Data Protection & Security
Your data security and privacy are our top priorities. Learn how we protect your information and comply with global data protection regulations.
End-to-End Encryption
All data transmitted between your device and our servers is encrypted using industry-standard TLS 1.3 encryption. Your API credentials and session data are encrypted at rest using AES-256 encryption.
Zero-Knowledge Architecture
We cannot access your Telegram credentials or session data. Your StringSession is stored locally in your browser and only transmitted securely to our API endpoints when needed for operations.
GDPR Compliance
We are fully compliant with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This includes:
- Right to Access: You can request a copy of all personal data we hold about you.
- Right to Rectification: You can request corrections to any inaccurate personal data.
- Right to Erasure: You can request deletion of your personal data at any time.
- Right to Portability: You can request your data in a machine-readable format.
- Right to Object: You can object to processing of your personal data for certain purposes.
Data Collection & Usage
What We Collect:
- Email address and name (optional, for account creation)
- Usage analytics (message counts, campaign performance)
- Payment information (processed securely by Stripe)
- Technical data (IP address, browser type, for security purposes)
What We Don't Collect:
- Your Telegram credentials (stored locally only)
- Content of your messages
- Personal information from extracted contacts
- Unnecessary tracking or behavioral data
Security Measures
Technical Safeguards
- SOC 2 Type II compliant infrastructure
- Regular security audits and penetration testing
- Multi-factor authentication for admin access
- Automated vulnerability scanning
- Secure coding practices and code reviews
Operational Safeguards
- Employee background checks and training
- Principle of least privilege access
- Incident response procedures
- Regular backup and disaster recovery testing
- 24/7 security monitoring
Data Retention
We retain your data only as long as necessary to provide our services and comply with legal obligations:
- Account Data: Retained until account deletion or 3 years of inactivity
- Usage Analytics: Aggregated data retained for up to 2 years for service improvement
- Payment Records: Retained for 7 years as required by financial regulations
- Support Communications: Retained for 3 years for quality assurance
International Data Transfers
Our primary data processing occurs within the European Union and United States. When data is transferred internationally, we ensure adequate protection through:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions for transfers to countries with adequate protection
- Additional safeguards such as encryption and access controls
Contact Our Data Protection Officer
If you have any questions about our data protection practices or wish to exercise your rights, please contact our Data Protection Officer:
Email: dpo@yourcompany.com
Address: Data Protection Officer, [Your Company Address]
Response Time: We will respond to all requests within 30 days