TG FlowsBack home

Privacy Policy

Effective July 19, 2026

1. Controller

The controller of TG Flows users’ personal data is DIGITAL SQUAD s.r.o., Company ID 21902453, registered office Děčínská 552/1, Střížkov, 180 00 Prague 8, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 408329. Contact: Telegram support @tgflowssupportbot.

2. Data we process

  • Account data: email, name, password (stored only as a hash), optionally your Google profile, language, settings, avatar;
  • Billing data: handled by Stripe (card numbers never reach us), including any VAT ID entered at checkout; we keep payment history and chosen capacity;
  • Service data: connected bots (tokens stored encrypted), flows, campaigns, tags, messages and conversations, notes, delivery statistics;
  • Your channels (optional feature): if you connect your personal Telegram account to manage channels, we process your phone number and an encrypted login session of that account;
  • Technical data: logs, IP address and browser data for security and troubleshooting; push-subscription data if you enable notifications;
  • Support: the content of your in-app and email support conversations.

3. Your bots’ subscribers

Personal data of people who talk to your bots (Telegram ID, name, username, profile photo, message content, tags) is processed by us as a processor on your instructions — you are their controller. The processing terms are in the DPA clause of the Terms of Service.

4. Purposes and legal bases

  • Providing the Service (account, bots, messages, payments) — performance of contract;
  • Security and abuse prevention (logs, rate limits, 2FA) — legitimate interest;
  • Accounting and tax — legal obligation;
  • Operational email (password reset, important notices) — performance of contract; any marketing only within legal limits and with opt-out.

5. Cookies

We use essential cookies only: the sign-in session, your language choice and short-lived security cookies (e.g. during 2FA). We deploy no third-party marketing or analytics cookies, which is why there is no cookie banner.

6. Recipients and sub-processors

  • Vercel Inc. (USA) — application hosting and uploaded-media storage
  • Neon Inc. (USA/EU) — database (PostgreSQL)
  • Stripe Payments Europe, Ltd. — payment processing and invoicing
  • Resend, Inc. (USA) — transactional email (e.g. password reset)
  • Telegram Messenger Inc. — the platform through which bots receive and send messages
  • Railway Corp. (USA) — runtime for the optional Telegram-channels worker
  • Google Ireland Ltd. — Google sign-in (only if you choose it)

We may disclose data to public authorities where required by law.

7. International transfers

Some providers are based in the USA; transfers rely on the EU–U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

8. Retention

  • account data — for the life of the account;
  • messages and conversations — up to 365 days from delivery, then progressively deleted;
  • tax documents — as required by law;
  • technical logs — short-term, for security purposes.

After a paid subscription ends, account and bot data remain available in your account (the bot is only locked for sending). We may delete a free account unused for more than 24 months after prior email notice. After account deletion we remove personal data without undue delay, except where retention is required by law.

9. Security

Transport encryption (TLS), bot tokens and channel login sessions encrypted at rest (AES-256-GCM), strict workspace isolation, access control and optional two-factor authentication (2FA).

10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection to legitimate-interest processing — exercisable anytime via our Telegram support (@tgflowssupportbot). On activated bots you can export the audience to CSV in the app; a workspace owner can delete the account in settings, team members request deletion via support. You may lodge a complaint with the Czech Data Protection Authority (uoou.gov.cz).

11. Automated decision-making

We perform no automated decision-making with legal effects and no user profiling.

12. Changes

We may update this policy; material changes are announced in the app or by email. It exists in Czech and English — the Czech version prevails in case of conflict.