Privacy Policy

Last updated: September 25, 2026

Who we are

MR-TBOT.COM (mr-tbot.com) is operated by BOT-HOLDINGS, LLC, doing business as codedatda.casa (“BOT-HOLDINGS”, “we”, “us”), based in Las Vegas, Nevada, United States. We are the data controller for the personal data described here. Questions and requests go to tbot@mr-tbot.com.

This policy covers the mr-tbot.com website: its pages and blog, the contact, NDA and invoice-payment forms, the support chat, plugin downloads, and the password-protected remote-support installer page at /rmm/.

What we collect, and why

• Server and security logs. Like every website, when you visit we and the services in front of us receive your IP address, browser type, the pages you request, timestamps and referring page. Our host keeps standard access logs and our content delivery network (Cloudflare) filters traffic for attacks. We use this to run the site, keep it secure and investigate abuse.
• Contact form. When you use it we collect what you type: what your message is about, your name, email address, phone number (optional), best time and time zone to reach you, postal address, event or project name, dates and details, invoice number, which wire patch a bug report is about, your message, a file, if you attach one. Files you attach are delivered to our team with the message and kept on our server. We use it to answer your message, quote or book work, answer billing questions and handle bug reports. The submission is emailed to our team mailbox and kept in the site’s database. We keep it for 24 months from the date you send it, unless you ask us to delete it sooner.
• Non-disclosure agreement (NDA) form. When you use it we collect what you type: your full name, email address, phone number, postal address, website (optional), the project the NDA covers, GitHub username (optional), notes or addendums, a photo of your face, the date, your acceptance of the NDA terms, your signature, drawn on screen. Files you attach are delivered to our team with the message and kept on our server. We use it to identify you as a party to the non-disclosure agreement and keep a signed record of it. The submission is emailed to our team mailbox and kept in the site’s database. We keep it for as long as the agreement remains in force (it has no fixed end date) and, after it is released or ends, for as long as we may need it as evidence of the agreement.
• Invoice payment form (Payment Portal). When you use it we collect what you type: payer name and company (optional), email address, phone number, billing address, project name, invoice number(s), payment type and amount, your acceptance of the PayPal fee terms, your signature, drawn on screen, supporting financial documents, if you attach any. Files you attach are delivered to our team with the message and kept on our server. We use it to record your payment and match it to the invoice it pays. The submission is emailed to our team mailbox and kept in the site’s database. We keep it for as long as tax and accounting law requires, because payment records are tax and accounting records.
• Comments. If you leave a comment we store the comment, your name, email and IP address (to filter spam). Your name and comment are public.
• Support chat. The chat button on this site opens a support assistant that is an AI: its answers are generated by an AI model run by OpenAI, using this site’s own pages and help articles. To start a chat you give your name and your email address and, if you choose, the topic of your question. Before your first message a Cloudflare Turnstile check runs to keep out bots; it sends browser signals and your IP address to Cloudflare. Each message you send, the details you entered, and the title and address of the page you are on are sent to OpenAI to produce the reply. A member of our team can read the conversation and may join it. Once a team member has joined, you may be able to send each other photos, videos and files. Files go only to our team, never to the AI (the AI sees only the file’s name). They are stored on our server with the conversation and can be opened by anyone who has the file’s private link. Photos keep the details your camera embedded in them, such as location and time, so remove those before sending if you prefer. We email our team when a chat starts (your details, the page and your first question), when it needs a person, and a full transcript when it ends, and we email a copy of the conversation to the address you gave. On the site we keep the conversation, the details you entered, the pages you chatted from, a random chat ID, a shortened IP address (for IPv4 the last number is removed; for IPv6 only the network prefix is kept) and any thumbs-up or thumbs-down rating you give (with any comment you add to it); your browser keeps the open chat in session storage until you close the tab. Once a week, conversations our team handled are sent to OpenAI with email addresses, phone numbers and order or ZIP numbers masked, so it can suggest answers for the assistant’s knowledge base; a person reviews every suggestion before the assistant uses it. Conversations, files and the details you entered are deleted from the site 90 days after the chat started; records of which team member handled a chat, and our team’s own internal chat about it, are kept for up to 12 months; emailed copies stay in the mailboxes they were sent to. Our team’s phones are alerted through Google Firebase Cloud Messaging (and Apple’s push service on iPhone); the alert contains only a chat reference, not what you wrote. Please do not send payment card numbers, passwords, government ID or health information in the chat.
• Form records. With every form submission the site also stores your IP address and the time you sent it. The contact and NDA forms run Google reCAPTCHA, which sends browser and device signals to Google to score whether the submission comes from a person. Files, photos and signatures you submit through the forms are kept in a folder on our web server that is blocked from public access, and only TBOT reviews them.
• Invoice payments. If you pay an invoice through the Payment Portal, you complete the payment in PayPal’s own window. PayPal receives your payment details directly under its own terms; we receive PayPal’s confirmation of the payment, never your card or bank details.
• Remote support agent. The password-protected page at /rmm/ is for clients who have asked TBOT for remote technical support. If you install the BOT-CENTRAL support agent from it, your device connects to a support server we operate ourselves (built on the open-source MeshCentral), which holds the device’s name, operating system, hardware and network details (including its IP address) while the device is enrolled. With the agent TBOT can see and control the screen, transfer files and run maintenance commands on that device. The page itself collects nothing beyond the standard server logs, and it loads its font from Google Fonts.
• Page-load measurement. Our content delivery network (Cloudflare Web Analytics) records page loads and timing without cookies and without identifying you across sites.

