2026-11-08 · v1.7
Permanent address of this version: https://pay.riadov.systems/legal/tg_smart_feed/privacy/1-7?lang=en
This Policy describes which personal data are processed by the Telegram bot @tg_smart_feed_bot and the related autoposting service (the "Service"). It is an Annex to the Riadov Systems Privacy Policy (https://riadov.systems/privacy/) and supplements it with respect to the Service: here you will find the full list of the Service's data, its recipients, retention periods and the commands with which you exercise your rights. In everything not described here, the Riadov Systems Privacy Policy applies. The Service Terms are available with the /terms command, together with the Riadov Systems Terms of Service: https://riadov.systems/terms/
The controller of personal data is:
Riadov Systems Vladyslav Riadov NIP: 6972395549 · REGON: 526790012 Address: ul. Jana Ostroroga 1a/28, 64-100 Leszno, Polska Email: [email protected] Telegram: @Riadov_Systems
Payments for the Service are handled by the payment service pay.riadov.systems of the same controller; the dashboard where you pay for the Service and manage your subscription is its page. The bot and the dashboard are parts of one Service, not a third party.
Personal data are processed in accordance with EU Regulation 2016/679 (GDPR) and the applicable law of the Republic of Poland.
• Account — when you press /start: your Telegram ID, username and name from Telegram (if any), the language of your Telegram, the selected bot language, the account creation date and the date of your last interaction with the bot, as well as when the bot warned you about automatic deletion and which versions of the Service Terms and Policy you have seen or received a message about (version number and time).
• Channels and groups to which the bot was added: chat identifier and type, title, public name (username), Telegram ID of the person who added the bot, the bot's status and rights, dates of adding and of the last change. If you added the bot to a channel or group at another person's request, your Telegram ID is stored in the record of that chat, while the chat itself belongs to that person in the Service.
• "Someone else will add it" requests: identifier, type, title and public name of the channel or group you selected, dates of creation, expiry and connection.
• Invitations to connect a channel or group: Telegram ID of the recipient and of the administrator who sent it, dates of creation, delivery and expiry.
• Plan and limits from the dashboard — a copy from the payment service: stage (setup paid or completed, subscription), plan, subscription status, publication limits, billing period, validity of the copy, the time you last opened the dashboard; the number of publications used in the period.
• Technical logs: event time and type, Telegram ID, chat identifier and technical identifiers of Telegram updates.
• An unfinished deletion request: your Telegram ID, who initiated the deletion — you or the automatic deletion after a year of inactivity, the time of the request, the number of attempts, the time of the next attempt and the code of the payment service's last failure.
• After account deletion: a fingerprint of your Telegram ID computed with a secret key (HMAC-SHA256), the deletion date and a note of who initiated it — you or the automatic deletion after a year of inactivity. The Telegram ID itself is not stored. The fingerprint is a pseudonym, not anonymous data: whoever has the key can check whether it belongs to a specific Telegram ID.
The bot does not store the texts of your messages to the bot, your phone number, contacts or files — neither in the database nor in the logs.
The bot does not store payment data. The payment service stores: your Telegram ID within the project, the dashboard language, the time you last opened the dashboard, the Stripe customer identifier; the selected plan, the dates the setup was paid and completed; subscription status (plan, number of extensions, billing period, cancellation flag); unfinished payment sessions; payments (type, amount, currency, status, payment identifiers in Stripe); consents before payment (type, version numbers of the Riadov Systems Terms of Service and of the Service Terms, version of the checkbox text, time). We do not collect or store invoice details (company name or your name, tax number, address) during payment.
Bank card data, e-mail and whatever Stripe asks for to pay by card are entered on the Stripe page — they are processed by Stripe, and neither the bot nor the payment service stores them.
• Account, channels, groups, requests and invitations — to provide the Service: connect your channels and groups, publish content in them, deliver invitations and talk to you in the selected language. Legal basis — performance of a contract (Art. 6(1)(b) GDPR).
• Plan, limits and publication counters, payments and subscription — to provide the paid Service and show you its status in the dashboard. Legal basis — performance of a contract (Art. 6(1)(b) GDPR).
• Records of payments — accounting and tax obligations. Legal basis — compliance with legal obligations (Art. 6(1)(c) GDPR). Records of the accepted Terms and of the request to start the service — evidence and defence against possible claims. Legal basis — the controller's legitimate interest (Art. 6(1)(f) GDPR). The checkbox before payment is part of the contract, not consent to data processing.
• Invoice — on your request via support: the details you send for it are used only for the invoice and accounting.
• Technical logs — security and stable operation of the Service, investigation of failures. Legal basis — the controller's legitimate interest (Art. 6(1)(f) GDPR).
• An unfinished deletion request — to complete the deletion even if the payment service is temporarily unavailable. Legal basis — fulfilling your deletion request (Art. 17 and Art. 6(1)(c) GDPR) and, for automatic deletion, observing the account retention period.
• Fingerprint after deletion — proof that the deletion has been carried out, and repeating the deletion if the database has to be restored from a backup. Legal basis — the controller's legitimate interest (Art. 6(1)(f) GDPR).
