Privacy Policy

1. Data controller

The controller of personal data processed in connection with the operation of the Adjoin dashboard (Customer accounts and their teams) is [Operator], company ID [registration number], registered office at [address], contact: [contact@domain.com] (the “Operator” or “we”).

With respect to the personal data of Telegram/WhatsApp group members, form contacts, and other end users that the Customer uploads or collects through the Service via their own campaigns, the Operator acts as a processor and the Customer as the controller — this relationship is governed by a data processing agreement, the essential terms of which are set out in this document and in the Terms of Service.

2. What personal data we process

Category	Example data	Source
Customer account	e-mail, name, password hash, team role	Customer at registration
Telegram/WhatsApp members	tg_user_id, username, first/last name, payment history	Telegram/WhatsApp API, the bot
Landing page visitors	IP address, cookies (_fbc/_fbp), UTM parameters, user agent	automatically on visit
Form submitters	submitted fields (e.g. name, e-mail, phone)	the form visitor
Billing data	payment history, currency, amount	Customer / connected CRM

3. Purpose and legal basis

• Providing the Service (account management, running campaigns and the bot, statistics) — performance of a contract (Art. 6(1)(b) GDPR).
• Sending conversion events to Meta (Conversions API) — the Customer's legitimate interest in optimizing their advertising; the Customer is responsible for informing their own end users in line with Meta's terms.
• Security and abuse prevention (anti-bot protection, audit log) — the Operator's legitimate interest.
• Billing and legal compliance — compliance with a legal obligation (accounting and tax law).
• Communicating with the Customer (support, change notices) — performance of a contract / legitimate interest.

4. Retention period

We process personal data for the duration of the contract (as long as the workspace exists) and afterwards for as long as required by law (e.g. accounting records for 10 years). Data about the Customer's members/contacts is retained for as long as the workspace that collected it exists — deleting a workspace, campaign, or an individual member/form submission in the dashboard permanently and irreversibly deletes it.

5. Recipients and processors

We use the following subprocessors/recipients of data, with whom we have appropriate data processing agreements in place:

• Cloudflare, Inc. — hosting for the application, database, and CDN (Workers, D1, KV).
• Meta Platforms, Inc. — recipient of conversion events (Conversions API) per the Customer's own campaign settings.
• Telegram / WhatsApp (Meta) — technical infrastructure for message delivery and group management, per the Customer's choice.
• The Customer's own chosen CRM — only if the Customer activates the integration themselves.

6. International transfers

Some of the recipients above (Cloudflare, Meta) may process data outside the European Economic Area, in particular in the United States. In such cases, the transfer is safeguarded by the European Commission's Standard Contractual Clauses or an equivalent mechanism under Art. 46 GDPR.

7. Your rights

With respect to your personal data, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erasure (“the right to be forgotten”) — for a Customer account, the workspace and individual records (a member, a form submission) can be deleted directly in the dashboard, see below;
• restrict processing;
• data portability (data export, e.g. the CSV export of members/statistics available in the dashboard);
• object to processing based on legitimate interest;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz), or your local supervisory authority, if you believe processing violates the GDPR.

How to exercise your rights

The fastest way is directly in the dashboard: Settings → Delete workspace permanently deletes an entire account including all data; an individual group member can be deleted from their detail view, and a form submission from the form's detail page. For anything else (access, portability, questions), contact us at [contact@domain.com] — we respond to requests within 30 days at the latest.

8. Cookies

Landing pages created through the Service use technical cookies required for attribution to work (e.g. _fbc, _fbp for matching with the Meta Pixel) and a short-lived cookie identifying the click. The Adjoin dashboard itself uses only a necessary login (session) cookie — no third-party marketing or analytics cookies beyond that purpose.

9. Security

Login passwords are stored exclusively as an irreversible hash (PBKDF2); sensitive access tokens (API keys to Meta/Telegram accounts) are encrypted at the database level. Access to data is scoped to roles within a workspace and protected by a login session of limited duration.

10. Contact

For any questions about how we process personal data, contact us at [contact@domain.com]. This document forms an integral part of our Terms of Service and the Operator may update it as reasonably necessary, in particular to reflect changes in the law.