We do not collect more than we list here, we do not buy data about you from data brokers, and we do not sell your personal data.

How we use AI

Some of what this service does is generated by machine-learning models run by a third-party provider. Specifically:

• the support chat assistant, Data, writes its answers with an AI model; your messages, the page you are chatting from and the recent conversation are sent to the AI provider for each answer, together with passages from this site, TBOT’s own notes and the public MESH-API documentation
• once a week, chats that TBOT answered in person are sent to the AI provider, with email addresses, phone numbers and order-like numbers removed first, to draft knowledge-base entries that TBOT reviews before the assistant can use them

We use OpenAI (OpenAI, L.L.C.) for this. We send them only what is needed to answer the request. Under their API terms they do not use the content we send to train their models, and we do not use your content to train models either. Generated text can be wrong, incomplete or out of date; treat it as a draft, not as professional, legal, medical or financial advice. A person on our team may read a conversation or output to help you or to check quality.

Legal bases (EU, UK and similar laws)

• Contract: to provide what you asked for, such as answering a message, fulfilling an order or running your account.
• Legitimate interests: keeping the site secure, preventing fraud and abuse, understanding aggregate use of the site, and running our business, balanced against your rights.
• Consent: any optional field you choose to fill in, and any optional feature you switch on. You can withdraw consent at any time; it does not affect processing that already happened.
• Legal obligation: tax, accounting and responding to lawful requests.

Cookies and similar technologies

We use the following cookies. Strictly necessary cookies are needed for the site to work. The analytics cookies listed below are currently set when the page loads, and there is no consent tool on this site yet. You can block or delete them in your browser, and we are working to gate them on your consent.

Our site does not currently respond to Do Not Track or Global Privacy Control browser signals; use your browser settings instead.

Full details are in our Cookie Policy.

Who we share it with

We share personal data only with the service providers that help us run this site and deliver what you asked for. Each is a separate company that processes it under its own terms, which include data-protection commitments:

Some recipients decide for themselves how they use what you give them and are not our service providers: Google LLC (YouTube): the video players embedded on the homepage, the Bio and TBOT-LIVE pages and some portfolio and blog pages load with the page, so YouTube receives your IP address and browser details and sets its own cookies even if you do not press play; Twitch Interactive, Inc.: the live-stream player embedded on the TBOT-LIVE page loads with the page, so Twitch receives your IP address and browser details and sets its own cookies; PayPal, Inc.: PayPal’s payment scripts load when you open the Payment Portal page, so PayPal receives your IP address and browser details; if you pay an invoice there, PayPal receives your payment details and the payment amount directly and processes the payment under its own terms. Their own privacy policies apply to that use.

We also disclose data when the law requires it (for example a valid court order), to protect our rights, safety or property or those of others, and, if our business is sold or reorganized, to the successor under this same policy. We do not sell personal data and we do not share it for cross-context behavioral advertising.

