Privacy Policy

Forgebot (the "Service", "we") is an online platform for building Telegram bots, sending broadcasts, chatting with subscribers and accepting payments. The Service runs on forgebot.net, its subdomains and the dashboard.

This policy applies to website visitors and to customers — people and companies that have registered an account ("you"). It also explains how we handle the data of our customers' bot subscribers and website chat visitors.

This policy explains how we handle data. The rules for using the Service are set out in the Terms of Use.

We process your account and team data ourselves, under the rules of this policy.

The data of your bot subscribers, chat contacts and website chat visitors is collected by you — through your bots, flows and widgets. For that data you are the owner (controller), and we are the processor: we store and process it only to run the Service and on your instructions.

That is why it is you who decides what data to collect and on what legal basis, obtains subscribers' consent and, where the law requires it, publishes your own privacy policy for your bot or website. Do not collect bank card data or other highly sensitive information through bots — the Service is not designed to store it.

If a subscriber contacts us about their data, we will forward the request to you or help you answer it.

About you as a customer:

• Account: name, email, workspace name, time zone and interface settings. Your password is stored only as a hash — we never know the password itself.
• Sign-in with Google: your verified email, name, Google account ID and profile photo link. Your Google password never reaches us.
• Team: names, emails and roles of the people you invite.
• Payments: plan, amounts, invoices, payment statuses and documents you upload to confirm a payment (for example, a receipt). We do not receive or store full bank card details.
• Support: your requests and the files attached to them.
• Technical data: IP address, browser and device type, sign-in times, the list of active sessions and the account activity log. On the sign-in pages and in the dashboard we also compute a technical browser identifier (a hash of its characteristics) to protect accounts from takeover, fraud and re-registration by blocked users.

About the subscribers and visitors of your bots and websites (on your instructions):

• Telegram bot subscribers: Telegram ID, name, username, language, messages and files, button presses, answers in flows, variables and tags, plus a phone number or location if the subscriber chose to share it.
• Website chat visitors: messages, files they send and their name if they provided it.
• Payments in bots: invoice and payment details passed on by Telegram. Subscribers' card data is handled by the payment provider and never reaches us.
• Data your flows receive from or send to external services (webhooks, API requests).

We use data:

• to run the Service: create your account, run bots and flows, deliver messages and broadcasts, show analytics;
• to accept payments and keep payment records;
• to send service emails: registration confirmation, password reset and change, team invitations, suspicious sign-in alerts and payment decisions;
• to protect the Service and its users: prevent account takeover, spam, fraud and ban evasion, and investigate incidents;
• to answer support requests;
• to find bugs and improve the Service, using technical data and anonymised statistics;
• to comply with the law and protect our rights.

We do not sell personal data and do not use your subscribers' data for our own commercial purposes such as advertising.

If you add the AI assistant block to a flow, the subscriber's messages and the flow context are sent to the AI provider whose model is selected in the block, to get a reply. The provider processes this data under its own rules.

You decide whether to use this block and what data goes into it. Do not send sensitive information through it (health data, identity documents, payment details). AI replies can be inaccurate — check what your bot sends.

Only with those the Service cannot work without, and only as much as needed:

• Telegram — so that bots can receive and send messages;
• our hosting provider — the Service runs and stores data on its servers in the European Union (the Netherlands);
• Cloudflare — to protect the website from attacks, deliver traffic and forward emails sent to the support address;
• email services — to send service emails and to receive your support requests;
• payment providers and banks — to accept payments;
• AI providers — only if you use the AI assistant block;
• Google — only if you sign in with Google;
• external services you connect in your flows yourself — according to your settings and under your responsibility;
• public authorities — only when the law requires it.

Our hosting provider, Cloudflare and the service-email delivery service process data on our instructions and only to run the Service. The other companies on the list process the data they receive under their own terms and policies and are responsible for their own operations.

We use only strictly necessary cookies — without them signing in, account protection and language choice do not work. There are no advertising or analytics cookies and no third-party trackers on the website.

• kar_refresh — keeps you signed in; up to 30 days;
• kar_device — recognises your browser to protect your account and prevent ban evasion; up to 400 days;
• NEXT_LOCALE — remembers the website language; 1 year;
• kar_tz — your time zone in the dashboard; 1 year;
• kar_oauth and kar_fp — temporary, only while you sign in with Google; 5 to 10 minutes.

Your browser also stores (in localStorage, sessionStorage and IndexedDB) the colour theme, interface settings, a note that you have read the cookie notice and a key that protects your session. The website chat widget stores a token for the visitor's conversation in the visitor's browser.

You can disable cookies in your browser settings, but then signing in will not work.

We keep:

• account data and subscriber data — while the account exists. Deleted flows are erased immediately and permanently. Deleted bots and subscribers disappear from the dashboard but are kept in the account so they can be restored if you reconnect the same bot; they are permanently deleted together with the account or at your request to support;
• service history — flow runs and inactive support chat conversations — is deleted automatically, usually after 30 days;
• technical logs — usually up to 30 days, the account activity log — up to 12 months;
• abuse-prevention data (hashes of browser and device identifiers, IP addresses and emails) — up to 6 months after the last visit; if linked to a block for a breach — longer, as moderation history;
• payment records — as long as needed for accounting and required by law;
• database backups — made daily and kept for a limited time: copies on the server for up to 5 weeks (7 daily and 4 weekly), then deleted; until then deleted data may remain in backups.

After an account is deleted we delete its data within a reasonable time, except data we must keep by law or to resolve disputes.

The connection to the website is encrypted (HTTPS). Passwords are stored only as hashes; bot tokens and secrets from bot settings are stored encrypted. Different customers' data is separated at the database level, server access is restricted and we make regular backups. We mask personal data in technical logs where possible.

No protection is absolute: we take reasonable measures but cannot guarantee that data will never reach unauthorised persons. If we become aware of an incident affecting your data, we will notify you within a reasonable time and take steps to limit the consequences.

On your side, keep your password safe and give account access only to people you trust.

You can:

• find out what data we hold about you and get a copy;
• correct inaccurate data — most of it can be changed in your profile settings;
• delete your account and data;
• withdraw consent or object to processing where the law of your country provides for it.

To do so, email support@forgebot.net from the address linked to your account. We will reply within 30 days and may ask you to confirm that the request really comes from you.

If you are a subscriber of someone else's bot or a visitor of someone else's website, contact its owner — they control that data. If you write to us, we will pass your request on to the owner.

You also have the right to complain to the data protection authority of your country — but we hope you will give us a chance to resolve the issue first.

The Service is meant for businesses. You must be at least 18 to register; we do not knowingly collect children's data. If your bot targets children, you are responsible for parental consent and legal compliance.

Data is stored on our hosting provider's servers in the European Union (the Netherlands). Some of the companies listed under Who We Share Data With — for example Telegram, Cloudflare, Google, payment providers and AI providers — may process data outside the European Union. We share with them only what is needed for the Service to work.

We may update this policy. The current version is always on this page, with its effective date at the top — the new version applies from that date. We will try to give advance notice of material changes in the dashboard or by email.

For any questions about your data or this policy, email support@forgebot.net.