Privacy Policy

1. Two roles

For the data of Askora users (bot owners), we are the controller.

For the data of bot clients, the bot owner is the controller: they decide what the bot asks and why. We process this data on the owner’s behalf, only to make the bot work, and do not use it for our own purposes.

2. Users’ data

Name; email if you sign in with email; sign-in method and its ID (for example, your Telegram ID); password only as a salted hash (PBKDF2-SHA256, 100,000 iterations), never the password itself; sessions as token hashes; the days you used the Service; answers to onboarding questions.

Plan, subscriptions and payments: amount, status and dates. When billing is switched on, card details are seen only by the payment processor, not by us.

Bots: settings and versions. The token of a Telegram bot is stored encrypted.

Support requests: text, photos and the selected bot.

On the website: a random browser ID in localStorage, steps on the site and clicks, without texts, names or phone numbers. The build log keeps a hash of the IP address, not the address, for 90 days.

3. Sign in with Google

If you choose “Continue with Google”, Google shares with us only your name, email address, profile picture and Google account ID (scopes openid, email and profile). We do not request access to your Gmail, Drive, Contacts, Calendar or any other Google data.

We use this data only to create your Askora account, sign you in and show your name and picture in the studio. We do not sell it, do not use it for advertising, do not use it to train AI models and do not share it with third parties, except the hosting provider that stores your account (Cloudflare).

Askora’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Askora at any time in your Google Account settings (Security, Third-party apps), and delete your Askora account and this data as described in “How long we keep data”.

4. Bot clients’ data

Telegram chat ID, name and @username, a link to the Telegram profile photo, the client’s sequence number; answers to bot steps (for example a phone number, email or address, if the bot asks for it); requests, bookings and orders; cart; payments (amount and status); promo codes and referrals; tags, stage and the owner’s note; bot variables; steps passed; the conversation with the bot.

When the owner turns on AI answers, the client’s question and the owner’s business information are sent to an AI model provider to produce the answer.

5. Why we use data and our legal basis

To let you sign in, build and manage bots, and to run your bots (performance of our contract with you). To pay for plans, keep accounts safe, prevent abuse, give support and improve the Service from anonymized statistics (our legitimate interests and, for payments, legal obligations). Where we rely on consent, you can withdraw it at any time.

6. Where it is stored and international transfers

Data is stored in the Cloudflare cloud (Workers, D1 database, R2 file storage). Support photos are available only through signed links for a limited time. Photos of products, mini apps and messages are uploaded only by the bot owner and are public through a long random link, as they are in the bot itself.

Our providers may process data outside Serbia. Where they do, we rely on adequacy decisions or appropriate safeguards, such as standard contractual clauses.

7. Who receives data

Telegram: messages of bots and @AskoraStudioBot.

Cloudflare: hosting and storage.

AI model providers, such as Anthropic (Claude): the bot description and edits you write, and, if AI answers are on, clients’ questions with your business information. We use them only to provide the Service.

A payment processor, once billing is switched on: amount, payment description, customer ID and email for the receipt.

Only if the bot owner connects them: Google Sheets and Google Calendar, Zapier, Make, n8n and the owner’s webhook (requests and events), the “HTTP request” step (data goes to the https address the owner sets), Telegram Stars (payments in the bot).

Once enabled: Resend (sign-in code emails) and Cloudflare Turnstile (a check that you are not a robot).

We do not sell personal data or share it for advertising.

8. How long we keep data

Account data is kept while the account exists. You can delete your account yourself in “Account” or ask support: bots are turned off at once, and after 30 days the account, bots and their clients’ data are erased; signing in during these 30 days cancels the deletion. Records of plan payments are kept without name and contacts for the period required by accounting law.

Bot client conversations are deleted automatically after 90 days, service notifications after 30 days, the build log after 90 days. Other bot client data is kept while the bot is connected or in the studio trash (30 days) and can be deleted earlier at the bot owner’s request to support.

9. Your rights

You can ask what data we hold about you, have it corrected or erased, restrict or object to its processing, receive it in a portable format, and withdraw consent. Bot clients should first contact the bot owner; if there is no answer, contact us.

A bot client can unsubscribe from broadcasts with /stop or the word “unsubscribe” and rejoin with /subscribe.

If you are unhappy with how we handle your data, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection of Serbia (poverenik.rs). We would like the chance to help first.

10. Security

Connections are encrypted, passwords and tokens are stored only as hashes, Telegram bot tokens are encrypted, and access to data is limited by roles: owner, colleagues with “Requests” or “View only” rights, and administrator.

11. Changes and contact

A new version is published on this page and applies from the date of publication. We will tell you in the studio or by email about significant changes.

Questions about data: the “Support” button in the studio and @AskoraStudioBot, or team@askora.world. Nataliia Romanova PR Ketering Vkusno po ruski Beograd, registration number 67268903, tax number (PIB) 114026599, Belgrade, Serbia.