Privacy Policy

Last updated: August 10, 2026

1. In short

We collect only what's needed for the service to work: your Telegram identifier, your bookkeeping settings, and the content of documents you send us. We don't sell data, don't share it with advertisers, and don't use your documents to train models.

2. What data we process

Account data

• Telegram user ID and username
• company names, country, currency and categories you set up
• links to the sheet and folder created for you

Document content

• files you send us: receipt photos, PDF invoices
• data extracted from them: vendor, date, amount, document number, category, payment method, status

Payment data

• the fact and amount of payment, subscription validity, your customer ID in the payment system
• we do not receive or store your card details — Stripe processes them

Technical data

• service logs: request time, operation type, error details

3. Why we process it and on what basis

• Providing the service — recognition, file storage, writing to the sheet. Basis: performance of our contract with you.
• Payment and invoicing — subscription processing. Basis: contract performance and accounting requirements.
• Support and troubleshooting — service logs. Basis: our legitimate interest in service stability.
• Legal requirements — retaining transaction-supporting documents for the periods required by law.

4. Who we share data with

We use third-party services without which the product can't function. Each gets only what it needs for its role:

• Telegram — the channel through which you talk to the bot
• Google (Drive, Sheets, Cloud Vision) — file storage, your sheet, text recognition on images
• Supabase — the service's database
• Hetzner — the server that runs the bot (Germany)
• Stripe — payment processing
• Vercel — website hosting

We don't share data with third parties for marketing and don't sell it. Data may only be disclosed on a lawful request from public authorities.

5. Transfers outside the EU

Some providers are based in the US. Transfers rely on the European Commission's standard contractual clauses and other legally provided mechanisms.

6. How long we keep data

• Document files and sheet rows — until you delete them. The sheet and folder are yours and you control them.
• Account data — while you use the service, and up to 12 months after you stop.
• Payment data — 7 years, as required by Estonian accounting law.
• Technical logs — up to 90 days.

7. Your rights

Under data protection law, you have the right to:

• obtain a copy of the data we hold about you
• correct inaccurate data
• delete data when there's no lawful basis to keep it
• restrict or object to processing
• receive data in a machine-readable format
• lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon)

To exercise these rights, email us at bugiaiinfo@gmail.com. We respond within 30 days.

8. Security

Connections are encrypted, access to the server and database is restricted, and credentials for third-party services are stored separately from the code. No one can guarantee absolute security, but we take reasonable measures and will notify you and the supervisory authority in the event of a breach affecting your rights.

9. Cookies

The bugiai.com website does not use advertising or analytics cookies and does not track visitors. The bot runs inside Telegram and uses no cookies.

10. Children

The service is intended for businesses and organizations. We deliberately do not collect data from individuals under 16.

11. Changes to this policy

When this policy changes, we'll update the date at the top of the page and notify you of material changes through the bot.