Privacy Policy
Version of 8 November 2026
This page explains what data Keylo (the Telegram bot @keylo_ai_bot, the mini app app.keylobot.com and the website keylobot.com) collects, why, where it is stored and how to delete it. In short: we take only what the bot needs to work, we do not sell data and we do not train AI on it.
1. Who is responsible for the data
The data controller is Richard Jucov, an individual, Republic of Moldova (“we”). Contact: Telegram @keylo_official, e-mail [email protected].
We process data under the personal data protection law of the Republic of Moldova (Law No. 195/2024) and, for users in the European Union, also under the EU General Data Protection Regulation (GDPR).
2. What data we collect
| Data | Source | Purpose |
|---|---|---|
| Telegram id, name, @username | Telegram, when you start the bot or open the app | Recognising you, showing your settings, contacting you |
| Shop name, markup, brands, rules, settings | You, in the app and the bot | Running the bot by your rules |
| Phone number | You, when connecting your Telegram | Logging in to your Telegram account, client records |
| Telegram connection session | Created when you log in | Reading new posts in the boutiques you selected |
| List of boutiques and work chats | You, in the app and the bot | Where to read posts from and where to publish them |
| Boutique posts: text, photos, prices | The boutique channels and groups you selected, or posts you forwarded | Building posts, publishing, search archive, statistics |
| The label of the link you came from (for example, site_tiktok) | The website and the bot at first start | Understanding which ads work |
| AI Search requests, photos and forwarded messages in requests | You, in the AI Search group | Item search, “👁 Watch”, “🔔 Every day” |
| Date and version of your consent to connect Telegram | The bot, on connection | Proof of consent |
| Plan, dates, payment history | The bot, the payment provider | Subscription and payment records |
| Technical logs (what the bot did and when, errors) | The bot | Support, fixing errors, security |
To show the list for choosing boutiques, the bot reads the names of your channels and groups and the latest posts in some of them once. We keep only the ones you select. We do not read your private chats, do not send messages on your behalf and do not receive full bank card details.
3. Your Telegram account
3.1. The connection goes through the official Telegram API, like a login from a new device. The session is stored encrypted; the encryption key is stored separately from the database.
3.2. Through the session the bot reads new posts in the boutique channels and groups you selected. A ban on sending messages, joining channels and other actions is built into the connection code.
3.3. You can revoke access at any time: Telegram → Settings → Devices → “Keylo” → “Terminate session”. After that the bot can no longer read your account.
3.4. Your Telegram cloud password, if you enter it, is used only to log in. The bot does not store it and deletes your message with the password immediately.
4. Legal grounds
- Performance of the contract (Terms of Service) — running the bot, publishing, search, subscription.
- Your consent — connecting your Telegram account. You can withdraw consent by terminating the “Keylo” session.
- Legitimate interest — security, preventing abuse, fixing errors, general service statistics.
- Legal obligation — payment records.
5. Who receives data
We do not sell data. Advertising pixels on the website work only with your consent (section 11). Data is received only by services Keylo cannot work without:
| Recipient | What it receives | Purpose |
|---|---|---|
| Telegram | Bot messages, publications in your channels | Running the bot |
| Anthropic (USA) — AI provider | Post texts and photos, your search requests | Recognising price, brand, sizes; item search |
| Hosting provider (Contabo, Germany) | All bot data is stored on the server | Running the service |
| Google (Google Sheets) | Your name, @username, Telegram id, phone, plan and dates, statistics | Our internal client records |
| Google (Google Fonts) | IP address when the mini app loads its fonts. The keylobot.com website does not load Google fonts | Displaying the mini app |
| Crypto Pay (Telegram bot @CryptoBot) | Invoice amount and description, if you pay in cryptocurrency | Accepting cryptocurrency payments |
| Lemon Squeezy (USA) — seller for card payments (Merchant of Record) | Payment details, e-mail, country | Accepting card payments, taxes, receipts |
| Brave Search (USA) | Search request text and supplier website addresses, without your name or contacts | Searching websites closed to the bot |
| Cloudflare | Technical data of website visits; Cloudflare Web Analytics — cookie-free visit statistics | Running the keylobot.com domain and website, website statistics |
| Meta (Facebook, Instagram) and TikTok | Data about website visits and button clicks (pixels) — only after your consent in the cookie banner | Measuring advertising |
Under its commercial terms, Anthropic does not train models on data we send through the API. We also do not use your data or posts to train AI.
Some recipients are outside Moldova and the EU (for example, in the USA). We send them only what is needed, under their data processing agreements.
Data may be disclosed at a lawful request of public authorities in the manner prescribed by law.
6. Supplier websites
For AI Search the bot reads public data of the websites you connected: item names, prices, photos and availability. This is not personal data; it is stored in our product cache.
7. How long we keep data
| Data | Period |
|---|---|
| Downloaded post photo files | Up to 3 days, then deleted from the server |
| Posts, cards, statistics | While your Keylo account exists. Archive search uses posts from the last 90 days |
| Telegram connection session | Until you disconnect Telegram or your Keylo account is deleted |
| AI Search requests and “Watch” | While the account exists or until you turn them off |
| Payment data | As long as accounting law requires |
| Technical logs | Up to 30 days |
| Database backups | Up to 14 days; deleted data disappears from them after this period |
After a subscription ends, data is kept so you can continue working. If a subscription is not renewed for more than 6 months, we may delete the account after warning you in the bot.
8. Your rights
You can:
- find out what data we keep about you and get a copy;
- correct inaccurate data;
- delete your data and your Keylo account;
- restrict or object to processing;
- withdraw consent to the Telegram connection (terminate the “Keylo” session);
- file a complaint with a supervisory authority: in Moldova — the National Center for Personal Data Protection, in the EU — the data protection authority of your country.
To use these rights, write to us on Telegram @keylo_official or to [email protected]. We reply within 30 days. We delete an account within 30 days of the request, except payment data that the law requires us to keep.
9. Your clients’ data
If you forward your clients’ messages to AI Search, publish posts in your channels or keep client data in your chats, you are responsible for this data as its controller. Keylo processes it only on your instructions and only to run the bot. Forward to the bot only what is needed to find an item.
10. Security
- Telegram sessions are encrypted; the key is stored separately from the database.
- Only the service owner has access to the server and the database, with key-based login.
- Each buyer sees only their own data: data of different buyers is separated in the database.
- Staff you invited see your shop’s data and change settings within their role.
- The service owner and support admins appointed by them see buyers’ data in the admin panel and can act on behalf of a buyer when needed for support and fixing errors.
- Keys and passwords are not stored in code or in correspondence.
If a breach affects your data, we will notify you in the bot and notify the supervisory authority as the law requires.
11. Cookies and similar technologies on the website
- Necessary. The website stores your chosen theme, language and your choice in the cookie banner in your browser, and for the duration of the visit the label of the ad link, to pass it to the bot. Without this the website does not work the way you set it up.
- Statistics. Cloudflare Web Analytics counts visits without cookies and without identifying visitors.
- Advertising. The Meta and TikTok pixels load only after you press “Accept” in the banner. Without consent they do not load at all.
You can change or withdraw consent at any time: the “Cookie settings” link at the bottom of every page.
12. Age
Keylo is intended for persons over 18 engaged in business. We do not knowingly collect data of minors.
13. Changes
We may update this Policy. We publish the new version on keylobot.com/privacy and in the mini app and announce material changes in the bot.