Informativa sulla privacy

This Privacy Policy (“Policy”) explains how personal data is processed in connection with the PostBot Telegram bot, the PostBot “Studio” Mini App and related functionality (collectively, “PostBot” or the “Service”).

PostBot is operated by:

G MEDIA PARTNERS EUROPE d.o.o. Starine Novaka 23 Beograd, Republika Srbija Website: g.media Privacy and data enquiries: [email protected] Telegram: @postbotsupport

Where Regulation (EU) 2016/679 (the “GDPR”) applies to a particular processing activity, G.Media acts as a controller or processor according to its role in that activity.

Who This Policy Applies To

This Policy applies to:

• PostBot users;
• owners and administrators of connected Telegram channels;
• PostBot team members;
• people interacting with PostBot functionality within Telegram channels; and
• members and other audience members of connected Telegram channels whose data is processed in connection with particular functionality.

An individual whose information is processed in connection with a Telegram channel is not necessarily a PostBot user.

G.Media's Role

G.Media as Controller

G.Media determines the purposes and essential means of processing required for:

• operation of PostBot accounts;
• authentication;
• provision of Service functionality;
• Premium and AI credits;
• payment accounting;
• support;
• security;
• fraud and abuse prevention;
• operation and protection of infrastructure; and
• legal compliance.

For such processing, G.Media acts as controller.

Channel Audience Data

Where a channel owner or administrator uses functionality involving channel audience data, the legal roles of the parties depend on the particular processing activity.

Where the channel owner or administrator independently determines the purposes of processing audience data and PostBot processes that information to provide functionality requested by that owner or administrator, the owner or administrator may act as controller and G.Media may act as processor for the relevant processing.

G.Media remains an independent controller for processing carried out for its own purposes, such as security, fraud prevention, support, billing and infrastructure protection.

Channel owners and administrators remain responsible for their own obligations to their audiences, including establishing an appropriate legal basis and providing notices where required by applicable law.

PostBot Account Data

We may store:

• Telegram user ID;
• language;
• time zone;
• referral code;
• Telegram ID of the user who referred you;
• Premium term;
• Telegram Stars subscription ID and term;
• AI usage counters;
• AI credit balance and credit lots;
• last activity date;
• whether the user has blocked the bot; and
• account creation date.

We do not store your name, Telegram username or phone number as permanent PostBot account fields.

This information may be supplied by Telegram as part of Telegram Mini App initData when the Mini App is launched and used within the user's session.

Authentication

PostBot does not use separate user passwords.

For Telegram Mini App authentication:

1. Telegram supplies signed initData; 2. PostBot verifies its authenticity using HMAC; 3. a signed server-side session is created following successful verification; and 4. the session is maintained using a cookie.

The session cookie is technically necessary for authentication and is not used for advertising tracking.

Content and Publications

PostBot may store information concerning:

• posts;
• drafts;
• scheduled publications;
• recurring publications;
• templates;
• publishing settings;
• delivery records for individual channels;
• Telegram ID of the author;
• Telegram ID of the person who published the content; and
• Telegram ID of the person who edited the content.

Media

PostBot does not maintain its own permanent file storage for ordinary publication media.

Files are re-hosted through Telegram and the PostBot database stores the relevant Telegram file_id.

A temporary Telegram message used for re-hosting is deleted immediately after completion of the relevant operation.

Video Messages

The video-message editor may temporarily store an MP4 file on the server.

The file is deleted:

• upon publication; or
• automatically within 30 minutes.

AI Studio

When PostBot AI functionality is used, we may process:

• prompt text;
• generation settings;
• reference images;
• audio;
• video;
• other submitted materials;
• generated output;
• the output's Telegram file_id;
• association of the request with the user's Telegram user ID; and
• AI credit usage information.

AI prompts and results may be stored for the relevant user to provide history and related Service functionality.

Necessary materials may be transmitted to the relevant AI provider to perform the user's request.

Users should not submit third-party personal or confidential information to AI Studio unless they have the rights or other lawful basis required to do so.

Telegram Channel Data

For connected channels, PostBot may store:

• Telegram channel ID;
• channel name;
• public @username, where available;
• subscriber count;
• owner information;
• PostBot channel settings; and
• information required for publishing, collaboration and analytics.

