Privacy Policy

Account details: business name, email address, phone number and country. Product data: the website URLs you add, your widget settings such as greeting, colours and position, and your Telegram bot token, which is encrypted before it is stored. Visitor events: anonymous page views, sessions and chat opens, used to show you how the widget performs on your site.

We do not keep permanent message content. Chat messages are deleted 24 hours after they are sent, so we cannot read a conversation from last month. Visitors do not need an account to start a chat, and we never ask them for a password, payment details or an email address.

We use your data to deliver the chat service: routing visitor messages to your Telegram group, showing your dashboard, and sending transactional email such as confirmation links, password reset links and billing notices. We do not sell personal data, and we do not use it for advertising.

Each website you add gets one first-party cookie that identifies a returning visitor so an open chat reconnects to the right conversation. It holds a random identifier and nothing else. There are no advertising or cross-site tracking cookies on your main site or in the widget.

We rely on a small set of processors, each of which only receives what it needs: Supabase stores account data and visitor events, Telegram delivers messages to you and back to the visitor, Resend sends transactional email, and Cloudflare serves the widget and this website.

Messages and their attachments are deleted 24 hours after they are sent. Visitor events are kept for analytics and then removed or aggregated. Account data — business details, websites and widget settings — stays until you delete your account, after which it is removed within 30 days.

Telegram bot tokens and other secrets are encrypted at rest. Every database table is protected by row-level security, so one account can never read another account's rows. Sessions travel in http-only cookies and are refreshed on every request. No system is perfect: if we ever find a breach that affects your account, we will tell you.