1. General
This Policy defines the processing of personal data by the Operator — Individual Entrepreneur Sergey Aleksandrovich Kalashnikov (hereinafter the “Operator”, “we”, “gGram”) — in accordance with Federal Law 152-FZ of July 27, 2006 on personal data.
The Policy covers the website ggram.xyz, the dashboard at app.ggram.xyz, the Telegram bot @gGram_Notifications_Bot and connected services.
The current edition is always published on this page; its version and effective date are shown above.
2. What data we process
Account: email, a password hash (we do not store the password itself), Telegram id and username if you linked the bot, name and time zone if you set them.
Phones: name, model, Android and gGram app versions, battery, state (online, gGram service, notifications) and task queue.
Telegram accounts: account name and a masked phone number such as +7 9•• ••• •• 12. We do not store Telegram sessions or sign-in codes — you sign in to Telegram yourself on the phone.
Work: campaigns, uploaded recipient lists, conversations with leads, warmup and AI settings. AI keys you add are stored encrypted.
Technical: IP address, browser and session data, request and action logs. Needed for security and troubleshooting.
Payment: amount, status and transaction id from the payment service. Full bank card details are not shared with and not stored by the Operator — they are handled by the payment service.
Requests: content of Enterprise or early-access requests.
We do not process or request special categories of personal data or biometric data.
3. Purposes and legal grounds
Purposes: providing and restricting access to the service; performing the contract (the Public offer and these Terms); authentication and two-factor sign-in verification; access recovery; accepting payments and issuing activation keys; technical support; ensuring security and investigating incidents; complying with the law, including tax and accounting rules.
Legal grounds: performance of a contract to which the data subject is a party; the data subject's consent; compliance with the Operator's legal obligations; pursuit of the Operator's legitimate interests, provided the subject's rights are not infringed.
Decisions producing legal effects are not made solely by automated processing.
4. Where and on what infrastructure data is processed
The main dashboard database, authentication system and server functions run on the Operator's dedicated server in a data centre in Moscow (Russian Federation).
The website ggram.xyz, the dashboard app.ggram.xyz and the engine api.ggram.xyz are hosted in the same place in Moscow.
The Telegram bot @gGram_Notifications_Bot, delivery of Telegram notifications and calls to external AI services run through a dedicated server in the Federal Republic of Germany: data exchanged between you and the bot, notification texts and AI request texts pass through it.
Database backups are stored on the same server in Moscow and encrypted.
Thus personal data is processed both inside and outside the Russian Federation. The terms of cross-border transfer are described below.
5. Processors
The Operator entrusts personal data processing to the parties below in the volume needed for the stated purposes.
Selectel (Russian Federation) — provider of the dedicated server in Moscow: all data listed above as needed for the service to work.
Dedicated server provider for the Telegram bot and AI (Germany) — data exchanged between the user and the bot, notification texts and AI requests.
Telegram Messenger — two-factor sign-in codes and recovery codes, service notifications. Transfer is governed by the messenger's own terms.
OpenAI, Anthropic (United States of America), OpenRouter — AI processing of texts, if you turned on AI replies and connected a key for the respective provider.
Payment services: YooKassa (NBCO YooMoney LLC, Russian Federation) and Robokassa (Robokassa LLC, Russian Federation) — accepting payments for access to the service and issuing the cash receipt: payer's email, amount and purpose of the payment are passed.
reg.ru (Russian Federation) — domain registration and DNS zones for ggram.xyz.
Personal data is not shared with third parties for any other purpose, not sold and not used for creditworthiness assessment. Transfer to government bodies happens only in cases and scope required by law.
6. Cross-border transfer
Processing on infrastructure in the Federal Republic of Germany and transfer of data to Telegram and external AI services constitute cross-border transfer of personal data.
The Federal Republic of Germany is a party to the Council of Europe Convention on the protection of individuals with regard to automated processing of personal data and is among the states providing adequate protection of data subjects' rights.
The United States of America is not among such states. Transfer of data to the United States (external AI services) is performed only with the data subject's consent given in writing or an equivalent form — see the document “Consent to processing of personal data”.
You may withdraw consent to cross-border transfer. Withdrawal may make certain features of the service (in particular AI replies in the dashboard) or the service as a whole unusable, in which case we will notify you.
7. Processing with artificial intelligence
If you turned on AI replies in the dashboard, the text of the conversation with the lead and the AI funnel settings are sent to the AI provider you chose (OpenAI, Anthropic, OpenRouter). Their servers are outside the Russian Federation.
The dashboard asks for your explicit consent to this transfer when you connect the AI. Without consent AI replies do not work.
8. Retention
Personal data is processed for the period needed to achieve the purposes of processing.
Dashboard action logs and sign-in attempt logs (date and time, account id and truncated network address) are kept for 90 days and then deleted automatically.
One-time sign-in and password reset codes last no longer than five minutes and are deleted after use or expiry.
After account deletion data is deleted after 30 days; payment data required by tax and accounting law is kept for the statutory period.
9. Your rights
You may obtain confirmation of processing, information about the Operator and the data processed, and request correction, blocking or deletion of your data if it is incomplete, outdated, inaccurate, obtained unlawfully or no longer needed for the stated purpose.
You may withdraw consent to processing, including separately your consent to cross-border transfer, and object to processing.
You may complain to Roskomnadzor or to court.
Requests go to info@ggram.xyz. Part of the data you can export yourself in the dashboard on the Phones page — Export dashboard data.
10. Security
Access to data is restricted at the database level by row-level security policies, not only by the interface; dashboard actions are recorded in audit logs.
Sign-in is protected by server-side two-factor authentication: the code is verified on the server before a session is issued.
Communication between the browser and the service is protected with TLS. Database backups are encrypted.
We do not claim certification against information security standards and do not undertake service availability commitments unless they are agreed separately and in writing.
11. Deletion
You can delete your account in the dashboard: Settings, Security, Delete account. Data is deleted 30 days after the request.
Until the 30 days pass, you can cancel the request in the dashboard or in the bot.
12. Changes to the Policy
We may change this Policy. The current edition is published on this page with its version and effective date.
For changes materially affecting the subject's rights we will ask you to confirm you have read them on the next sign-in.