2026-11-08
Permanent address of this version: https://pay.riadov.systems/legal/lot_check/privacy/2026-11-08?lang=en
This Policy is an Annex to the Riadov Systems Privacy Policy (the “main Policy”): riadov.systems/privacy/. It describes what personal data the Lot Check Telegram bot for monitoring IAAI and Copart auctions processes together with the Dashboard at pay.riadov.systems (the “Service”), why, to whom it is disclosed, how long it is kept and which commands you use to exercise your rights. General rules — in particular on payments in Riadov Pay, invoices, support and backups — are in the main Policy. The words “Dashboard”, “Riadov Pay” and “Subscription” have the meaning given in the Riadov Systems Terms of Service.
The controller of personal data is: Riadov Systems Vladyslav Riadov NIP: 6972395549 · REGON: 526790012 Address: ul. Jana Ostroroga 1a/28, 64-100 Leszno, Polska E-mail: [email protected] · Telegram: @Riadov_Systems
We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Polish law. This Policy is information we are required to give you (Art. 13 GDPR), not consent: with the “I accept” button in the bot you confirm that you have read it, you do not consent to data processing.
• Bot account: Telegram ID, username and first name from Telegram, chosen language, account creation date and the date of the last interaction with the bot.
• Tasks: name, search results link, website (IAAI or Copart), task status and creation date, as well as the data of lots found (link, title, price, photo, “Buy Now” option) needed to detect changes.
• Subscription access: a copy of the state from Riadov Pay — stage, plan, Subscription status, link limit, start and end of the billing period, the date until which access is valid, and the time of the last sign-in to the Dashboard. The bot does not store Stripe identifiers or payment card data.
• Document acceptances: which version of the Service Terms and Service Privacy Policy was accepted, when, and a hash (SHA-256) of the text in your language; which new version the bot notified you about, when, and the date from which it applies.
• A deletion request, until it is carried out: Telegram ID, who initiated the deletion (you, automatic deletion, the operator following your request to support, or a repeat after the database is restored from a backup), request time, number of attempts, time of the next attempt, the code of the payment service’s last failure and the time of the last internal alert about the delay.
• Warnings before automatic deletion: which warning was sent (30 or 7 days before), from which of your last activities the year was counted and when the warning was sent.
• Deletion log: a hash (HMAC-SHA256) of your Telegram ID computed with a secret key, the deletion time, who initiated it and what was deleted (the account in the bot together with the Dashboard, or only the Dashboard data). The log does not contain the Telegram ID itself, but the hash is a pseudonym, not anonymous data: anyone who knows the ID and the key can check for a match.
• Data request log: request number, action, status and reason codes, as well as runs of the operator’s internal tool — which action, when, by whom and with what result; it contains none of your data.
• Dashboard and payments (Riadov Pay): Telegram ID within the Service, Dashboard language, time of the last sign-in to the Dashboard, Stripe customer identifier, plan and Subscription, payments and consents before payment — the full list is in section 4 of the main Policy.
• Temporary data: the remembered language, the state of a task you have started adding, a marker of a recently sent data copy (/my_data) and a temporary block on sending notifications when Telegram limits their number.
• Technical logs: time and type of events, task names and, in the event of notification delivery errors, the Telegram chat identifier.
We do not store the texts of your messages to the bot, except for the task name and link you enter yourself. The bot opens IAAI and Copart pages using the links from your tasks without passing your Telegram data to these websites.
• Account, tasks, Subscription access, notifications, communication in the chosen language, the Dashboard and payments — performance of a contract (Art. 6(1)(b) GDPR).
• Payment records for accounting and tax purposes, carrying out your deletion request, the deletion log (so that a deletion is not undone when the database is restored from a backup) and the record of data requests — legal obligation (Art. 6(1)(c) GDPR).
• Proof of accepted Terms, of notices about new versions and of the request to start the service before payment, warnings before automatic deletion and automatic deletion of inactive accounts, security and stable operation of the Service, analysis of failures based on technical logs — the controller’s legitimate interest (Art. 6(1)(f) GDPR).
The checkbox before payment is part of the contract, not consent to data processing. Providing data is voluntary, but the Service cannot be used without a Telegram ID. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). We do not sell data or share it for marketing purposes.
• Riadov Pay — the payment service pay.riadov.systems; it is part of Riadov Systems, not a third party. The bot and Riadov Pay exchange payment status, plan, limits and the time of last activity and, at your request, a copy of your data or its deletion.
• Contabo GmbH — hosting of the servers running the bot, Riadov Pay and the databases.
• Stripe (Stripe, Inc. / Stripe Payments Europe, Ltd.) — payment processing in the Dashboard: stripe.com/privacy.
• Cloudflare (Cloudflare, Inc.) — the delivery and protection network through which the Dashboard at pay.riadov.systems opens; it processes the IP address and technical request data.
