Telegram Mini App and bot

Partner Hub Privacy Policy

Last updated: 2 November 2026 · Version 1.0

AffiliateManagersAI Ltd is being incorporated in Cyprus. Until incorporation and opening of its bank account AMAI does not take any payments.

This document is written in English. The English version is the binding version.

1. What this Policy covers

1.1 The AMAI Partner Hub (the "Partner Hub") is a Telegram Mini App and bot operated by AffiliateManagersAI Ltd, a private company being incorporated in the Republic of Cyprus, trading as AMAI, Limassol, Cyprus ("AMAI", "we", "us"). Its registration number and registered office will be added on incorporation.

1.2 Affiliate programmes and affiliate teams that use AMAI (each a "Customer") invite affiliates, webmasters and media buyers ("Partners", "you") to a private Deal Room (partner room) in the Partner Hub to discuss and manage a partnership. You join a Deal Room only by opening a personal invitation link, and only after you have shown interest in talking to the Customer.

1.3 This Policy explains what personal data is processed when you open the Partner Hub or use a Deal Room, who is responsible, and what choices you have. It is written to meet Article 13 of Regulation (EU) 2016/679 ("GDPR") and the Telegram rules for bots and Mini Apps.

2. Who is responsible for your data

2.1 The Customer that invited you is the controller of the data about your partnership with it: your Deal Room messages, files, commercial terms, registration details and the Customer's notes about you. The Customer's name is shown in the Deal Room, and the Customer must give you its own privacy notice, for example with its invitation. AMAI processes this data on the Customer's behalf, as its processor, under a data processing agreement (DPA).

2.2 AMAI is the controller of the following, which we need to run the Partner Hub safely for all users:

• verifying your Telegram identity and managing your Partner Hub sessions;
• technical and security logs and the prevention of fraud, spam and abuse;
• your requests to us to stop contact through AMAI (section 9.2);
• handling reports of illegal content under the Digital Services Act;
• records we must keep to show compliance with the law, such as proof of your consent.

2.3 Telegram is an independent controller of the data it processes when you use Telegram, under its own Terms of Service and Privacy Policy. AMAI does not control Telegram's processing.

2.4 Contact: amai@amai.team (subject: Privacy). We forward requests about Customer-controlled data to the relevant Customer and help it respond.

3. Data we receive from Telegram

3.1 When you open the Partner Hub, Telegram passes the following data to it, depending on your settings and the context in which you open it:

• your Telegram user ID;
• your first name, last name and username, if set;
• your language code;
• your profile photo URL, if available;
• whether you have Telegram Premium and whether you allow the bot to write to you;
• the start parameter of the link you opened (your invitation token);
• a signed data string (with its date and hash) that lets us verify that the data really comes from Telegram;
• technical data that every website receives, such as your IP address, device and browser type, platform and Mini App version, and display settings.

3.2 Of the data in the list above received from Telegram, our servers keep only your Telegram user ID, your username (as a snapshot), whether you allow the bot to write to you, the invitation parameter, the time at which Telegram signed the data and a hash of the signed data. We do not keep your first or last name, profile photo, language code or Premium status received from Telegram. We use this data only to verify who you are, connect you to the right Deal Room, show your username and any profile details you choose to add to the Customer's managers, protect the service against misuse and, if you allow it, send you notifications through the bot. Technical data such as your IP address may be processed in server logs for security.

3.3 We do not read your other Telegram chats, contacts or channels through the Partner Hub, and we do not collect Telegram data to build datasets or to train AI models.

4. Data you provide in a Deal Room

4.1 In a Deal Room you may provide: messages; files (for example traffic statistics, screenshots or creatives); information about your traffic sources, channels, websites, GEOs and verticals; your registration email and promo code for the Customer's programme; the commercial terms you discuss and accept; and your consent and contact-preference choices.

4.2 Please do not share special categories of personal data, identity documents, bank card numbers or data about players.

5. Purposes and legal bases

5.1 Processing for the Customer (AMAI acts as processor; the Customer determines the legal basis and is responsible for it):

• discussing a partnership, agreeing terms, registering you in the Customer's affiliate programme and managing the relationship: steps at your request before entering into a contract and performance of the contract (Article 6(1)(b) GDPR), and the Customer's legitimate interest in running its programme (Article 6(1)(f));
• keeping a record of what was agreed: the Customer's legitimate interest and legal obligations;
• optional AI assistance (section 6): your consent (Article 6(1)(a)).

5.2 Processing by AMAI as controller:

• identity verification, session management, security, fraud and spam prevention, and technical logs: legitimate interest in providing a secure service (Article 6(1)(f));
• honouring your requests to stop contact: legitimate interest in honouring your objection, and our obligations under Article 21 GDPR;
• notice-and-action under the Digital Services Act and proof of consent: legal obligation (Article 6(1)(c)) and legitimate interest in demonstrating compliance.

6. AI assistance in Deal Rooms: your consent

6.1 A Customer may use an AI assistant in a Deal Room to understand your messages, keep a structured record of facts agreed in the room, and write replies within the Customer's own rules. The AI assistant uses models provided by OpenAI, as AMAI's sub-processor.

6.2 We only use AI on your Deal Room messages if you agree. The Partner Hub tells you that replies may be written by an AI assistant and asks for your consent separately from anything else, with boxes that are not ticked in advance. The consent screen names the Customer or Customers responsible (controllers) and the programmes covered. The purposes are:

• AI assistance: the Customer's AI assistant may read the messages in your Deal Room to draft replies and, within the Customer's rules, to reply to you directly; and
• Room memory: the assistant may keep a structured summary of facts you and the Customer agree (for example GEO, traffic type, registration details and agreed terms) so you do not have to repeat them.