Teams

For collaboration functionality, PostBot may store:

• team member Telegram IDs;
• roles;
• permissions; and
• team membership.

PostBot also maintains a team audit log.

It may contain:

• user identifier;
• action performed;
• date and time;
• affected object;
• previous value; and
• new value.

The audit log is used for collaboration functionality, auditing, security, diagnostics and dispute resolution.

Channel Audience Data

To provide analytics and interactive functionality, PostBot may process information concerning people who do not themselves use PostBot.

Membership Events

Depending on events made available by Telegram, we may process:

• Telegram IDs of users who join;
• Telegram IDs of users who leave;
• Telegram IDs of users who are removed;
• Telegram IDs of users submitting join requests;
• event type; and
• event time.

Subscriber counts are also retained in aggregate form.

PostBot Reaction Buttons

When a person interacts with a PostBot reaction button, we may store:

• Telegram user ID;
• name supplied by Telegram;
• selected reaction;
• relevant post; and
• interaction time.

For native Telegram reactions, PostBot uses aggregate metrics only and does not retain individual user identifiers as part of the analytics described here.

Boosters

PostBot may receive Telegram IDs of users who boost a connected channel where this information is provided by Telegram.

Giveaways

Depending on the giveaway mechanics, we may store:

• Telegram user ID;
• name;
• participation status;
• information necessary to verify participation requirements; and
• winner status.

Views

PostBot may obtain aggregate publication view counts from public Telegram pages in the format t.me/s/<channel>.

The channel's public @username is used for this purpose.

This process does not collect identifiers of individuals who viewed a publication.

Link Clicks

Technical request information may be processed for link-click tracking.

PostBot uses a hash of the user-agent. The user's Telegram user ID is not stored for such a click.

Polls

PostBot uses aggregate voting metrics for poll analytics.

Telegram IDs of individual voters are not stored as part of this analytics functionality.

Payments

PostBot uses Telegram Stars (XTR) for paid digital functionality.

We may store:

• payer Telegram ID;
• payment identifier;
• amount;
• purchase type;
• status;
• date and time;
• subscription identifier;
• Premium term;
• AI credit balance;
• credit lots; and
• expiration dates.

Unless otherwise stated at purchase, individual purchased AI credit lots are valid for 90 days.

G.Media does not receive or store payment card details.

Payments are processed through Telegram and the relevant payment infrastructure.

Technical Data and Logs

Technical data necessary to operate, diagnose and secure the Service may be processed.

PostBot logging is designed to exclude or redact sensitive authentication information.

In particular, ordinary application logs are not intended to contain:

• authentication headers;
• session cookies;
• Telegram Mini App initData;
• secret keys and tokens.

Cloudflare and other infrastructure providers may process standard network information, including IP addresses and request metadata, as necessary for traffic delivery and security.

Sources of Personal Data

We may receive information:

• directly from users;
• from Telegram;
• through activity within PostBot;
• through events relating to connected Telegram channels;
• from channel owners and administrators;
• from public Telegram pages;
• through Telegram payment infrastructure;
• from AI providers when generated output is returned; and
• from technical service providers.

For Telegram channel audiences, personal data may therefore be obtained indirectly through Telegram or in connection with a channel being connected to PostBot.

Purposes and Legal Bases

Where the GDPR applies, the applicable legal basis depends on the particular processing activity.

Performance of a Contract — Article 6(1)(b) GDPR

We process information where necessary to provide functionality requested by a user, including:

• accounts and authentication;
• content creation and publishing;
• scheduling and automation;
• drafts and templates;
• team collaboration;
• Premium;
• AI credits;
• user-initiated AI functionality; and
• other requested Service functionality.

Legitimate Interests — Article 6(1)(f) GDPR

We may process information for legitimate interests pursued by G.Media or, where relevant, a channel owner, including:

• security;
• fraud and abuse prevention;
• infrastructure protection;
• diagnostics;
• audit logging;
• analytics;
• Service reliability;
• protection of G.Media and user rights; and
• handling disputes and claims.

