Privacy Policy - Pocket Secretary (Telegram bot)
Last updated: YYYY-MM-DD
1. Who we are
Pocket Secretary (the "Bot") is operated by FOP Ihor Aleksandrin, 70 Ispanska St., Kharkiv, 61205, Ukraine ("we"). Contact: support@dobriedela.com or the Bot's /paysupport command.
The Bot has two kinds of users:
- Owners: professionals who connect the Bot to their Telegram Business account and configure it.
- Clients: people who write to an Owner in a chat where the Bot is active.
For the data a Client types into an Owner's request or booking form, the Owner decides why and how the data is used (controller); we process it on the Owner's behalf (processor). For Owner account data, settings and payments, we are the controller.
2. What the Bot does in Telegram Business
The Bot acts only in the private chats that the Owner selected when connecting it under Telegram Settings > Business > Chatbots, and only with the permissions the Owner granted. It never acts in groups or channels. Every greeting tells the Client that this is an automated assistant. We do not hide the Bot's activity from the Owner: each request, booking and "talk to a person" call is sent to the Owner as a message.
3. Data we process
| Data | Whose | Why | Kept |
|---|---|---|---|
| Telegram user id, chat id with the Bot | Owner | identify the Owner, send notifications | until the Owner deletes data (/deletedata) |
| Business connection id, whether replying is allowed, enabled/disabled | Owner | operate the connection | same |
| Settings and texts: business name, prices, address, hours, UTC offset, greeting, FAQ items, booking slots | Owner | run the Bot with the Owner's answers | same |
| Plan status and payment records (receipt id, Stars amount, date) | Owner | provide Pro, refunds, accounting | payment records are kept for the period required by tax and accounting law |
| Request form: name, need, preferred time, Telegram id and username | Client (typed on purpose) | deliver the request to the Owner | until the Owner deletes it (/deletelead, /deletedata) |
| Booking request: name, chosen time, Telegram id and username | Client (typed on purpose) | let the Owner confirm or decline | same |
| Chat timer record: client chat id, first name, time of last message, greeting time, "paused until" time, current form step | Client | pause when the Owner replies, avoid repeating greetings, continue a form | idle records are deleted automatically after 30 days |
| Processed update ids | technical | ignore duplicate deliveries | deleted after 2 days |
We do not store the text of Clients' chat messages. The Bot reads each incoming message in memory to choose an answer by keyword and to take the next step of a form; only the form answers listed above are saved. Messages the Owner writes in client chats are used only to know that the Owner replied (to pause the Bot); their text is not read or stored.
4. What we do not do
- No AI model or third-party service reads your chats; answers are written by the Owner and matched by keywords.
- No advertising, analytics, profiling or sale of data. No sharing with third parties, except the processors in section 6.
- We do not use data from Business chats for any purpose other than running the Bot for that Owner.
5. Legal bases (GDPR)
Owners: performance of the service they request, and legal obligations for payment records. Clients: the Owner's legitimate interest in answering enquiries and, for forms, the Client's own action in submitting them. Owners are responsible for informing their clients as required by law.
6. Where data is processed
- Telegram (messages, payments in Stars).
- Cloudflare (Workers and D1 database) hosts the Bot. Cloudflare may process data outside the EEA under its data protection terms.
We do not use other processors.
7. Your rights
Owners can view the Bot's data (/leads, /bookings, /faq, /status), export requests (/export, Pro) and delete a request (/deletelead N) or all data (/deletedata). Clients can ask the Owner, or us, to delete their request; we will do it within 30 days. You may also ask us for access, correction or restriction, and complain to the data-protection authority of the country where you live.
Deleting data does not remove the Bot from your Telegram account: do that in Telegram Settings > Business > Chatbots.
8. Security
Access to the database is limited to the Bot's Worker and the operator. Webhook calls are verified with a secret token. Secrets are stored as Cloudflare secrets, not in code.
9. Changes
If we change the scope of what the Bot does with Business data, we tell Owners in the Bot before the change takes effect so they can disconnect.
10. Telegram rules
We follow the Telegram Bot Developer Terms of Service, section 5.4 (Business bots): we describe the Bot's functionality accurately, disclose what we keep and why (this policy and /privacy), use Business-chat data only to provide the service, and do not share it with third parties without permission.