6.3 Your choice is recorded with the date, the version of this Policy and the purposes you accepted. Your decision belongs to your verified Telegram identity and covers the Customer and programmes named on the consent screen, including new Deal Rooms with them; it never covers other businesses. A new invitation, reload or device does not create a new consent. Saying no does not stop you from using the Deal Room: the Customer's team will reply to you personally.

6.4 You can withdraw consent at any time in the AI and privacy settings of the Partner Hub. Withdrawal takes effect immediately: the AI assistant stops, every Deal Room covered by your consent returns to the Customer's team, and room memory is no longer updated. If you allow AI again later, earlier automated work does not restart by itself. Withdrawal does not affect processing that took place before.

6.5 Transparency. While AI assistance is active, the Deal Room shows this. If you want a reply from a person, say so in the room or withdraw your consent.

6.6 Limits. The AI assistant can make mistakes. It cannot approve commercial terms, confirm registrations or payments, or change your status: these are confirmed by the Customer's team through fixed workflows. Only terms confirmed in the Deal Room are binding.

6.7 No training. Your Deal Room messages are not used to train, fine-tune or benchmark AI models, not by AMAI, not by the Customer through AMAI and not by OpenAI. They are used only to provide the AI assistance in your Deal Room. Other data from Telegram is not sent to the AI model.

7. Who can see your data

• the Customer's authorised managers who are assigned to your Deal Room;
• AMAI personnel who need access to provide support, keep the service secure or handle a request from you, bound by confidentiality;
• AMAI's sub-processors: OpenAI for AI assistance, only if you consented, and the hosting provider of the platform. The hosting provider and the full list of sub-processors will be published in Annex 3 of the DPA before the paid launch and are available on request;
• Telegram, to deliver bot notifications to you;
• authorities, where we or the Customer are legally required to disclose data.

We do not sell your data or use it for advertising.

8. International transfers

8.1 Where a sub-processor processes data outside the EEA (for example OpenAI and its affiliates in the United States), the transfer is protected by an adequacy decision (including the EU-U.S. Data Privacy Framework where the recipient is certified) or by the European Commission's Standard Contractual Clauses.

8.2 If the Customer that invited you is located outside the EEA, it will receive your Deal Room data in its own country. This disclosure is made by AMAI on the Customer's instructions and, where required, under the Standard Contractual Clauses (processor to controller). The Customer's privacy notice describes its own safeguards.

9. Your choices and rights

9.1 Tools in the Partner Hub:

• Export room data: a machine-readable copy (JSON) of the visible messages, file details, published terms and your consent history for a Deal Room;
• Request data removal: asks for the operational data of a Deal Room (messages, files, room memory) to be removed. Your AI consent is revoked and open invitations are cancelled at once. Some records may be kept where the Customer or AMAI must keep them by law or to establish legal claims, for example proof of agreed terms and of your consent;
• Contact later: the Customer will not send you commercial messages for 14 days; no message is sent automatically when the pause ends;
• Do not contact me: the Customer, across all its managers and programmes, will no longer contact you through AMAI, with no expiry. Only you can reverse this, by opting in again in the Partner Hub;
• Close partner profile: closes your access to all Partner Hub rooms and requests removal of their operational data; terms, registrations and required consent records are kept, and copies you already downloaded cannot be recalled.

9.2 Stop contact by every business using AMAI. If you do not want any business using AMAI to contact you, write to amai@amai.team (subject: Privacy) with your Telegram username or user ID. We apply your request manually for all Customers, without undue delay and in any case within one month, and keep only a minimal record of it (see the Partner Notice).

9.3 Your GDPR rights: access, rectification, erasure, restriction, data portability, objection (including the absolute right to object to direct marketing), and withdrawal of consent. For Customer-controlled data, contact the Customer or us; we forward your request to the Customer within 5 business days and help it respond within one month.

9.4 Complaints: you may complain to the data protection authority in the EU country where you live or work, or to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy).

10. Storage and security

10.1 We use encryption in transit (TLS) for connections between the Partner Hub and our servers.

10.2 Files in Deal Rooms are encrypted at application level with a dedicated key that is stored separately from the files.

10.3 Access is limited to authorised persons on a need-to-know basis. Every Deal Room is bound to one Customer workspace and one Partner. Key actions (consent, control-mode changes, exports, erasure) are logged.

10.4 We verify the signature of the data Telegram sends to the Partner Hub before trusting it, and sessions expire automatically.

11. How long we keep data

12. If the Partner Hub stops operating

If AMAI stops operating the Partner Hub or the bot, we will delete the personal data we received through Telegram, as Telegram's rules require, after giving Customers the data retrieval period required by the EU Data Act (at least 30 days), unless the law requires us to keep specific records.

13. Payments

No payments are made to or from you inside the Partner Hub, and no digital goods or services are sold in it. Commission payments, if any, are made by the Customer outside the Partner Hub under its own terms.

14. Age and business use

The Partner Hub is for adults (18+) acting in a business capacity. If you are under 18, do not use it.

15. Changes, contact and language

15.1 We will publish changes on this page and, for material changes, inform you in the Partner Hub before they apply. If a change affects what you consented to, we will ask for your consent again.

15.2 Contact: AffiliateManagersAI Ltd (AMAI), Limassol, Cyprus, amai@amai.team. For illegal content and abuse, use the subject "Abuse report".

15.3 This Policy is written in English. The English version is the binding version.