When relying on legitimate interests, the necessity of processing and its impact on the rights and freedoms of individuals are considered.

Consent — Article 6(1)(a) GDPR

Where applicable law requires consent for a particular optional processing activity, consent is requested separately.

Consent may be withdrawn. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Legal Obligation — Article 6(1)(c) GDPR

Information may be processed or retained for accounting and tax obligations, binding requests from public authorities and other applicable legal obligations.

Information may also be retained to the extent necessary for the establishment, exercise or defence of legal claims.

Recipients and Service Providers

We do not sell personal data.

Information may be disclosed to the following categories of recipients to the extent required for the relevant functionality.

Telegram

Telegram is the primary platform through which PostBot operates.

Content, media, messages, channel information, Bot API updates, payments, Telegram Stars and Mini App data may be processed through Telegram.

AI Providers

Where the corresponding functionality is used, information may be transmitted to:

• OpenAI;
• DeepSeek;
• OpenRouter;
• Google Gemini;
• Anthropic Claude;
• xAI / Grok;
• Leonardo.ai;
• Kling AI; and
• ElevenLabs.

When OpenRouter is used, information may be transmitted to the provider of the model selected through OpenRouter.

Gramesh

PostBot may provide Telegram channel identifiers to the internal Gramesh analytics API for functionality relating to metrics such as views and reposts.

Cloudflare

Cloudflare is used in front of PostBot server infrastructure for network delivery, performance and security.

G.Media Infrastructure

PostBot's principal server-side storage infrastructure is located in the European Union.

Public Authorities

Information may be disclosed where necessary to comply with a binding legal requirement, court order or lawful request of a competent authority.

Advertising and Third-Party Tracking

The PostBot client contains no third-party advertising or behavioural analytics trackers.

PostBot does not use tracking cookies to create advertising profiles.

Technical processing by Telegram, Cloudflare and other services necessary to operate the infrastructure is not advertising tracking by PostBot.

International Data Transfers

PostBot's principal server-side storage infrastructure is located in the European Union.

The Operator, G MEDIA PARTNERS EUROPE d.o.o., is established in the Republic of Serbia.

Telegram, certain AI providers and other service providers may process information in multiple jurisdictions, including countries outside the European Economic Area.

Where Chapter V GDPR applies to a particular international transfer, G.Media uses the transfer mechanism and safeguards required by applicable law.

Depending on the recipient and circumstances, these may include an adequacy decision, European Commission Standard Contractual Clauses or another legally permitted mechanism.

Information regarding safeguards applicable to a particular transfer of your information may be requested at [email protected].

Data Retention

We retain personal data only for as long as necessary for the relevant processing purposes unless a longer retention period is required by law.

Account

The core technical account record is retained for as long as necessary to operate the Service, maintain security, administer subscriptions and payments, prevent abuse and comply with legal obligations.

Content

Drafts, scheduled publications, templates and other content-related information are retained while necessary to provide the functionality or until deleted by the user or through the Service's applicable deletion logic.

Media

Ordinary media is not stored in PostBot's own permanent file storage.

Temporary MP4 files used by the video-message editor are deleted upon publication or automatically within 30 minutes.

Temporary Telegram messages used for re-hosting are deleted immediately after the relevant operation.

AI Prompts and Results

AI prompts and results may be retained while necessary to provide history and related AI functionality or until removed through available deletion mechanisms or a justified user request.

Channel Analytics

Channel-related analytics are retained until the relevant channel is removed from PostBot unless particular information must be retained on another lawful basis.

Audit Logs

Team audit logs are retained in connection with the channel.

When a channel is removed, related information is deleted according to Service logic. Certain audit records may remain with the deleted channel identifier cleared where necessary for security, auditing or dispute resolution.

Payments

Payment records are retained for the period required for accounting, taxation, refunds, dispute resolution and other applicable legal obligations.

Caches

Temporary operational caches exist only in memory and generally remain for minutes or approximately one hour.

Technical Logs

Application logs are retained for the period necessary for security, diagnostics and operation of the Service and are then deleted or overwritten in accordance with internal retention rules.

Data Deletion

Users may use:

Settings → Data → Delete PostBot Data.

