Privacy Policy

Last updated: 16 October 2026

This page explains what SpecBot collects, why, who helps us process it and how you get it deleted. It covers the website (specbot.dev), the web app (app.specbot.dev) and the SpecBot app for Claude and ChatGPT (the "MCP App"). If something here is unclear, email [email protected].

Who we are

SpecBot is run by Dabanny Ltd (Дабани ООД), a company registered in Bulgaria, EIK 205476845, VAT BG205476845, registered address Nikola Petkov 7, 2100 Elin Pelin, Bulgaria. We are the data controller for your account data. For the details you enter about your own clients, you are the controller and we process them for you.

What we collect

Your account

• Name, email address and a hashed password, or the name, email and avatar from Google or Apple if you sign in with them.
• Business details you add in settings: company name, logo, branding and defaults.
• Plan and billing status. Card details go straight to Stripe; we never see or store them.
• Monthly usage counters (proposals and AI drafts) so we can apply plan limits.

Your work

• Your catalog: offerings, prices, variants, add-ons, terms and reusable content blocks.
• Proposals and every saved version of them, including the client name and client email you enter.
• Your notes and AI-generated drafts, and voice notes turned into text (we keep the text, not the audio).

Your clients, when they open or accept a proposal

• Views of the share link: time, browser user agent, referrer and a truncated hash of the IP address (not the IP itself).
• Acceptance evidence: the signer's name, role, company and email, their IP address and user agent, the options they picked, the totals, the time, a hash of the exact version they accepted and the signed PDF.

Connected AI apps (Claude, ChatGPT)

• The name and redirect address of each app that connects to your account.
• Connection tokens, stored only as hashes, with their expiry and last-used time.
• The arguments the assistant sends when it calls a SpecBot tool, for example the client name and the offerings to put in a draft. SpecBot never receives your chat history, only those tool arguments.

Usage and errors

• Product analytics: pages viewed and actions taken, via PostHog (EU).
• Error reports with technical context, via Sentry (EU region).
• How you arrived (UTM tags, referrer) and Google Ads conversion measurement (without cookies unless you accept them).

Why we use it (lawful basis)

• To provide the service you signed up for (contract): your account, catalog, proposals, share links, acceptances, email delivery and billing.
• Legitimate interest: keeping the service secure, fixing errors, preventing abuse and understanding which features people use.
• Legal obligation: invoices and accounting records.
• Consent: analytics and advertising cookies (see below), and marketing emails if you subscribe. You can change your mind at any time.

We don't sell your data and we don't use your proposals to train AI models.

Who processes it for us

• Hetzner (EU): servers and the database. Your data is stored in the EU.
• Cloudflare: DNS, CDN and hosting for specbot.dev, and storage for our off-site database backups; traffic passes through its network.
• PostHog (EU region): product analytics.
• Sentry (EU region): error monitoring.
• Stripe: payments and subscriptions.
• Brevo (EU): sends account emails and the proposal emails that go to your clients.
• Fastmail: hosts our specbot.dev mailboxes (support@, hello@), so it holds the emails you send us.
• Google: Sign in with Google (if you use it) and Google Ads measurement on specbot.dev.
• Apple: Sign in with Apple (if you use it).
• OpenRouter: AI drafts in the web app only. When you generate or refine a proposal or transcribe a voice note, your proposal details go through OpenRouter to the model provider. The MCP App runs no AI on our side: the drafting is done by Claude or ChatGPT under your agreement with them.

Some of these companies are based outside the EU. Where data leaves the EU we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

The SpecBot app for Claude and ChatGPT

• You connect it by signing in to SpecBot and approving the connection on our consent screen.
• The assistant can read your catalog and proposals, create and update offerings, and draft proposals.
• Sending a proposal to a client needs your confirmation first. The assistant shows you the draft and only sends it after you say so.
• What you type in the chat stays with Claude or ChatGPT and is covered by their privacy policies. We only see the tool calls.
• Access tokens expire after an hour and refresh tokens after 30 days of no use.

How long we keep it

• Account data, catalog and proposals: while your account is open.
• Acceptance records and signed PDFs: while the proposal exists. They are your evidence of the agreement with your client.
• Invoices and billing records: as long as Bulgarian accounting law requires (currently 10 years).
• Analytics events in PostHog: up to 1 year.
• Error reports in Sentry: up to 90 days.
• Support emails: in our mailbox for as long as we need them to help you, then deleted.
• Backups: we back up the database every night. Copies stay on our server for 7 days and in off-site storage (Cloudflare) for 30 days, so deleted data is fully gone within 30 days.

Deleting your data

Email [email protected] from your account address and we delete your account within 30 days. That removes your profile, catalog, content blocks, proposals, versions, views, acceptance records, signed PDFs and connected-app tokens. Billing records we must keep by law stay.

If a client already accepted a proposal, both you and the client received the signed PDF by email. Deleting your account removes our copy; the copies you and your client hold are yours. Download anything you need before you ask us to delete it.

To disconnect Claude or ChatGPT, remove SpecBot in that app's connector or app settings. To cut off access on our side straight away, email us and we revoke the tokens. A page to see and revoke connected apps yourself is coming to the web app settings.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and take it elsewhere. Email [email protected] and we reply within 30 days. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the authority where you live.

If you are a client of a SpecBot user and want your details removed, contact the person who sent you the proposal first. If you can't reach them, email us.

Cookies and local storage

On your first visit to specbot.dev or app.specbot.dev we ask whether you accept cookies. Your answer is saved in one cookie (specbot_consent, kept for 180 days) and applies to both sites. Change it any time with Cookie settings in the site footer or in the app's settings.

Always on (needed for the service)

• specbot_consent: remembers your cookie choice.
• On app.specbot.dev: your sign-in token in local storage and a specbot-logged-in cookie, so you stay logged in.
• Cookieless analytics: PostHog counts page views and actions without storing anything on your device. Each page load looks like a new anonymous visitor. We rely on legitimate interest for this.
• Cookieless Google Ads measurement: the Google tag loads on every page, but until you accept it sets no cookies. It only sends Google signals without identifiers (that a page loaded or a sign-up happened, your cookie choice, and the time), with ad click IDs removed. Google uses these to estimate how many sign-ups came from our ads.

Only if you accept

• PostHog cookies and local storage (ph_*), so visits from the same browser are linked.
• Google Ads cookies (_gcl_*), so Google can link an ad click to a later sign-up or upgrade.
• On specbot.dev, a local-storage entry (specbot_attribution_v1) remembering how you arrived, so we can credit a sign-up to the right campaign.

If you reject cookies after accepting them, we remove these from your browser. Proposal share links work the same either way.

Security

Passwords and connection tokens are stored as hashes. Traffic is encrypted with HTTPS. Share links use long random tokens. Access to production systems is limited to the people who run SpecBot.

Children

SpecBot is a business tool and is not meant for anyone under 16.

Changes

If we change this policy in a way that matters, we email account holders before it takes effect. The date at the top shows the latest version.

Contact

Dabanny Ltd (Дабани ООД), Nikola Petkov 7, 2100 Elin Pelin, Bulgaria.
Email: [email protected]