LangBot User Privacy Policy

Version: 1.5 Effective Date: March 30, 2026 Last Updated: September 15, 2026

1. Introduction

Welcome to LangBot (hereinafter referred to as "we", "us", or "the Platform"). We understand the importance of your personal information and are committed to protecting your privacy. This Privacy Policy (hereinafter referred to as "this Policy") is designed to explain how we collect, use, store, share, and protect your personal information, as well as the rights available to you.

LangBot's online services, including LangBot Space and LangBot Cloud, are provided and operated by Beijing Langbo Intelligent Technology Co., Ltd. (北京浪波智能科技有限公司). The company acts as the data controller for the online services described in this Policy, except where this Policy expressly identifies another controller.

Please read and fully understand this Policy before using our services. If you do not agree with any terms of this Policy, please stop using our services. By continuing to use our services, you acknowledge that you have read, understood, and agreed to be bound by this Policy.

This Policy is formulated in accordance with the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, and other applicable laws and regulations, while also referencing the requirements of the EU General Data Protection Regulation (GDPR).

2. Definitions and Scope

2.1 Definitions

2.2 Scope

This Policy applies to the following services:

Important Note: For self-hosted LangBot Core instances, the data controller is the instance operator, not Beijing Langbo Intelligent Technology Co., Ltd. We are responsible for the telemetry and diagnostics received by our services as described in Section 4.2. These data can be pseudonymous, not anonymous; Beta diagnostics are enabled by default in Beta builds and can be disabled. See Section 15 for details.

3. Data Controller

3.1 LangBot Space Platform

For LangBot Space, LangBot Cloud, and other official LangBot online services, the service provider and data controller is:

Beijing Langbo Intelligent Technology Co., Ltd. (北京浪波智能科技有限公司)
Contact Email: [email protected]

3.2 Cloud Pods

For Cloud Pods hosted on our infrastructure:

• Infrastructure Provider: Beijing Langbo Intelligent Technology Co., Ltd. (responsible for hosting, security, and availability)
• Content Controller: The user who provisions the Cloud Pod (responsible for bot configuration, connected platforms, and end-user interactions)

3.3 Self-Hosted Instances

For LangBot Core instances self-hosted using our open-source software:

• Data Controller: Instance Operator
• Our Role: Software provider; we also process telemetry and diagnostics sent to our services as described in Section 4.2

We do not control or bear responsibility for the data processing practices of third-party operated LangBot instances. Please consult the relevant instance operator for their privacy policy.

4. Information We Collect

4.1 LangBot Space Platform User Information

4.1.1 Account Information

4.1.2 Service Usage Data

4.1.3 Payment Information

We do not store: Bank card numbers, payment passwords, complete payment credentials, or other sensitive payment information.

4.1.4 Developer Information

4.2 Telemetry Data (from Self-Hosted Instances)

Existing product telemetry and Beta diagnostics are separate data streams sent to the configured LangBot Space service (by default https://space.langbot.app). This update describes Core 4.11.0-beta.2 diagnostics schema v1; it does not change existing product analytics settings.

Existing product telemetry

When enabled, query telemetry can include instance and Workspace identifiers, a random query ID, version, adapter/runner types, model name, duration, timestamp, pipeline plugin names and feature usage. Feature usage includes tool-call counts by source, tool-call rounds, knowledge-base/retrieved-entry counts, knowledge-engine plugin IDs, sandbox execution/error counts, activated skill names and configured MCP server names. Workspace heartbeats after startup and daily include deployment/database categories, sandbox configuration and availability, adapter types and resource counts. Managed SaaS query events can also send a runtime deployment identifier for idle-timeout activity; it is not stored in analytics event records. Optional surveys contain submitted answers and participation metadata.

Feature counters do not intentionally include tool arguments/results, retrieved text or sandbox code/output. The legacy error field can contain raw tracebacks and exception text; it and user-defined model, skill or MCP names may contain sensitive information. The new content-free diagnostics rules do not sanitize existing telemetry.

Beta diagnostics v1

Beta diagnostics are on by default in Beta builds only. Stable, alpha and release-candidate builds do not enable this producer; this release has no stable opt-in. There is no additional setup, consent wizard or required test step. Bounded background queues, batches, timeouts and retries keep diagnostic transport off the normal bot request path. Records may be lost when queues fill or networks fail.

Allowlisted records contain versions/build revision, environment and capability categories, public component IDs, operation/event categories, execution stage, observed outcome, counts, duration, fixed reason codes, error categories and code-derived fingerprints, plus sender health counters. Error fingerprints do not use exception messages. Independent instance_id and optional workspace_uuid, and opaque event/trace/span/run identifiers, correlate diagnostic steps. Instance-level records may have no Workspace.

