1. Who are we?
We are MALJOY LTD, a company which is established and operates in accordance with the laws of the United Kingdom. Registration No.16216055. Registered address: Suite 12, 2nd Floor Queens House, 180 Tottenham Court Road, London, United Kingdom, W1T 7PD.
- we are the controller of your personal data, that is, we independently determine how and why we process your personal data (the “Controller");
- sINCE ACCESS TO THE BOT IS PROVIDED REMOTELY, WE MAY INADVERTENTLY COLLECT PERSONAL DATA FROM PERSONS UNDER THE AGE OF 16. IF YOU ARE A MINOR, PLEASE REFRAIN FROM ANY USE OF THE BOT AND ACCESS THERETO. WE WILL COMPLETELY ERASE YOUR DATA IMMEDIATELY UPON YOUR OR YOUR LEGAL GUARDIAN’S REQUEST;
2. Definitions
Bot – anonymous chat “Anonymous chat | Dating (username @chatus, @anonymous_chatusbot”, that is a small application that runs entirely within the Telegram app for mobile devices and personal computers.
User – an individual who interacts with the Bot via the Telegram app to access the anonymous chat service.
Personal Data – any information that can be used to identify a person, as well as any information about a person who is already identified.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Telegram – a mobile and desktop app known under the name ‘Telegram’ for Android- and iOS-run mobile devices, as well as for personal computers, providing communication and messaging features for its users, including but not limited to Bot and Service.
3. What is this Privacy Policy for?
This Privacy Policy explains what personal data we collect and why we process it when the User uses the Bot. It also sets out other important information about how we handle personal data, the User rights, and how to exercise them.
4. For what purposes and what personal data do we process?
4.1
| Purpose | To identify the Bot user |
| Categories of personal data processed | Telegram identifiers (user ID, username, profile link). |
| Legal basis for processing personal data | Legitimate interest: to operate, maintain and secure the service (prevent abuse, troubleshoot, ensure functionality). |
| Personal data retention period | 1 year after the Bot is deleted. |
| Is the User obliged to provide personal data? | The User is not required to provide additional personal data to us. The Bot receives the necessary data from Telegram when the User uses the Bot. |
4.2
| Purpose | To match users |
| Categories of personal data processed | User ID, gender, age (optional). |
| Legal basis for processing personal data | Performance of a contract (Terms of Service): processing is necessary to deliver the service the User requested, such as matching users based on their gender and / or age preferences. |
| Personal data retention period | 1 year after the Bot is deleted. |
| Is the User obliged to provide personal data? | Gender is mandatory to enable matching. If the User chooses not to provide the mandatory data (gender), the User may not be able to use the matching features of the Bot. However, providing age is optional. If user does not provide this information, the Bot will have limited matching functionality. |
4.3
| Purpose | To match Bot’s users with same interests |
| Categories of personal data processed | User ID, information about personal interest (close-ended list): financial support, roleplay, friendship, loneliness, music, cinema, books, sports, memes, anime, Korea, pets, technology, games, twitch. |
| Legal basis for processing personal data | Performance of a contract (Terms of Service): processing is necessary to deliver the service the User requested, such as matching users based on their interests. |
| Personal data retention period | 1 year after the Bot is deleted. |
| Is the User obliged to provide personal data? | Providing interests is not mandatory. The User can choose whether or not to share his/her interests. If User does not provide this information, the Bot will have limited matching functionality. |
4.4
| Purpose | To identify user as a premium user and allow to use services available to premium users |
| Categories of personal data processed | User ID, membership expire time, amount of donates of Telegram stars. |
| Legal basis for processing personal data | Performance of a contract (Terms of Service): processing is necessary to verify premium membership and provide the associated services. |
| Personal data retention period | 1 year after deleting the Bot. |
| Is the User obliged to provide personal data? | Since this information is received directly from Telegram, the Users is not required to provide it himself. The data is collected automatically as part of the service when the User interact with the Bot. |
4.5
| Purpose | To record and monitor user and system actions for security, debugging, abuse prevention, and service performance control. |
| Categories of personal data processed | Usage data (e.g. timestamp of the event (created_at, updated_at), technical metadata (is_media, ip_address, user_agent, log_level), optional diagnostic or contextual data (context, meta), etc.).Action logs (e.g. action type or event name (action, e.g., start_chat, send_message, report_user), context or parameter value associated with the action (value – may include message ID, hash, or short code but not full message content), message and routing identifiers (message_id, sended_id), etc.). |
| Legal basis for processing personal data | Legitimate interest: to ensure service security, monitor usage, prevent abuse, and improve the quality of the Bot. |
| Personal data retention period | The data are processed only for the duration of the monitoring check and are not stored afterwards. |
| Is the User obliged to provide personal data? | The User is not obliged to provide this data himself. However, the data is collected automatically by the Bot during normal operation of the service, and users cannot opt out of this automatic collection. |
4.6
| Purpose | To prevent anti-fraud, anti-spam and other illegal activities |
| Categories of personal data processed | Number of chats (per day, per month, per year, etc), chat duration, number of messages received, last activity, chat content. |
| Legal basis for processing personal data | Legitimate interest: to protect the service and users from fraud, spam, and other illegal activites, ensuring safe and trustworthy interactions. |
| Personal data retention period | 1 year after the Bot is deleted.Chat messages without detected prohibited content are processed only for the duration of the spam filter check and are not stored afterwards. Chat messages flagged for moderation are processed until the moderator reviews and inspects the content and are not stored afterwards. |
| Is the User obliged to provide personal data? | The User is not obliged to provide this data himself. However, the data is collected automatically by the Bot during normal operation of the service, and users cannot opt out of this automatic collection. |
4.7
| Purpose | Affiliate programs allowing Telegram users to promote the Bot and earn commissions on purchases made by people they referred. |
| Categories of personal data processed | User ID, referral link, referrals count (user invites), interaction logs related to affiliate activities. |
| Legal basis for processing personal data | Legitimate interest: to operate and optimize the affiliate program, ensuring fair and transparent awarding of commissions. |
| Personal data retention period | 1 year after deleting the Bot. |
| Are you obliged to provide personal data? | The User is not obliged to provide this data himself. The data collection occurs as part of the service operation, and users cannot opt out of the automatic collection necessary for tracking referrals and commissions. |
4.8
| Purpose | To identify blocked user |
| Categories of personal data processed | User ID, account status flags (e.g., is_blocked). |
| Legal basis for processing personal data | Legitimate interest: to maintain a safe environment by identifying and managing blocked users, preventing abuse, and ensuring the security of the service. |
| Personal data retention period | 1 year after deleting the Bot. |
| Are you obliged to provide personal data? | If the User is blocked, that status is determined automatically; the User cannot opt out of this data collection related to blocking. |
4.9
| Purpose | To block inappropriate messages and/or photos |
| Categories of personal data processed | User IDs associated with messages, reported chat content (message, photo, etc.). |
| Legal basis for processing personal data | Legitimate interest: to ensure a safe environment by detecting and preventing the sharing of inappropriate content, protecting users from harm, and maintaining compliance with Bot policies. |
| Personal data retention period | Data is deleted after moderator reviews messages and/or photo. The storage period for data related to automated bans (e.g., for banwords, spam, etc.) is up to 1 year from the date of ban. |
| Are you obliged to provide personal data? | The User is not obliged to provide this data but can report a message if he/she thinks that the content of the message is inappropriate. |
4.10
| Purpose | To allow users to see unblurred photos |
| Categories of personal data processed | User ID, information on status of photo blur function (on/off). |
| Legal basis for processing personal data | User’s consent: the User can choose to see unblurred photos. |
| Personal data retention period | 1 year after deleting the Bot. |
| Are you obliged to provide personal data? | The User can choose to see unblurred photos. If the user chooses not to consent, he/she will not be able to see the unblurred images. |
4.11
| Purpose | To enable users to have ratings |
| Categories of personal data processed | User ID, information about User's rate. |
| Legal basis for processing personal data | Performance of a contract (Terms of Service): rating feature is part of a service. |
| Personal data retention period | 1 year after deleting the Bot. |
| Are you obliged to provide personal data? | Ratings are given by other users. |
4.12
| Purpose | To run advertisement campaigns |
| Categories of personal data processed | User ID, language, channels subscribed, Telegram membership status. |
| Legal basis for processing personal data | Legitimate interest: to optimize advertising efforts and improve targeting. |
| Personal data retention period | 1 year after deleting the Bot. |
| Are you obliged to provide personal data? | The data is gathered as part of the service operation, and users cannot opt out of this automatic collection. |
4.13
| Purpose | To ensure Bot functionality |
| Categories of personal data processed | User ID, language, timestamp of message or chat event, chat ID. |
| Legal basis for processing personal data | Legitimate interest: to maintain, improve, and ensure the reliable operation of the Bot. |
| Personal data retention period | 1 year after deleting the Bot. |
| Are you obliged to provide personal data? | No, since this data is automatically collected as part of the Bot’s normal operation for maintaining functionality. |
4.14
| Purpose | To provide you with the support and address your questions |
| Categories of personal data processed | Name, e-mail, phone No., other data which user can share |
| Legal basis for processing personal data | Your consent which you express by contacting us, voluntary independent disclosure of data when sending it to us. |
| Personal data retention period | 1 year from the last contact date. |
| Are you obliged to provide personal data? | You voluntarily 1provide the data while contacting us. |