• Warnings about automatic deletion and records of messages about new versions of the Terms and the Policy — to warn you before the account is deleted and to have proof that the message about a new version was sent. Legal basis — performance of a contract (Art. 6(1)(b) GDPR) and the controller's legitimate interest (Art. 6(1)(f) GDPR).
The bot does not make automated decisions about you that have legal effects. Riadov Systems does not sell or transfer personal data to third parties for marketing purposes.
• Telegram — the platform on which the bot runs. Telegram processes data as a separate controller under its own privacy policy: telegram.org/privacy.
• Payment service pay.riadov.systems — part of the Service of the same controller, not a third party: the bot sends it your Telegram ID and the number of publications used, and receives your plan, limits, payment status and the time you last opened the dashboard; on your /my_data or /delete_account request — a copy of your data held there or its deletion.
• Hosting provider — the servers are physically located in the European Union (Germany).
• Stripe (Stripe, Inc. / Stripe Payments Europe, Ltd.) — payment processing in the payment service: stripe.com/privacy.
• inFakt — accounting only for an invoice you request, from the details you send to support (an accountant may have access).
• Account — until you delete it with the /delete_account command or until a year passes without your interaction with the bot and the dashboard and without an active subscription: then the account is deleted automatically together with the data in the payment service. If before the deletion you write to the bot, open the dashboard or take out a subscription, the automatic deletion is not carried out. The bot sends a warning 30 and 7 days before the automatic deletion.
• Channels and groups connected to your account — until the account is deleted.
• Your Telegram ID in the record of someone else's channel or group to which you added the bot — until its owner deletes their account or until you delete yours.
• Records of channels and groups not linked to an account in the bot — until deleted at your request via /support.
• "Someone else will add it" requests — 30 days from creation if the channel or group is not connected; connected ones — until the account is deleted.
• Invitations — up to 30 days from creation.
• Plan and limits from the dashboard (a copy in the bot) and publication counters — until the account is deleted.
• Technical logs — 30 days.
• An unfinished deletion request — until the deletion is done: it disappears together with your data. A request for automatic deletion is withdrawn if you write to the bot again or the payment service sees that you opened the dashboard or have an active subscription.
• Fingerprint after account deletion — 730 days (two years) from deletion: it is only a fingerprint without the Telegram ID, a date and the initiator, needed to prove the deletion and to repeat it if the database has to be restored from a backup; after this period the record is deleted.
• Database backups — under section 8 of the Riadov Systems Privacy Policy: deleted data disappear from backups when the backup's retention period expires, not immediately. If the database has to be restored from a backup, we use the deletion log to repeat the deletions already carried out before the bot runs again.
• Data in the payment service: dashboard account, setup and subscription — until the account is deleted; records of payments and consents — 5 years from the end of the year in which the tax payment deadline passed, regardless of account deletion and unlinked from you after deletion.
Under the GDPR you have the right to:
• access your data and receive a copy (right to data portability) — the /my_data command sends a file with the data of your account, channels, groups, requests, invitations, plan and limits, an unfinished deletion request if there is one, as well as your data in the payment service; technical log data — on request via /support;
• request deletion — after confirmation, the /delete_account command deletes your account in the bot and in the dashboard, channels, groups, requests, invitations and payment data; an active subscription does not prevent deletion — it is canceled immediately, without an automatic refund (this does not affect the right of withdrawal, section 5 of the Service Terms), and records of payments and consents remain unlinked from you. If the payment service is temporarily unavailable, nothing is deleted immediately, but the request is saved: the bot tells you that the deletion is queued, retries it on its own and will write to you once the account is deleted — you do not need to repeat the command. Technical logs disappear after their retention period (30 days), backups — under section 5;
• request rectification — your name, username and Telegram language are updated automatically when you press /start; the bot language is changed with the /language command;
• restrict processing or object to it — via /support or [email protected];
• lodge a complaint with a supervisory authority — in Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), uodo.gov.pl; you may also contact the supervisory authority of the country where you live or work.
If you cannot use the bot's commands, write to support: /support, Telegram @Riadov_Systems or [email protected]. To avoid disclosing or deleting someone else's data, we may ask you to confirm that the request comes from you — usually by writing from the same Telegram account. A deletion request sent via support is carried out in the same way as the /delete_account command.
We respond to requests sent via support within one month.
The controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss and destruction. The bot exchanges data with Telegram over the secure HTTPS protocol.
The Service is intended for persons aged 18 and over. Persons under 18 must not use the Service.
Riadov Systems may change this Policy. Each new version has a new number and date, stated at the beginning of the document. The current version is always available with the /privacy command and on the page https://pay.riadov.systems/legal/tg_smart_feed/privacy?lang=en, which also lists the previous versions with their permanent addresses.
The bot sends you a message about each new version of this Policy with the version number and date, a link to the permanent address of its full text (the text there does not change) and the date from which it applies, which is no earlier than 31 days after the day the message is sent. You do not need to confirm anything.