These identifiers are pseudonymous, not anonymous. An instance and a Workspace are different identity dimensions and may be associated with an account or deployment. An unauthenticated report is not necessarily unidentifiable.

Beta diagnostic records exclude messages, prompts, model replies, raw platform events, tool/API arguments and results, form values, file/media contents, filenames/local paths, raw URLs/query strings, credentials, platform user/group IDs, user-defined resource names, and raw exceptions/tracebacks. Network infrastructure sees sender IP addresses for delivery and abuse prevention; this is not a guarantee that service access logs are IP-free.

Diagnostics support compatibility and regression investigation, separately from query usage, retention/funnel statistics, account bindings and managed runtime idle-timeout activity. A platform API accepting a request does not prove a user received or read a message; absent or untested records do not demonstrate success.

Controls, retention and deletion

Set space.disable_beta_diagnostics: true in the existing space section of data/config.yaml and restart LangBot to disable only Beta diagnostics. It does not change query telemetry, heartbeats, surveys or other product analytics settings. The master switch space.disable_telemetry: true takes precedence and disables Core telemetry, including Beta diagnostics, query/heartbeat sends and survey fetching. Use YAML booleans (true/false), not quoted strings. If your deployment sets SPACE__DISABLE_BETA_DIAGNOSTICS or SPACE__DISABLE_TELEMETRY, those environment values override the file at startup; update or remove them too, then restart the process (recreate a container when changing its environment). Diagnostics also require a configured space.url; local-version builds such as 4.11.0b2+local do not enable the producer. These switches do not alter privacy settings of messaging platforms, plugins, model providers or other online services.

Beta diagnostics can be read by administrators, members explicitly authorized for telemetry access, and authorized service API clients. Ordinary Workspace membership does not itself grant this access. Server default cleanup thresholds are 30 days for diagnostic detail and 90 days for aggregates, with configuration bounded by those limits. Records become eligible for deletion at these thresholds; a scheduled worker removes them in bounded batches. Backlogs or service interruptions can delay removal, so these are not guarantees of deletion at an exact hour. These periods do not change existing product-analytics retention settings. Once opt-out takes effect, future diagnostic sends stop and local pending diagnostic records are cleared. Records already received by the server are not deleted by opt-out. Request historical deletion from [email protected] or your Space administrator; active administrators and authorized service API clients can delete diagnostics by instance and, where applicable, Workspace. Telemetry read permission alone does not permit deletion or error-status changes. Share identifiers privately.

See the Data Collection Policy and optional Beta test checklist for details; 中文 and 日本語 are also available.

4.3 Cloud Pod Data

For Cloud Pods provisioned through LangBot Space:

Note: Message content within Cloud Pods is processed by the LangBot instance running inside the Pod. We provide the infrastructure but do not monitor, access, or analyze the content of conversations unless required by law or requested by the Pod owner for troubleshooting purposes.

5. How We Collect Information

5.1 Information You Directly Provide

• Information filled in when registering an account
• Information provided when completing your profile
• Information authorized when logging in with a third-party account
• Information filled in when submitting plugins
• Information provided when contacting support or submitting feedback

5.2 Automatically Collected Information

• Access logs and usage data
• Device and browser information (via cookies)
• Telemetry data (can be disabled)

5.3 Information from Third-Party Sources

• Public information provided by OAuth login providers (GitHub, Google)
• Transaction status information returned by payment providers

6. Purpose and Legal Basis for Information Use

6.1 Purposes of Use

6.2 Legal Basis

Under Article 13 of the Personal Information Protection Law, we process your personal information based on the following legal bases:

7. Information Sharing and Disclosure

7.1 We Do Not Proactively Share Your Personal Information

Except in the following circumstances, we will not share your personal information with third parties.

7.2 Sharing with Your Consent

With your explicit consent, we may share your information with third parties.

7.3 Service Providers

We may engage the following types of service providers to process your information:

We require all service providers to comply with strict data protection obligations.

7.4 Legally Required Disclosure

We may disclose your information in the following circumstances:

• To comply with laws, regulations, court orders, or mandatory government requirements
• To protect the rights, property, or safety of us, our users, or the public
• To detect, prevent, or address fraud, security, or technical issues

7.5 Business Transfers

In the event of a merger, acquisition, or asset sale, your personal information may be transferred as a transaction asset. We will notify you before the transfer and ensure the recipient continues to comply with this Policy.