5. From where do we get your personal data?
The Bot is a small application that runs within the Telegram app. It may receive certain user data from Telegram once a user starts interacting with the Bot. Additional information may be provided directly by the user while using the Bot or contacting us via support email.
6. To whom do we transfer your personal data?
We may disclose all or part of your personal data to the following data recipients:
- telegram (platform provider) and our hosting provider;
- other Bot users as necessary to enable chat/matching;
- courts, other competent authorities or law enforcement agencies: the data may be disclosed in cases and according to the procedure provided for by legal acts, but only at their request and only when required by applicable legal acts or in order to make, execute or defend legal claims;
- payment service providers, when you make payments;
7. Do we collect your financial information when you make in-built purchases?
When you make in-built purchases in the Bot, we do not collect data about the payment transactions you make, and we do not have access to your payment information. This information is collected and stored by Telegram and its authorised operators. Please see Telegram’s Privacy Policy here - https://telegram.org/privacy/eu.
Some data required for the operation of these payment services is collected directly by them; we do not have access to or process such data. We recommend that you familiarise yourself with the policies of these services, which govern the collection and use of personal data.
4.15
| Third-party data processors | Personal data category | Privacy Policy |
| Tribute | ID Telegram, Purchase Data | https://tribute.tg/privacy-policy.html |
| Stripe | ID Telegram, Purchase Data | https://stripe.com/en-lt/privacy |
8. Do we transfer your personal data outside the European Economic Area (EEA)?
Our hosting provider is based in the EEA.
Telegram operates a global infrastructure; consequently, personal data exchanged with Telegram may be transferred to servers and affiliates located outside the EEA. These transfers are necessary for the performance of the service and are carried out on the legal basis of Article 49(1)(b) GDPR (necessary for the performance of the contract). For details about how Telegram processes data and safeguards transfers, see Telegram’s privacy policy: https://telegram.org/privacy/eu.
Other users of the Bot with whom the User chooses to communicate with and share certain information, may be located outside the EEA. These transfers are necessary for the performance of the service and are carried out on the legal basis of Article 49(1)(b) GDPR (necessary for the performance of the contract).
9. Do we make automated decisions, including profiling?
Automated decisions may occur for spam or abuse prevention (automatic blocking), but such decisions are subject to human review and appeal.