The function deletes, among other things:

• drafts;
• scheduled publications;
• failed publications;
• notifications;
• related delivery records; and
• related PostBot reaction-button interaction records.

Posts already published to Telegram channels are not automatically removed.

The current “Delete PostBot Data” function does not itself automatically physically delete the core technical account database row.

Users may make a separate personal data deletion request at [email protected].

Following verification of the request, information is deleted or irreversibly de-identified to the extent required by applicable law.

Certain information may be retained where necessary or permitted for:

• payment accounting;
• legal compliance;
• security;
• abuse prevention; or
• establishment, exercise or defence of legal claims.

Data Protection Rights

Where the GDPR applies, subject to its applicable conditions you may have the right to:

• receive information about processing;
• access your personal data;
• rectify inaccurate information;
• complete incomplete information;
• request erasure;
• request restriction of processing;
• receive eligible information in a portable format;
• object to processing based on legitimate interests;
• withdraw consent where processing relies on consent; and
• lodge a complaint with a competent data protection authority.

Where you object to processing based on legitimate interests, further processing will continue only where permitted by applicable law.

Exercising Your Rights

Contact [email protected].

We may request information reasonably necessary to identify the relevant records or verify control of the relevant Telegram account.

If you are not a PostBot user but interacted with a connected Telegram channel, additional information may be required to locate information relating to you.

Where the GDPR applies, requests are handled within the time limits prescribed by the GDPR, generally within one month, subject to extensions permitted by law.

Complaints

Where the GDPR applies, you may lodge a complaint with a competent data protection authority, including, where applicable, the authority in the EEA country of your habitual residence, place of work or place of the alleged infringement.

As G.Media is established in Serbia, matters falling under Serbian data-protection law may also be addressed to the:

Commissioner for Information of Public Importance and Personal Data Protection Republic of Serbia.

Contacting G.Media first is not a condition for exercising a statutory right to lodge a complaint.

Security

We maintain technical and organisational measures designed to protect information against unauthorised access, loss, alteration, destruction and disclosure.

These measures include:

• PostgreSQL application data storage;
• principal server-side storage infrastructure in the EU;
• Cloudflare in front of the Service infrastructure;
• verification of Telegram Mini App initData before sessions are created;
• signed server-side sessions;
• exclusion or redaction of authentication headers, cookies and initData from application logs;
• exclusion of secrets from ordinary logging;
• use of Telegram file_id rather than permanent PostBot file storage for ordinary media; and
• automatic deletion of temporary video-message files.

No storage or transmission method can provide absolute security.

Where a personal data breach occurs, we comply with applicable requirements concerning assessment and notification of competent authorities and affected individuals.

Storage on Your Device

PostBot may use Telegram Mini App or browser localStorage to store:

• theme;
• language;
• time zone;
• local composer draft;
• emoji-pack settings; and
• sticker-pack settings.

This information remains on the user's device until deleted, overwritten or removed through the relevant local storage controls.

A signed session cookie is used for server authentication.

PostBot does not use advertising tracking cookies.

Children

PostBot is not intended for individuals younger than 13 years of age or any higher minimum age required by Telegram or applicable law in the user's country.

Where a higher age applies to a particular country or functionality, that age applies.

If you believe PostBot is unlawfully processing information relating to a child, contact [email protected].

Changes to This Policy

We may update this Policy when the Service, processing activities, providers or legal requirements change.

The date of the current version appears at the beginning of this Policy.

Where a change materially affects personal data processing or user rights, we may provide notice through PostBot, Telegram, an official channel or another reasonable method.

Where applicable law requires separate consent, continued use of the Service alone will not replace such consent.

Relationship With the Terms of Use

Use of PostBot is also governed by the PostBot Terms of Use.

This Policy governs the processing of personal data.

Where a Telegram channel owner or administrator independently determines the purposes of processing audience data through PostBot, that person remains responsible for their own data-protection obligations under applicable law.

Contact

For privacy, personal data and data-subject rights enquiries:

G MEDIA PARTNERS EUROPE d.o.o. Starine Novaka 23 Beograd, Republika Srbija

Website: g.media Email: [email protected] Telegram: @postbotsupport