Privacy Policy
This Privacy Policy explains what data PufAI (operated by Erdal Balcı, Turkey) collects when you use the Telegram bot @PufAIBot and the website at pufai.app, how we use it, and the rights you have. We designed the Service to collect the minimum data needed to operate.
1. Data Controller
Erdal Balcı — individual sole trader, Turkey. Contact: [email protected].
2. What We Collect
From Telegram
- Your Telegram user ID, username, first name, and language code — provided by Telegram whenever you interact with the bot.
- Messages, prompts, and files you send to the bot, so we can process them.
From Payments (via Paddle)
- Paddle handles all card and payment data — we never see or store your card number. We receive from Paddle: transaction ID, product purchased, amount, currency, and the customer email you provide at checkout, so we can grant credits and support your purchase.
Automatic
- Basic server logs (timestamps, request paths, error traces) for security and debugging. Logs are rotated and not tied to personally identifiable content.
We do not use cookies or advertising trackers on our website. We do not sell your data.
3. Why We Use It (Legal Bases)
- To provide the Service (performance of contract): process your messages, generate AI responses, deliver purchased credits.
- To process payments (performance of contract): grant credits when Paddle confirms a purchase and support refund requests.
- To keep the Service secure (legitimate interests): detect abuse, prevent fraud, and enforce quantity caps.
- To comply with law (legal obligation): retain transaction records for tax and accounting.
4. Third-Party Processors
To operate the Service we share the minimum data necessary with:
- Telegram Messenger Inc. — delivery of messages between you and the bot.
- Paddle (Paddle.com Market Limited) — Merchant of Record; processes payments and manages subscription billing.
- Abacus.AI, Inc. — hosting infrastructure and upstream AI model inference for chat, image generation, and file analysis.
Each processor operates under its own privacy policy and applies appropriate safeguards for international transfers.
5. AI Prompts and Files
Prompts and files you send are transmitted to upstream AI providers only to generate a response, and are not used by us to train AI models. Do not send information you would not want processed by an AI system — for example, passwords, government ID numbers, or confidential business data.
6. Data Retention
- Account and credit balance: kept while your account is active and for up to 12 months after last use.
- Message content: not stored permanently — transient processing only, kept in short-term logs for at most 30 days for abuse investigation.
- Payment records: retained as required by tax and accounting law (typically 5–10 years) in the country of the merchant of record and of the seller.
7. Your Rights
Depending on your country of residence you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data (subject to legal retention obligations);
- restrict or object to processing;
- port your data to another service;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local data-protection authority.
To exercise these rights, email [email protected]. We respond within 30 days.
8. International Transfers
The Service and its processors operate globally. Your data may be transferred to and processed in countries outside your own, including the United States and the European Union. We rely on our processors’ standard contractual clauses and equivalent safeguards.
9. Children
The Service is not directed to children under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has used the Service, contact us and we will delete the account.
10. Security
We use industry-standard measures (HTTPS, access controls, encrypted storage) to protect data. No system is 100% secure; if we become aware of a breach affecting your data, we will notify you as required by law.
11. Changes
We may update this Privacy Policy. Material changes will be notified via the bot or by updating the “Last updated” date above.
12. Contact
Data protection inquiries: [email protected].