admins.
Jane Partner API credentials are stored encrypted (AES-256-GCM), with the key kept outside the database.
Card details stay with Stripe.
Deleting your account ends billing first, then deletes its dispensaries, conversations, leads and documents.

The age gate and disclaimer are on by default. The chat refuses medical claims and has defenses against people trying to talk it off script.
You can list the websites your chat answers on. A copy of your line on any other site gets a short note to contact the store and uses none of your replies.
Messages are rate-limited per visitor, per conversation and per store.
Lead webhooks are signed (HMAC SHA-256), so your system can check each one came from us.
Downloads of leads and conversations are escaped, so a shopper’s message cannot run as a formula when opened in a spreadsheet.

Every page and the chat’s API are served over HTTPS, and browsers are told to use nothing else (HSTS).
Our pages refuse to be framed by other sites and send a content security policy.
When our server reads or posts to an address someone typed (website training, Find my menu, the site check, webhooks), it checks every address it connects to and never connects to a private network.
Error reports leave out messages, request bodies, headers, cookies and who the user is.
The text-message page can be served from a neutral domain that shows only those pages, the chat and its API, never this site or the dashboard, and names no business that uses it.

The privacy policy lists the services that process personal data for us and what each one gets.

Email hello@conversionsystem.com about our security or a problem you found, or to ask about a data processing agreement.

Free every month for one dispensary. No developer and no credit card.