2026-10-01
This version is no longer in force. Current version: https://pay.riadov.systems/legal/lot_check/privacy?lang=en
Permanent address of this version: https://pay.riadov.systems/legal/lot_check/privacy/2026-10-01?lang=en
This Policy describes how we process the personal data of users of the Telegram bot for monitoring IAAI and Copart auctions and the related panel (the “Service”).
The controller of personal data is: Rubicon Group Vladyslav Riadov NIP: 6972395549 · REGON: 526790012 Address: ul. Jana Ostroroga 1a/28, 64-100 Leszno, Polska E-mail: [email protected] · Telegram: @rubicon_group
We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Polish law.
• Account: Telegram ID, username and first name from Telegram, chosen language, account creation date and date of your last interaction with the bot.
• Tasks: name, search results link, site (IAAI or Copart), task status and creation date, as well as data on the lots found (link, title, price, photo, “Buy Now” option) needed to detect changes.
• Subscription: plan, status, end date of the billing period, cancellation flag and the customer and subscription identifiers in Stripe. We do not store payment card data.
• Document acceptances: which version of the Terms and the Policy was accepted, when, and a hash (SHA-256) of the text in your language.
• Temporary data: remembered language, the state of a task you have started adding and a temporary block on sending notifications when Telegram limits their number.
• Technical logs: time and type of events, task names and, if a notification fails to be delivered, the Telegram chat identifier.
We do not store the content of your messages to the bot, except for the task name and link that you provide.
• Maintaining your account, tasks, subscription and notifications, communicating in your chosen language and recording your acceptance of the Terms — performance of a contract (Art. 6(1)(b) GDPR).
• Payment and billing records (once payments are launched in the panel) — legal obligation (Art. 6(1)(c) GDPR).
• Security and stability of the Service and error analysis based on technical logs — legitimate interest of the controller (Art. 6(1)(f) GDPR).
Providing data is voluntary, but the Service cannot be used without it. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). We do not sell data or share it for marketing purposes.
• Contabo GmbH — hosting of the servers on which the bot and the database run.
• Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) — payment processing in the panel, once payments are launched.
• Telegram — the communication channel with the bot. Telegram processes data as a separate controller under its own privacy policy: telegram.org/privacy.
We store the database and logs on servers in the European Union (Germany). Telegram and Stripe may process data outside the European Economic Area. Telegram does so as a separate controller under its own privacy policy. Data is transferred to Stripe, Inc. in the USA on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR) or standard contractual clauses (Art. 46(2)(c) GDPR).
• Account, tasks with lot data, subscription and document acceptances — until you delete your account with the /delete_account command; lot data of a deleted task is deleted together with the task.
• Remembered language — in the cache for up to 72 hours; the state of adding a task — until adding is finished or cancelled or the account is deleted; the sending block — for the time specified by Telegram plus 2 minutes.
• Technical logs — 30 days.
• Payment records — for the period required by tax law.
You have the right to:
• access your data (Art. 15 GDPR) and data portability (Art. 20 GDPR) — the /my_data command sends a file with your data;
• rectification (Art. 16 GDPR) — your username and first name are updated on /start, the /lang command changes the language, and we will correct other data on request via /support;
• erasure (Art. 17 GDPR) — the /delete_account command; if your subscription is active, cancel it in the panel first; technical logs expire after 30 days;
• restriction of processing (Art. 18 GDPR) and to object to processing based on legitimate interest (Art. 21 GDPR) — via /support or at [email protected].
The /my_data and /delete_account commands work immediately. We respond to other requests without undue delay and in any event within one month (Art. 12(3) GDPR).
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) — Art. 77 GDPR.
We apply appropriate technical and organisational measures that protect data against unauthorised access, loss and destruction. The Service is intended for persons aged 18 or over.
Each new version of the Policy has a new date and is available with the /privacy command; after a change, the bot will ask you to read it.
This document was drawn up in Polish. The English, Ukrainian and Russian versions are translations; in the event of any discrepancy, the Polish version prevails.