Privacy Policy

Last updated November 5, 2026

CreatorInbox (“we”) helps creators answer and sell in their Telegram chats. This policy explains what we collect, why, and who processes it. Questions: support@creator-inbox.com.

What we collect

Your account: email, name, and, if you sign in with Google, your Google profile name and picture. We do not get your Google password or access to your Google data.
Your bot and Telegram Business connection: the bot token you give us (stored encrypted) and the permissions Telegram grants it. We never ask for your Telegram password or login code.
Chats you connect: messages, media and profile details of the people who write to you, as Telegram delivers them to your bot, so you can read and answer them here.
Your content and sales: files you upload to sell, offers, prices, and Telegram Stars payment records.
Billing: if you add a card, Stripe stores it; we only see the card brand, last four digits and payment status.
Technical data: session cookies to keep you signed in, and server logs (IP address, request time) kept for security and debugging.

How we use it

To run the service: show your chats, send your messages and offers, deliver purchased files.
To draft and send AI replies when you turn AI on. The relevant conversation and your AI settings are sent to our AI provider to generate a reply. They are not used to train models.
To bill you for your plan and the fee on AI-assisted sales.
To email you sign-in codes and important account notices.

We do not sell personal data and do not show ads.

Who processes data for us

Supabase: database and file storage (Frankfurt, EU).
Fly.io: application hosting (Frankfurt, EU).
OpenRouter: AI replies, only when AI is on. It routes requests to DeepSeek models on hosting providers that don’t store or train on the data.
Braintrust: quality monitoring of AI replies, only when AI is on. It receives the conversation the AI saw and its reply, without account or chat identifiers.
Resend: sending email.
Stripe: card payments and invoices.
Google: sign-in, only if you choose it.
Telegram: message delivery and Stars payments, under Telegram’s own terms.

How long we keep it

We keep your data while your account is active. When you delete your account or ask us to, we delete your account, chats and files within 30 days, except records we must keep by law (such as invoices).

Your rights

You can ask us to access, correct, export or delete your data, or object to how we use it. Email support@creator-inbox.com. People who write to a creator through CreatorInbox can ask that creator, or us, to delete their messages. If you are in the EU or UK you can also complain to your data protection authority.

Security

Data is encrypted in transit; bot tokens are also encrypted at rest. Sign-in is by one-time email code or Google, so there are no passwords to leak.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect.