Legal

Privacy Policy

This policy replaces an earlier version written for a different product, which described cookies this site does not set. One section is deliberately absent: we are not yet incorporated, so there is no registered entity to name as data controller, and naming a placeholder would be worse than the gap.

Two roles, and why it matters

ATREOX AI handles personal data in two different roles. As a controller, for our own customers: name, email, billing and subscription data. As a processor, on your behalf, for everything the automation touches — the Telegram accounts you upload, the proxies you add, and the people the automation interacts with.

That second role is the substantial one. NeuroDialogs reads and replies to direct messages from real Telegram users. The parsers collect data about channels and discussion groups. Neurocommenting stores the text of posts it comments on. For that data you are the controller and we act on your instructions.

Data we hold as controller

About our customers: your name, email and account identifiers, to provide the Service and your account. Billing and subscription data, held by Stripe — we hold identifiers and status — to take payment and manage subscriptions. Support correspondence, to answer you. Referral participation and attribution, to run the referral programme. Server and application logs, for security, debugging and abuse prevention.

We do not sell personal data. We do not share it for anyone else’s marketing.

Data we process on your behalf

Processed only to run the modules you have licensed, on your instructions: Telegram account credentials and profile data you add — session strings, api_id and api_hash, phone number, display name, bio, avatar, and the account health status recorded by the Service. Proxy credentials you add: host, port, username, password.

Operational records: channels monitored, posts commented on and their text, comments generated and delivered, direct-message conversations handled by NeuroDialogs, and parser results.

Account checker — uploaded sessions

The free account checker lets you upload a Telegram session file to check one of your own accounts. That file is a live credential and we treat it as one: it is used only for the check you asked for and deleted the moment it finishes — always, including if the check fails — with a background sweep removing anything a failed check might leave behind. We never write the session, its contents, your phone number, or your account’s numeric ID to our database, our logs, or any error message. We keep only anonymised facts about the account (whether it can post, its approximate age, data centre and device) and a one-way fingerprint that lets your own history line up over time — never anything that identifies the account or you.

The public checker keeps what it does on your account to the minimum needed to answer “can this account post”: a single typing signal that creates no message and leaves no trace in any chat. It does nothing else on your behalf — in particular it does not message @SpamBot — so the spam-limit status is available only in the panel, on your own accounts.

Free checkers — what is counted, and the “ask a person” form

Every run of the free proxy and account checkers is counted, so we can see whether they are used and what they find. Each count records only: when, which checker, how many lines were submitted and checked, how many came back with each result (for example “2 working, 1 does not hold its exit”), and whether the run finished or hit the hourly limit. It records no IP address, no proxy host, port, login or password, and nothing about the account — the table has no column for any of them. These counts are kept for 400 days. Separately, the hourly limit is enforced by remembering the requesting IP address for one day.

Under a bad result the checker offers a link to ask a person about it. Nothing is sent unless you open that form, type a Telegram username and press send. What is sent is that username, which checker, which result, and for a proxy the two-letter country Telegram reported — never the proxy, the login or the session file. It arrives as an email in our inbox, a person replies to you once on Telegram about that result, and it is not stored in any database or added to any list.

People who are not our customers

The Service interacts with Telegram users who have no relationship with us — people who send direct messages that NeuroDialogs answers, and people whose public activity the parsers record. For that data the customer is the controller and is responsible for having a lawful basis for it. That is the position the Terms take, and it is stated here plainly rather than left implied.

Sub-processors

Stripe handles payments and subscription billing. Clerk handles authentication and user accounts. Vercel hosts the website and dashboard. Upstash (Redis) stores referral attribution. The language models that generate comment and reply text are provided by OpenAI, Anthropic, Google, xAI and Moonshot, depending on which model you select in the dashboard — the text of the post being commented on, and the conversation being replied to, is sent to the selected provider.

This list is not yet complete: the provider hosting the automation engine and its database is not named here, and the hosting regions and international-transfer mechanisms for the providers above are not yet stated. Both will be added rather than guessed at.

How long we keep things

These are the periods the system actually enforces, read from the retention rules in the engine rather than described from intent. Undelivered comment drafts: 30 days. Failed send records: 90 days. No-account diagnostic records: 7 days. Pending posts not yet acted on: 14 days. Channel failure history: 30 days.

Delivered comments are kept indefinitely — they are your record of what was posted under your accounts. Account, billing and subscription records are kept for the life of the account, then as required by law.

Your rights

We treat customers as consumers (see the Terms). If you are in the EU/EEA or the UK, you have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. Where processing relies on consent, you can withdraw it at any time.

Requests go to hello@atreoxai.com and we respond within one month. If a request concerns data we process on a customer’s behalf, we will direct it to that customer, who is the controller for it.

You may also complain to the data protection supervisory authority where you live.

Security

Access to production systems is restricted; traffic is encrypted in transit; payment card data never touches our servers and is handled entirely by Stripe.

Cookies and analytics

This site sets no cookies for analytics or advertising, and therefore shows no cookie banner. That is a deliberate outcome, not an oversight.

We use Vercel Web Analytics. It is served from our own domain, so no third-party host is contacted, and it sets no cookies. It records aggregate page views and referrers — which pages are read and roughly where visitors arrived from. It does not build a profile of you and does not follow you between sites.

Two cookies are set, both strictly necessary for something you asked for: atreox_ref, set by the dashboard, remembers which partner referred you so their commission is attributed, and lasts 90 days; and session cookies set by Clerk, which keep you signed in to the dashboard.

Cloudflare Turnstile checks that a submission comes from a person rather than a script. It sets no cookies. It loads in three places only: the contact page, the free proxy and account checkers, and the “ask a person” form under a checker result once you open it — not while you are reading a guide or anything else on this site.

Videos are not embedded. Where a page shows a video, what is on the page is an image served from this site and a play button: no player, no YouTube script, and no request to Google. Pressing play is what loads the video, from youtube-nocookie.com, and YouTube may then set cookies in your browser — which is why the button says so before you press it. If you do not press it, nothing of Google’s is loaded at all.

Children

The Service is not directed at anyone under 18 and we do not knowingly collect their data.

Changes

We may update this policy. Material changes will be announced before they take effect, and the "Last updated" date above will change.

Contact

hello@atreoxai.com