1. Who is the data controller
For personal data you provide directly to tgme (account details, billing information, in-product activity), tgme is the data controller.
For personal data of your subscribers processed through tgme's broadcasting, bot, and inbox features, you are the data controller and tgme is a data processor acting on your instructions. That relationship is documented in our Data Processing Addendum.
2. What data we collect
We collect the following categories of data: - Account information: name, email, organisation, role - Authentication data: hashed credentials, TOTP secrets, session tokens - Billing information: payment method identifiers, invoicing address (payment card numbers are handled by our payment processors, not stored on our servers) - Service usage: pages visited, actions taken, API calls, error logs - Integration data: Telegram bot tokens (encrypted at rest), Telegram user IDs of subscribers you connect to your workspace - Support communications: messages you send us via Telegram or email
3. How we use it
We use your data to: - Provide, maintain, and improve the Service - Authenticate you and secure your account - Bill you and process payments - Send you transactional messages about your account - Send you product updates if you opted in - Investigate abuse and enforce our Terms - Comply with legal obligations
4. Legal bases (GDPR / PDPA)
Where GDPR or comparable regimes apply, we process your data on the following bases: - Contract: to provide the Service you signed up for - Legitimate interests: to secure the Service, prevent abuse, and improve product quality - Legal obligation: to meet tax, accounting, and law-enforcement requirements - Consent: for optional marketing communications (which you can withdraw at any time)
7. Retention
We retain personal data for as long as your account is active and thereafter for as long as needed to (a) comply with legal obligations, (b) resolve disputes, or (c) enforce our agreements. Encrypted backups may persist for up to 90 days after deletion.
Broadcast and inbox history is retained for the duration of your subscription plus 30 days grace on cancellation.
8. Your rights
Depending on your jurisdiction, you may have the right to: - Access the personal data we hold about you - Request correction of inaccurate data - Request deletion of your data - Restrict or object to certain processing - Data portability - Withdraw consent for marketing communications
To exercise any of these rights, contact us via the Telegram handle listed on tgme1.com.
9. International transfers
tgme is operated from Malaysia and uses infrastructure providers in several regions including Southeast Asia, the EU, and the United States. Where personal data of EU or UK residents is transferred outside those regions, we rely on Standard Contractual Clauses or equivalent safeguards.
10. Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest (AES-256 for sensitive fields like bot tokens), least-privilege access controls, regular vulnerability scanning, and audit logging. No system is perfectly secure; you use the Service at your own risk.
11. Children
tgme is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified in-product or by email. The effective date at the top of this page reflects the latest revision.
13. Contact
Privacy-related questions and requests should be sent to the Telegram handle listed on tgme1.com. We aim to respond within 30 days as required by most privacy laws.