International transfers

We are based in the United States and our providers are mostly US companies, so your data is processed mainly in the United States. Our team also administers our sites and services from Hong Kong, and working copies of some production data are kept on our administrators’ workstations there. If you are in the EU, UK or Switzerland, transfers rely on the providers’ EU Standard Contractual Clauses or Data Privacy Framework certification, plus the security measures below. You can ask us for details of the safeguard that applies.

How long we keep it

• Server and security logs: our host keeps raw access logs for a few months, our site firewall keeps its own short-term record of recent visits and blocked requests, and the log of changes made in the site’s admin area is kept for 12 months. Our CDN keeps request logs only briefly.
• Contact form: 24 months from the date you send it, unless you ask us to delete it sooner.
• Non-disclosure agreement (NDA) form: as long as the agreement remains in force (it has no fixed end date) and, after it is released or ends, for as long as we may need it as evidence of the agreement.
• Invoice payment form (Payment Portal): as long as tax and accounting law requires, because payment records are tax and accounting records.
• Support chat: conversations, files, and the details you entered, 90 days from the start of the chat; records of which team member handled a chat and our team’s internal team chat about it, 12 months; suggested knowledge-base answers (with contact details and numbers masked), until we delete them; emailed copies stay in the receiving mailboxes while we may need them to help you.
• IP addresses recorded with form submissions: kept with the submission they belong to.
• Comments: kept while the comment is published, or until you ask us to remove it.
• Remote-support device records: until the device is removed from our support server; ask us and we will remove it.

Security, and what happens if something goes wrong

We protect personal data with encryption in transit (HTTPS), Cloudflare’s edge network in front of the site, which blocks known attack traffic, login protection with automatic blocking of repeated failed logins, access limited to the people on our team who need it, and uptime and health monitoring of our servers. Files sent through our forms and the support chat are stored inside the site’s uploads folder behind a rule that blocks all direct web access; support-chat files can only be opened through unguessable links. No system is perfectly secure, so we also plan for failure: if we learn of a security incident that affects your personal data, we will investigate, contain it, and notify you and any regulator we are required to notify without undue delay and within the time the applicable law sets (72 hours to the supervisory authority under the GDPR).

If you believe you have found a security problem in this site or any of our services, please tell us at dev@codedatda.casa before you tell anyone else. We will not pursue good-faith researchers who report responsibly and do not access, change or destroy other people’s data.

Your rights

Wherever you live, you can ask us what personal data we hold about you, ask us to correct or delete it, ask for a copy in a portable format, object to or restrict how we use it, and withdraw any consent you gave. If you are in the EU, UK or Switzerland these are your rights under the GDPR and UK GDPR, and you may also complain to your data protection authority. If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, correct, and to opt out of sale or sharing (we do not sell personal data and we do not share it for cross-context behavioral advertising), and we will not treat you differently for exercising them; residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states with privacy laws have similar rights, including the right to appeal a decision we make about your request.

To exercise any of these, email tbot@mr-tbot.com from the address you used with us, or tell us enough for us to find and verify your record. An authorized agent may act for you if they show us your written permission. We answer within 30 days (45 for California requests, extendable once) and we do not charge for this unless a request is clearly excessive.

Children

This site is not directed to children and we do not knowingly collect personal data from anyone under 13 (or under 16 in the EU). If you believe a child has given us data, contact us and we will delete it.

Third-party content

Some pages embed content from other companies (YouTube video players, a Twitch live-stream player, Google Fonts, Google reCAPTCHA on the contact and NDA forms, PayPal’s payment buttons on the Payment Portal). When such content loads, that company receives your IP address and may set its own cookies under its own policy. Where we can, we load it only after you interact with it.

Links to other sites

Links to sites we do not run (including app stores, GitHub, payment processors and social networks) are covered by those sites’ own policies.

Changes

When we change this policy we update the date at the top and, for material changes, post a notice on the site or email registered users. Earlier versions are available on request.

Contact

BOT-HOLDINGS, LLC, doing business as codedatda.casa
Las Vegas, Nevada, United States
tbot@mr-tbot.com