10. What rights do you have?
For users in the European Union
- the right of access: the right to receive confirmation whether we process personal data related to user and, if we process it, to request access to the processed personal data;
- the right to rectification: the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her;
- the right to be forgotten – under certain circumstances mentioned in the GDPR (for example, when personal data is processed unlawfully, personal data is no longer necessary for the purpose for which this personal data was collected, etc.), the user shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay;
- the right to restrict – under certain circumstances mentioned in the GDPR the right to obtain from the controller restriction of processing;
- the right to object – the right to express disagreement with the processing of personal data when we process personal data based on the legitimate interests;
- the right to data portability – the right to submit a request to transfer (receive) personal data, the processing of which is based on your consent or the performance of a contract concluded with the user, if this personal data is processed by automated means;
- the right to withdraw the consent – in cases where we process your personal data based on the user’s consent, the user has the right to withdraw his/her consent at any time and the processing of his/her personal data for the purposes that were based on user’s consent will be terminated, without prejudice to the lawfulness of the processing of personal data based on consent before its withdrawal;
- the right to lodge a complaint with a supervisory authority (see Section 11);
For residents of the Russian Federation
If you are a personal data subject from the Russian Federation, then you have the right to ensure the protection of your rights and freedoms when processing personal Data, protection of the rights to privacy, personal and family secrets, in particular, you have the right:
- require us, as an operator, to clarify your Personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as take legal measures to protect your rights;
- to receive information related to the processing of your Personal Data, including: confirmation of the fact of processing Personal Data by the operator; legal grounds and purposes of processing Personal Data; purposes and methods of processing Personal Data used by the operator; name and location of the operator, information about persons (except for employees of the operator) who have access to Personal Data or to whom Personal Data may be disclosed based on an agreement with the operator or based on Federal Law; processed Personal Data related to the relevant Personal Data subject, the source of their receipt; terms of processing of Personal Data, including the terms of their storage; information about the performed or proposed cross-border data transfer; name or surname, first name, patronymic and address of the person processing Personal Data on behalf of the operator, if processing is entrusted or will be assigned to such a person; other information;
- to protect their rights and legitimate interests, including compensation for damages and/or) compensation for moral damage in court;
For residents of Brazil
If Brazilian law applies to the processing of your Personal Data, you have the right to request from Maljoy:
- confirmation of the fact of data processing;
- access to processed data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary, redundant data or data processed in violation of the provisions of the Brazilian Data Protection Act (LGPD);
- the possibility of transferring data to another service or product provider through a direct request in accordance with the requirements of the National Data protection Authority (ANPD) and taking into account the requirements of commercial and industrial secrets;
- deletion of personal data processed with your consent;
- information about public and private organizations with which Maljoy has shared data;
- information about the possibility of refusal of consent and the consequences of such refusal;
- you can also withdraw your consent to the processing of Personal Data, object to the processing carried out on the basis of one of the situations of refusal of consent, if there is a violation of the provisions of the LGPD. We do not make decisions based solely on automated processing of Personal Data, however, in any case you have the right to review decisions made solely on the basis of automated processing of personal data affecting your interests, including decisions aimed at determining your personal, professional, consumer and credit profile or other aspects of your personality;
For residents of Indonesia
If you are a resident of Indonesia, Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi, or “UUPK” — referred to here as “UUPK” or “UU PDP”), which entered into full effect in October 2024, grants you the following rights in relation to your personal data that we process:
- right of access (Article 34 UU PDP). You have the right to request confirmation of whether we process personal data about you, and if so, to obtain access to that data, including information about the purposes of processing, the categories of data processed, and the recipients to whom your data has been or may be disclosed;
- right to rectification (Article 35 UU PDP). You have the right to request the correction of inaccurate or incomplete personal data about you without undue delay;
- right to termination of processing and deletion (Article 36 UU PDP). You have the right to request that we stop processing and delete your personal data where: (i) the personal data is no longer necessary for the purposes for which it was collected; (ii) you have withdrawn consent, and no other lawful basis applies; (iii) you have successfully objected to the processing; or (iv) the processing is unlawful;
- right to withdraw consent (Article 38 UU PDP). Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal;
- right to object to automated processing (Article 40 UU PDP). You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you. Where such processing occurs, you have the right to request human review of the decision;
- right to delay or restrict processing (Article 37 UU PDP). You have the right to request a temporary suspension of the processing of your personal data while a dispute regarding the accuracy of your data, or the lawfulness of our processing, is being resolved;
- right to data portability (Article 39 UU PDP). Where technically feasible, you have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another controller;
- right to seek compensation (Article 67 UU PDP). You have the right to seek compensation or other redress through civil proceedings if you suffer material or non-material harm arising from our failure to comply with UU PDP;
For residents of India
If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDPA”) grants you the following rights as a Data Principal in relation to your personal data that we process as a Data Fiduciary:
- right to access information about processing (Section 11 DPDPA). You have the right to request the following information from us: (i) a summary of the personal data we hold about you and the ways in which it has been processed; (ii) the identities of all Data Fiduciaries and Data Processors with whom we have shared your personal data, and a description of the personal data shared; and (iii) any other information as may be prescribed by the Central Government. We will provide this information within a reasonable period of receiving your request;
- right to correction, completion, updating, and erasure (Section 12 DPDPA). You have the right to request that we: (i) correct inaccurate or misleading personal data; (ii) complete incomplete personal data; (iii) update personal data that is out of date; and (iv) erase personal data that is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and no other lawful basis applies. We will action valid requests within a reasonable period;
- right to withdraw consent (Section 6(4) DPDPA). Where we process your personal data on the basis of your consent, you may withdraw that consent at any time. Withdrawal of consent is as easy as giving consent. After withdrawal, we will cease processing your personal data unless another lawful basis under the DPDPA applies. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal;
- right to grievance redressal (Section 13 DPDPA). You have the right to have your grievances regarding our processing of your personal data addressed promptly. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India (see below);
- right to nominate (Section 14 DPDPA). You have the right to nominate any other individual to exercise your data rights in the event of your death or incapacity. To register or update your nomination, please contact us at privacy@maljoy.io;
- children’s personal data (Section 9 DPDPA). We do not knowingly process the personal data of children (persons under 18 years of age) without obtaining verifiable consent from their parent or lawful guardian. We also do not engage in the tracking or behavioural monitoring of children, or target advertising at children, through the Service. If you are the parent or guardian of a child and believe we may have processed your child’s personal data without appropriate consent, please contact us immediately at privacy@maljoy.io;
- how to exercise your rights. To exercise any of the rights listed above, please contact us at privacy@maljoy.io. We will respond to your request within a reasonable period and, in any event, within thirty (30) days. We may need to verify your identity before processing your request;
For residents of the Republic of Turkey
The Personal Data Protection Act No. 6698 (“DPL”) contains the rights of data subjects accessing services from the Republic of Turkey. You have the right to contact the data controller in order to:
- find out if your personal data is being processed;
- request information about whether your personal data has been processed;
- find out the purpose of processing your personal data and whether this personal data is used in accordance with the purpose;
- know the third parties to whom your personal data is transferred in the country or abroad;
- request correction of incomplete or inaccurate data, if any;
- request the deletion of your personal data in accordance with the conditions specified in Article 7 of the DPL;
- request reporting on transactions carried out in certain cases from third parties to whom your personal data has been transferred;
- independently object to the occurrence of a result in relation to this person by analysing data processed exclusively using automated systems;
- claim compensation for damages resulting from the illegal processing of your personal data;
- to exercise his/her rights or for privacy questions, the User can contact: privacy@maljoy.io;
11. Contact the data protection authorities
For residents of the European Union: If you live in the European Union and believe that we are illegally processing your personal data, you have the right to file a complaint with the local data protection supervisory authority. You can find contact information here: https://www.edpb.europa.eu/about-edpb/our-members_en.
For residents of the Russian Federation: if you believe that your rights are being violated, you can contact the Authorized Body for the Protection of the rights of personal data subjects – Federal Service for Supervision of Communications. You can find contact information at: https://rkn.gov.ru/contacts /.
For residents of Brazil: if you believe that our interaction with your personal data violates applicable law, you can send a corresponding request to the Brazilian Data Protection Authority (ANPD).
For residents of Indonesia: If you are located in Indonesia and believe that our processing of your personal data violates UU PDP or other applicable Indonesian law, you have the right to lodge a complaint with the competent supervisory authority. Until the dedicated Personal Data Protection Authority (Lembaga Pelindungan Data Pribadi) referred to in Article 58 of UU PDP has been formally constituted and made operational by the Indonesian Government, complaints regarding personal data processing may be directed to the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, “Komdigi”), formerly the Ministry of Communication and Information Technology (Kominfo): https://www.komdigi.go.id. Complaints portal: https://aduankonten.id
For residents of India: If you are located in India and believe that our processing of your personal data violates the DPDPA or other applicable Indian data protection law, you have the right to lodge a complaint with the Data Protection Board of India (https://dpboard.gov.in). Under Section 13(2) of the DPDPA, before lodging a complaint with the DPBI, a Data Principal must first allow the Data Fiduciary to resolve the grievance.
Accordingly, we encourage you to contact us first at privacy@maljoy.io so that we can attempt to resolve your concern directly. If you are not satisfied with our response, you may then escalate the complaint to the DPBI.
For residents of the Republic of Turkey: if you believe that your rights are being violated, you can contact the Office for Personal Data Protection. You can find contact information here: https://www.kvkk.gov.tr/Icerik/6655/Contact-Us.
12. Is my personal data sold to any third parties?
No, we do not sell the personal data of Bot users to any third parties and have never attempted to sell any personal data.
13. Changes to this Privacy Policy
We’ll do our best to communicate the changes to this Privacy Policy through the Bot or Service. However, we encourage you to review this Privacy Policy periodically to stay aware of the most recent version. Your continued use of the Bot or Service after any modifications thereto constitutes acceptance of the updated Privacy Policy.