Who we are: hafbot (“we”, “us”) provides a personal AI agent that users reach through Telegram and our website at hafbot.si, operated from the United Arab Emirates. Contact for privacy and support: support@hafbot.si.
This policy is also linked from our bot on Telegram.
1. The short version
- Your agent’s memory is yours. See it, edit it, export it or delete it with
/memory. - We never hold your coding login. If you connect your own AI coding subscription, you sign in on your own agent computer through that provider’s own sign-in. The login stays on that computer and is excluded from our backups.
- We do not use your data to train AI models and we do not sell it.
- Nothing is sent, posted or booked in your name without an approval card.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Telegram user ID, name you give us, language, country, plan | To run your agent and check eligibility |
| Conversations | Messages, voice notes, files you send | To do what you ask |
| Memory | Facts and preferences your agent saves | So it remembers you |
| Computer data | Files and browser data on your agent’s computer | To do the work |
| Connected accounts | Access tokens for email, calendar and social accounts you connect | To act after you approve |
| Approvals | What was requested, what you approved, when | Safety and disputes |
| Usage and billing | Computer hours, AI usage, payments | Plans, limits and invoices |
| Message metadata | Time, size and type of messages on our servers (no content) | Delivery and abuse prevention |
We do not collect the password or tokens of any AI coding subscription you connect, your Telegram password or login codes, or card numbers (our payment providers handle those).
3. Legal bases
- Contract: running the Service you signed up for.
- Legitimate interests: security, abuse prevention, improving reliability.
- Consent: optional features such as connecting accounts, which you can withdraw at any time.
- Legal obligation: tax and accounting records.
4. Who processes your data
We use carefully selected service providers under data-processing agreements. Customers can request the current list at support@hafbot.si.
Telegram, the provider of any AI coding subscription you connect yourself, Google and Microsoft (for your mailbox) and the social platforms you connect act as independent controllers under their own terms.
4a. Google user data (Sign in with Google and connected Google accounts)
Sign in with Google. If you choose “Continue with Google”, we receive your name, email address and profile picture from Google (scopes: openid, email, profile). We use them only to create your hafbot account, sign you in securely, show your name and picture in the app, and contact you about your account. We do not request access to your Gmail, Calendar, Drive or contacts when you sign in.
Connecting Google apps (optional). If you later choose to connect Gmail, Google Calendar or Google Drive, Google shows you exactly what access is requested and you approve it. Your agent then uses that access only to do what you ask (for example read, summarise or draft emails, check your calendar, or find a file), and anything sent or changed in your name needs your approval first. You can disconnect at any time from Connections in the app or bot, or from your Google Account permissions page.
How we treat Google user data:
- We use it only to provide and improve the features you use in hafbot. We do not sell it, use it for advertising, or use it to build ad profiles.
- We do not use Google user data to train general AI or machine learning models.
- Humans at hafbot do not read it, unless you give us permission for a specific support request, it is necessary for security purposes (for example investigating abuse), or the law requires it.
- We share it only with service providers that help us run hafbot, under data-processing agreements, and only as needed to provide the features you use.
- Access tokens are stored encrypted and are never placed on your agent’s computer.
- When you disconnect a Google account or delete your hafbot account, we delete the related tokens and data as described in section 6.
Limited Use. hafbot’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. International transfers
We aim to keep data in the EU. Where a provider processes data outside the EU or UAE, we rely on Standard Contractual Clauses or another lawful transfer mechanism.
6. How long we keep data
| Data | Kept for |
|---|---|
| Memory | Until you delete it |
| Chats and files on your agent’s computer | Until you delete them or your account |
| Message metadata (no content) | 90 days |
| Approval records and admin access logs | 1 year |
| Backups | 30 days, rolling |
| After you delete your account | Destroyed within 7 days; cleared from backups within 35 days |
| Billing records | 5 years, as UAE tax law requires (no message content) |
7. Your rights
You can access, correct, export, delete or restrict your data, object to processing, and withdraw consent. Most of this works in the bot:
/memoryto view, edit, export or delete what your agent knows./memorythen “Delete everything” to erase your account (with a 24-hour undo)./supportfor anything else, or email support@hafbot.si. We answer within one month.- To delete your account and all your data, use
/memorythen “Delete everything”, or email support@hafbot.si from the address on your account.
You can also complain to your data protection authority. In the UAE, the UAE Data Office; in the EU, the authority in your country.
8. Security
Each agent runs on its own isolated computer. Email and social account keys are held by our approval service, never on the agent’s computer. Data is encrypted in transit and at rest. If a breach affects you, we will tell you without undue delay and notify the authorities as the law requires.
9. Children
hafbot is for adults aged 18 and over. We do not knowingly collect children’s data.
10. Website
hafbot.si sets no cookies and loads no third-party scripts. See the Cookie statement.
11. Changes
We will tell you in the bot before material changes take effect.