Legal
Data Processing Agreement
Last updated:
1. Roles
For personal data you process through the Service (including findings and records produced from your Telegram history), you act as the data controller and we act as your data processor. This Data Processing Agreement ("DPA") forms part of the Terms of Service.
2. Scope and instructions
We process personal data only to provide the Service and on your documented instructions, which include your configuration of search goals, record types, and databases. We will not use your personal data for our own purposes.
3. Nature of processing
Processing includes reading Telegram chats on a read-only basis, analyzing message content to produce findings, storing approved records in your database, retrieving knowledge for Reply Agent answers, and operational processing such as authentication, billing, and notifications.
4. Third-party data subjects
You acknowledge that searches may process personal data of third parties who are not your users. You are responsible for having a lawful basis for that processing and for honoring data-subject requests as controller. We support you by providing export and deletion tools and by minimizing retention.
5. Sub-processors
You authorize our use of the sub-processors listed below. We impose data-protection obligations on each and remain responsible for their performance.
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Auth0 (Okta) | Platform authentication / login | Email, name, auth identifier |
| Neon | Database hosting | Your findings, records, and record types |
| Mem0 | Reply Agent knowledge retrieval | Knowledge you provide to Reply Agents |
| Vercel | Application hosting & compute | All request/processing traffic |
| LLM provider (via AI Gateway / Anthropic) | Search and reply processing | Message content processed during searches and replies |
| Stripe | Subscription billing & payments | Billing contact & payment status |
| Resend | Lifecycle email delivery | Email address & notification content |
| Telegram | Connected messaging platform | Chats read by Search Agents and messages handled by Reply Agents |
6. Security measures
- Encryption at rest of Telegram session strings and other high-sensitivity secrets.
- Per-account isolation: every data-access path is scoped to the authenticated account.
- Audit logging of sensitive and irreversible actions.
- Treatment of all ingested message content as untrusted data, never instructions.
7. Data subject requests & deletion
You can export or delete any database, and destroy all data by closing your account, at any time via the Service. See the Privacy Policy.
8. Breach notification
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with information reasonably available to us.
9. Return and deletion on termination
On termination, you may export your data before deletion. Absent instructions, provisioned databases are destroyed as described in our data-lifecycle documentation.