Privacy policy
Version draft-2026-10
Who is responsible
[OPERATOR NAME], [ADDRESS], [COUNTRY], is the data controller. Contact for anything about your data: [CONTACT EMAIL].
What we store, and why
| Data | Why | How long |
|---|---|---|
| Email address, password (only as a one-way hash), two-factor secret (encrypted), role | Your account and logging in | Until you delete your account |
| Your bots' Second Life usernames and settings; their passwords as Second Life's login hash, encrypted | Logging your bots in | Until you remove the bot or delete your account |
| Nearby chat, IMs, group messages and activity your bots receive and send | Showing them to you on the page | As long as you choose per bot (30, 90, 365 days or forever); you can erase them at any time |
| Sessions: browser, IP address, times | Security, the Devices list | 30 days after the last use |
| Security log: logins, changes to your account, admin actions | Security and preventing abuse | 1 year |
| Number of messages sent per day | Second Life's daily message limit | 90 days |
| Server logs (no chat, no passwords) | Running and fixing the service | 30 days |
The legal basis is the contract with you (providing the service you asked for) and our legitimate interest in keeping it secure. We do not sell data, show ads or use your chats for anything else.
Other people's messages
Messages from other Second Life residents to your bots are stored for you, in your account only. Nobody else sees them. SLBot staff cannot read them, except when you turn on "Let support read it for 24 hours" for a bot; every such read is recorded in the security log.
Where it is kept
On our server in the European Union ([PROVIDER, COUNTRY]); encrypted backups are kept 30 days with a second provider in the EU. Your bots connect to Second Life (Linden Lab, USA) as any Second Life viewer does. Emails are sent through [EMAIL PROVIDER].
Your rights
- Download all your data: Account page → "Download my data".
- Change or correct it: Account page and bot settings.
- Delete it: remove a bot (its data goes with it), erase history, or delete your account (everything is removed at once; backups age out within 30 days).
- Object, restrict, or ask any question: write to [CONTACT EMAIL]. You can also complain to the data protection authority of your country ([AUTHORITY, e.g. ANSPDCP in Romania]).
Security
HTTPS only; passwords hashed with Argon2id; Second Life passwords and two-factor secrets encrypted (AES-256-GCM) with a key kept outside the database; optional two-factor login; rate limits and lockouts; an append-only security log. If a breach puts your data at risk, we tell the authority within 72 hours and tell you without delay.
Cookies
Only the ones needed to work: your login session, and "remember this browser" for two-factor login if you choose it. No tracking or advertising cookies.
Changes
When this policy changes we show the new version and ask you to accept it.