Privacy Policy

7.1 Two Roles

For account data (the Customer's company details, billing records, User accounts, support history and website analytics) we are the controller. For workspace content, above all Lead Data synced from Connected Accounts, captured by bridge pages, or generated by the AI Assistant, the Customer is the controller and we are a processor acting only on the Customer's instructions. A data-processing agreement forms part of these terms for business customers; contact us for a signed copy.

7.2 What We Process

• Account data: names, emails, company details, billing and subscription records, support correspondence.
• Workspace content: Telegram contact profiles and the times they were last in contact, notes, tags, trading-account records the Customer enters or imports, emails captured on bridge pages, and the conversations the AI Assistant itself holds. The Platform keeps no copy of the messages in a Connected Account: there is no message store, and the text of those chats is not written to our systems.
• Chats read but not kept: where a Customer switches on the "Earlier Conversations" option for a bot, the Platform reads that contact's existing chat from the Connected Account at the moment a reply is being composed, so the Assistant answers a long-standing contact in context rather than as a stranger. Those messages are held in memory for that reply only, are sent to the AI provider the Customer has chosen under the Customer's own API key, and are never written to disk by us. The option is off unless the Customer turns it on, and can be turned off at any time.
• Connection credentials: Telegram session data and bot tokens, stored encrypted, never displayed after creation, and deleted when a connection is removed.
• Tracking data: click records for the Customer's tracking links, advertising click identifiers and pixel event logs.

7.3 If You Are a Lead

If your messages or details appear in a Customer's workspace, that Customer decides why and how your data is used; we store and process it on their behalf. To access, correct or delete your data, contact the business you were talking to on Telegram. If you cannot reach them, contact us and we will pass your request to the responsible Customer and assist as the law requires.

7.4 Advertising Platforms and Hashed Data

Where a Customer enables pixel integrations, event data is sent to the chosen platforms (such as Meta, TikTok or Snapchat). Identifiers such as email addresses are hashed before transmission; raw email addresses are not sent to advertising platforms and are not stored in event logs. Advertising click identifiers and browser cookie values are transmitted as the platforms require them, unhashed, because that is the only form in which they can be matched. The Customer is responsible for having a lawful basis, and where required consent, for this tracking.

7.5 Retention, Security and Transfers

Workspace content is retained while the workspace exists, subject to any retention settings the Customer configures, and is deleted after workspace deletion following a short recovery window. Credentials and secrets are encrypted at rest; access is role-restricted and logged. Where data is transferred internationally we use recognised safeguards. We use a small number of sub-processors for hosting, email delivery and payment processing; a current list is available on request.

7.6 Your Rights

Depending on your jurisdiction you may have rights to access, rectify, erase, restrict or port personal data, and to object to certain processing. For account data, contact us directly. For Lead Data, Section 7.3 applies. You may also complain to your data-protection authority.

This section covers the cookies set by tgcrm.org itself: the home page, the legal pages, the sign-in page and the signed-in workspace. Cookies the site needs in order to work are set without asking. Analytics and tracking cookies are set only if you click Accept in the cookie banner, and you can change that answer at any time.

8.1 Cookies Set Without Asking

sg_session

Keeps you signed in to your workspace. Set when you sign in, lasts up to 30 days, and is removed when you sign out.

sg_account

Remembers which workspace you are working in when you belong to more than one. Up to 30 days.

sg_ref

Set only when you arrive through an affiliate's link, so that the affiliate is credited if you subscribe. Up to 30 days.

scalegram_consent

Remembers whether you accepted or declined analytics cookies, so the banner does not ask on every page. 12 months. The same answer is also kept in your browser's local storage.

Your light or dark theme is kept in your browser's local storage, not in a cookie, and is never sent to us. The sign-in and sign-up forms carry Cloudflare Turnstile, a check that tells people from bots. It runs in a frame served by Cloudflare, Inc. and sets no cookies on tgcrm.org.

8.2 Google Analytics, Only With Your Consent

If you click Accept, we load Google Analytics 4, provided by Google Ireland Limited for visitors in the European Economic Area and Switzerland, and by Google LLC elsewhere. It tells us which pages are read and how visitors found the site, as totals. Google may process this data in the United States, under the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. According to Google, Google Analytics 4 does not log or store IP addresses.

Google Analytics runs only on the public pages of tgcrm.org. It is never loaded inside the signed-in workspace or the admin area, and never on the websites Customers host with Telegram CRM. If you click Decline, or make no choice, Google's script is not loaded and no analytics cookies are set.

_ga

Set by Google Analytics to tell one browser from another. Up to 2 years.

_ga_ followed by our measurement ID

Set by Google Analytics to keep track of the current visit. Up to 2 years.

8.3 Whop, Only With Your Consent

Whop sells and processes Telegram CRM subscriptions as merchant of record. If you click Accept, we also load Whop's web pixel, which measures which visits lead to a subscription. It runs on the public pages of tgcrm.org, and inside the signed-in workspace only if you already accepted. If you click Decline, or make no choice, the pixel is not loaded and these cookies are not set. Paying through Whop's checkout works the same either way.

_wuid

Set by Whop's pixel to tell one browser from another. Up to 2 years.

_wuid_link

Set by Whop's pixel together with _wuid to recognise the same browser. Up to 2 years.

8.4 Advertising Pixels, Only With Your Consent

When we advertise Telegram CRM on Meta (Facebook, Instagram) or TikTok, we may add their pixels to these public pages so the platforms can report which ads brought visitors here. They load the same way, only after you click Accept, and never on Decline. Meta, provided by Meta Platforms Ireland Limited in the European Economic Area, sets _fbp and _fbc for up to 90 days. TikTok sets _ttp and related cookies for up to 13 months.

8.5 Changing Your Choice

Use the Cookie Settings link at the foot of the site to open the banner again and change your answer. If you decline after accepting, these analytics, Whop and advertising cookies are deleted from this site. You can also delete cookies in your browser's settings, after which the banner asks again. Google offers a browser add-on that blocks Google Analytics on every website: https://tools.google.com/dlpage/gaoptout.

Cookies set by Customer tooling

Tracking links, interstitial pages and bridge pages operated by Customers may set cookies (such as a click identifier) and may trigger advertising pixels, according to that Customer's configuration. The Customer is responsible for the consent requirements applying to those cookies and pixels in the markets it targets; Telegram CRM provides per-page consent settings for this purpose.

For any questions about these terms, our policies, or to exercise a data-protection right, please contact us at the address below.