8. Cross-Border Data Transfers

8.1 Data Storage Locations

8.2 Cross-Border Transfer Scenarios

When we need to transfer your personal information abroad, we will:

1. Conduct Security Assessments: Perform data export security assessments as required by national cyberspace authorities
2. Sign Standard Contracts: Enter into standard contracts formulated by national cyberspace authorities with overseas recipients
3. Obtain Your Separate Consent: Clearly inform you and obtain your separate consent before the transfer

8.3 Information Disclosure

When transferring data abroad, we will inform you of:

• The name and contact information of the overseas recipient
• The purpose and method of processing
• The types of personal information involved
• The methods and procedures for exercising your rights with the overseas recipient

9. Data Storage and Retention

9.1 Storage Methods

9.2 Retention Periods

9.3 Data Deletion

When the retention period expires or you request deletion, we will:

• Delete or anonymize your personal information
• Notify third parties who have received the information to delete it
• Except where retention is required by law

10. Data Security

10.1 Security Measures

We take the following measures to protect your personal information:

10.2 Security Incident Response

In the event of a personal information security incident, we will:

1. Respond Immediately: Activate emergency plans to prevent further damage
2. Assess Impact: Determine the scope of affected data and users
3. Notify Regulators: Report to relevant regulatory authorities as required by law
4. Notify Users: Inform affected users via email, in-app notifications, or other means
5. Remediate: Take measures to mitigate damage and prevent recurrence

11. Your Rights

Under the Personal Information Protection Law and related legislation, you have the following rights:

11.1 Right to Know and Right to Decide

You have the right to know how we process your personal information and the right to decide whether to consent to specific processing activities.

11.2 Right of Access and Right to Copy

You have the right to access and copy your personal information. You can exercise this right by:

• Logging into your account to view your profile
• Contacting us to obtain a copy of your data

11.3 Right to Rectification and Supplementation

When you discover that your personal information is inaccurate or incomplete, you have the right to request correction or supplementation:

• Modify directly in account settings
• Contact us for assistance

11.4 Right to Deletion

You have the right to request deletion of your personal information in the following circumstances:

• The processing purpose has been achieved or is no longer necessary
• You withdraw consent and there is no other legal basis
• We process information in violation of laws, regulations, or our agreement with you
• Other circumstances specified by laws and regulations

Limitations on Deletion Requests:

• Information required to be retained by laws and regulations (e.g., payment records)
• Information related to public interest
• Information necessary for contract performance

11.5 Right to Withdraw Consent

For personal information processed based on your consent, you have the right to withdraw consent at any time:

• Disable telemetry: Set space.disable_telemetry: true
• Unsubscribe from marketing: Click the "unsubscribe" link in emails
• Delete account: Apply in account settings

Withdrawal of consent does not affect the lawfulness of processing carried out based on consent prior to withdrawal.

11.6 Right to Data Portability

You have the right to obtain your personal information in a structured, commonly used format and to request that we transfer it to a third party you designate (where technically feasible).

11.7 Right to Refuse Automated Decision-Making

For decisions made entirely through automated decision-making that significantly affect your rights and interests, you have the right to request an explanation and the right to refuse decisions made solely through automated means.

11.8 How to Exercise Your Rights

You can exercise the above rights through the following methods:

We will respond within 15 business days of receiving your request. For complex requests, we may need to extend to 30 business days, and we will notify you in advance.

12. Cookies and Tracking Technologies

12.1 Cookies We Use

12.2 Cookie Management

You can manage cookies through your browser settings:

• View and delete stored cookies
• Block specific or all cookies
• Set cookie expiration times

Note: Disabling essential cookies may cause some features to not function properly.

12.3 Similar Technologies

In addition to cookies, we may use:

• Local Storage (localStorage): Store user preferences
• Session Storage (sessionStorage): Temporary session data

13. Automated Decision-Making and Artificial Intelligence

13.1 AI Model Usage

LangBot integrates multiple large language models (LLMs) to provide intelligent conversational services. LangBot itself does not provide AI models — it connects to third-party LLM providers configured by the user.

13.2 Data Usage Statement

We do not use your data to train AI models.

13.3 Automated Decision-Making

We may use automated processing for:

• Content Moderation: Detecting prohibited content in plugin submissions
• Security Detection: Identifying abnormal behavior
• Resource Management: Automated Cloud Pod scaling and idle detection

You have the right to:

• Understand the logic of automated decision-making
• Request human review of decisions that significantly affect you
• Refuse fully automated decision-making

14. Protection of Minors

14.1 Age Requirement

LangBot Space platform services are intended for users aged 14 and above. We do not intentionally collect personal information from minors under 14 years of age.

14.2 Guardian Responsibility

If you are the guardian of a minor and discover that your ward has used our services without your consent, please contact us immediately and we will take steps to delete the relevant information.

