Privacy Policy

01The short version

We collect as little as we can get away with. We do not sell data and we do not build advertising profiles. Our bots store what a feature actually needs to work — chat identifiers, settings, and the record of an action taken — and not the contents of your conversations.

02Who is responsible for your data

For this website and for the bots we run ourselves, KustBots is the data controller.

When we build or operate a bot for a client, that client is the controller and we act as their processor, handling data on their instructions. If your data sits inside a client’s bot, we will pass your request on to them.

03What we collect

From people using a bot in a group or a direct message:

• your Telegram user id, username and display name, and the id of the chat;
• the commands you send to the bot, so it can do what you asked;
• for moderation features, the message is examined in memory to reach a decision. What we store afterwards is the decision itself — which rule matched, the confidence, the timestamp and the ids involved — not the message text;
• whether you are an administrator of the chat, because several features depend on it.

From clients who engage us: your name, contact handle, billing details, and any credentials you give us so we can run your services.

From this website: ordinary server request logs, which include an IP address, a user agent, the path requested and a timestamp. There are no analytics scripts, advertising tags or third-party trackers on this site.

04What we never do

• We do not sell, rent or trade personal data to anyone.
• We do not build advertising or behavioural profiles.
• We do not read private conversations, and our bots cannot see messages in chats they have not been added to.
• We do not retain message content beyond the moment a feature needs it.

05Why we process it

To provide the features you or the chat administrator asked for; to keep groups free of spam, raids and abuse; to invoice and keep proper accounts; to secure our systems and investigate abuse; and to meet legal obligations.

Where the GDPR or a similar law applies, we rely on performance of a contract, on our legitimate interest in running and protecting the service, and on legal obligation.

06Payments

Card details never reach our servers. Card payments are handled by the payment provider, which is the controller for that data under its own privacy policy.

For crypto payments we store the invoice, the paying address and the transaction hash so we can reconcile what was paid. On-chain data is public and permanent by design, and neither we nor anyone else can delete it.

07Who we share it with

• Telegram, unavoidably, because the platform carries every message;
• payment providers, for the transaction you made;
• the hosting, network and database providers that run our infrastructure, under contract and only as needed to run it;
• law enforcement or a regulator, where we are legally required to and after checking that the request is valid.

Nobody else.

08Where it is processed

Our infrastructure may sit outside your country. Where data moves across borders we use providers that offer appropriate safeguards for those transfers.

09How long we keep it

• Operational state, such as a chat’s settings or queue: for as long as the bot is in that chat, then deleted when it is removed.
• Moderation and decision logs: typically 12 months, because a dispute about a removal usually surfaces long after it happened.
• Billing and accounting records: as long as tax law requires, which is commonly seven years.
• Website request logs: 30 days.

10How we protect it

Session strings and API tokens are encrypted at rest and are never baked into container images or committed to source control. Traffic between our services is encrypted in transit. Access is limited to the engineers who actually operate the service, and credentials are rotated when someone stops working on it.

11Your rights

Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected or deleted, to receive it in a portable format, to object to processing, and to complain to your data protection authority.

Message @kustbhai and we will answer within 30 days. We may need to confirm your Telegram identity first, so that nobody can request somebody else’s data.

12Children

Our services are not directed at children under 13, or under the higher minimum age where you live. We do not knowingly collect their personal data, and we will delete it if we learn we have.

13Cookies and local storage

This website sets no cookies and runs no third-party analytics.

It stores exactly one value in your browser, kb-theme, so the site remembers whether you chose the light or dark theme. It never leaves your device and we cannot read it. Clearing your browser’s site data removes it.

14Changes to this policy

We may update this policy. The date at the top changes when we do, and anything material is announced in our updates channel.

15Contact

Privacy questions and data requests go to @kustbhai on Telegram.