• Telegram (Telegram Messenger Inc., Telegram FZ-LLC) — the platform the bot and the Dashboard run on. Telegram processes data as a separate controller under its own privacy policy: telegram.org/privacy. The bot also sends warning and error log entries to an internal Riadov Systems Telegram chat to notice failures quickly; they may contain a Telegram chat identifier. An internal alert is also sent there if a deletion request has been waiting in the queue for more than a day — without your Telegram ID.
We store the databases and logs on servers in the European Union (Germany). Telegram, Stripe and Cloudflare may process data outside the European Economic Area. Telegram does so as a separate controller under its own privacy policy. In other cases transfers take place on the bases provided for in the GDPR — in particular a European Commission adequacy decision (Art. 45 GDPR) or standard contractual clauses (Art. 46(2)(c) GDPR).
• Account, tasks with lot data, Subscription access, document acceptances, notices about new versions and warnings before automatic deletion — until you delete your account with /delete_account or until a year passes without your interaction with the bot and the Dashboard and without an active Subscription: the account is then deleted automatically, in the bot and in the Dashboard together. The bot warns you with a message 30 and 7 days before this, and the account is deleted no earlier than 7 days after the second warning. If you use the bot again or sign in to the Dashboard before the automatic deletion is carried out, the account is kept. Lot data of a deleted task is deleted together with the task.
• Deletion request — until the deletion is carried out; it then disappears together with your data. If Riadov Pay is temporarily unavailable, the bot retries automatically, each time after a longer pause, and notifies you when the deletion you requested has been carried out.
• Dashboard data — deleted together with the account, except for payment records and consents before payment: they remain without any link to your account for the period set out in section 8 of the main Policy. After deletion Riadov Pay keeps a hash of your Telegram ID computed with a secret key and the deletion date — this is a pseudonym, not anonymous data (main Policy, sections 3 and 8). Stripe keeps payment records under its own policy.
• The deletion log and the data request log — 730 days from the entry; after that the entries are deleted automatically.
• Remembered language — in the cache for up to 72 hours; the state of adding a task — until adding is completed or cancelled or the account is deleted, but no longer than 30 days after your last step in it; the data copy marker — 10 minutes; the sending block — for the time specified by Telegram plus 2 minutes.
• Technical logs — 30 days and no more than three files of 5 MB per log; container logs — no more than three files of 5 MB, older entries are replaced by newer ones. Entries in the internal Telegram chat — until deleted manually.
• Database backups are kept for a limited time (main Policy, section 8): deleted data disappears from a backup when its retention period expires. So that deletions are not undone when the bot’s database is restored from a backup, the bot keeps a deletion log (section 2): before starting the bot again, we use this log to delete once more the accounts deleted after the backup was made, and Riadov Pay repeats its own deletions by itself. If after such a restore the bot still knows your account, send /delete_account once more.
You have the right to:
• access your data (Art. 15 GDPR) and data portability (Art. 20 GDPR) — the /my_data command sends a JSON file with your data in the bot and in Riadov Pay, including a pending deletion request and the last warning before automatic deletion; no more than once every 10 minutes;
• rectification (Art. 16 GDPR) — your username and first name are updated on /start, the language is changed with /language, other data will be corrected on request via /support;
• erasure (Art. 17 GDPR) — the /delete_account command deletes the account in the bot and in the Dashboard together; it cancels an active Subscription at once, without an automatic refund (refund questions — via /support); if Riadov Pay is temporarily unavailable, the request is queued and the bot will complete the deletion by itself. Technical logs expire after 30 days; the deletion log keeps only a hash of your Telegram ID — for 730 days (section 6). Deletion does not erase messages the bot has already sent you in Telegram — you can delete them in Telegram yourself;
• restriction of processing (Art. 18 GDPR) and to object to processing based on legitimate interest (Art. 21 GDPR) — via /support, on Telegram to @Riadov_Systems or at [email protected].
If you cannot use the bot, send your deletion request to support: we will check that it is really you sending it (usually from the same Telegram account) and file the same request as the /delete_account command. We reply to requests sent through support without undue delay and in any event within one month (Art. 12(3) GDPR); in complex cases this period may be extended, and we will inform you of this within that month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) — Art. 77 GDPR — or with the supervisory authority of the country where you live or work.
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss and destruction. The Dashboard works over the secure HTTPS protocol, and the bot and Riadov Pay exchange data within our server and sign their requests with a secret key. The Service is intended for persons aged 18 or over.
Each new version of the Policy has a new date and is available with the /privacy command and via the link in the Dashboard. Each version has a permanent address at pay.riadov.systems where its text does not change, and previous versions remain available there. The bot will notify you of a new version with a single message — with the version number and date, a link to the permanent address of its full text and the date from which it applies; you do not need to confirm anything.
This document was drawn up in Polish. The English, Ukrainian and Russian versions are translations; in the event of any discrepancy, the Polish version prevails.