14.3 Minors Under 14

Under the Personal Information Protection Law, all personal information of minors under 14 is classified as sensitive personal information. If such information needs to be processed:

• Explicit consent from parents or guardians must be obtained
• Dedicated processing rules must be established
• Strict protective measures must be adopted

15. Self-Hosted Instances

15.1 Responsibility Allocation

For instances deployed using LangBot Core open-source software:

15.2 What We Do Not Control

For self-hosted instances, we do not control and are not responsible for:

• User data collected by the instance operator
• Storage and processing of message content
• Privacy practices of the instance operator
• Data processing by third-party LLM providers

15.3 Obligations of Instance Operators

If you deploy a LangBot Core instance, you should:

• Establish and publish your own privacy policy
• Comply with applicable data protection laws
• Be responsible for bot end user data
• Respond to user rights requests

15.4 Telemetry Data

Existing product telemetry remains separately configurable. Beta diagnostics are on by default only for Beta builds; stable, alpha and release-candidate builds do not enable the producer. See Section 4.2 for the legacy error-content caveat, diagnostic field limits and pseudonymous identifiers.

• Disable only Beta diagnostics: set space.disable_beta_diagnostics: true and restart LangBot.
• Disable Core telemetry, including Beta diagnostics: set space.disable_telemetry: true and restart LangBot.
• Opt-out clears pending local diagnostics after it takes effect, not historical server records. Request historical deletion from [email protected] or your Space administrator.

16. Plugins and Third-Party Services

16.1 Plugin Marketplace

The LangBot Space plugin marketplace offers plugins published by third-party developers.

Important:

• Plugins are developed and maintained by third-party developers
• Each plugin may have its own privacy policy
• Please review the privacy terms before installing plugins
• We are not responsible for data processing by third-party plugins

16.2 Plugin Developer Responsibilities

Plugin developers must:

• Provide a privacy policy (if collecting any user data)
• Comply with our developer agreement
• Accurately disclose data collection practices
• Respond to user privacy requests

16.3 Third-Party LLM Services

LangBot supports connecting to various third-party LLM services (such as OpenAI, Anthropic, DeepSeek, Google Gemini, etc.).

Note:

• Content sent to LLMs is processed by the respective providers
• Please refer to each LLM provider's privacy policy
• We do not control third-party LLM data processing

16.4 Instant Messaging Platforms

LangBot supports connecting to various IM platforms (QQ, WeChat, Telegram, Discord, Slack, LINE, Lark, DingTalk, KOOK, etc.).

Note:

• Platform messages are subject to each platform's privacy policy
• Platform-assigned user identifiers are managed by the platforms
• We only process publicly available information provided by the platforms

17. Changes to This Privacy Policy

17.1 Change Notification

We may update this Policy from time to time. When we do, we will:

• Update the "Last Updated" date at the top of this Policy
• For material changes, notify you 7 days in advance via email or in-app notification

17.2 Material Changes

The following circumstances constitute material changes:

• Significant changes to the types of information collected
• Significant changes to the purposes of information use
• Significant changes to the scope of third-party sharing
• Significant changes to your rights

17.3 Continued Use

After changes take effect, your continued use of our services constitutes acceptance of the updated Policy. If you disagree with the changes, please stop using our services and contact us to delete your account.

18. Contact Us

If you have any questions, comments, or requests regarding this Policy, please contact us through the following channels:

Response Time:

• General inquiries: Within 3 business days
• Rights requests: Within 15 business days

19. Region-Specific Terms

19.1 Users in Mainland China

If you are a user in mainland China, the following terms specifically apply:

• Applicable Law: This Policy is governed by the Personal Information Protection Law, Cybersecurity Law, and Data Security Law of the People's Republic of China
• Dispute Resolution: Disputes arising from this Policy shall be under the jurisdiction of the competent people's court in our location
• Cross-Border Transfer: Before transferring personal information abroad, we will obtain your separate consent and complete security assessments as required by law

19.2 Users in the European Economic Area (EEA), United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, the following GDPR-related terms apply:

19.3 Users in California, USA

If you are a California resident, under the California Consumer Privacy Act (CCPA/CPRA), you have the following additional rights:

• Right to Know: Understand the categories and purposes of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information
• Right to Non-Discrimination: Exercise of privacy rights will not result in discriminatory treatment

We do not "sell" your personal information (as defined by CCPA).

Appendices

Appendix A: Data Processing Activities

Appendix B: Third-Party Service Providers

Appendix C: Glossary

Beijing Langbo Intelligent Technology Co., Ltd. reserves the right of final interpretation of this Privacy Policy.

Document Version: 1.5 Last Updated: September 15, 2026