Privacy Policy

1. Controller and contact

The controller is Valentin Chmara, Entrepreneur individuel, SIREN 904 613 536, 457 route de Relevant, 01400 Châtillon-sur-Chalaronne, France. For privacy questions or to exercise your rights, contact valentin@telegram-finder.io. No data protection officer has been appointed.

2. Data we process, purposes, and legal bases

Required account and payment fields are necessary to enter into or perform the contract. Without them, we cannot create the account or complete the purchase. Other fields are optional unless identified otherwise in the interface. We do not use personal data for solely automated decisions producing legal or similarly significant effects.

3. Data concerning people searched by our users

A user may submit data about another person. That data may come from the user, Telegram, LinkedIn-related input, or enrichment providers. Depending on the feature and circumstances, the user may be an independent controller and Telegram Finder may process the data on that user’s behalf, or Telegram Finder may act as controller for operating and securing the matching service. If you believe your data appears in the Service, contact us to obtain information, object, or request restriction or deletion. We may ask for proportionate evidence of identity and of the identifier concerned.

4. Recipients and processors

Access is limited to authorized persons and providers that need the data for the purposes above, including:

• Supabase — authentication, database and storage;
• Stripe — payments, billing, fraud prevention and subscription management;
• Vercel — website and server hosting, delivery and operational logs;
• Databuddy — cookieless, anonymous website analytics and performance measurement;
• TinyAdz — consent-based sponsored-content delivery, measurement and advertising fraud prevention;
• Google AdSense — consent-based advertising delivery, personalization, measurement and fraud prevention;
• Telegram — account connection and lookup features;
• Lemlist and Zeliq — contact enrichment where the relevant feature is requested.

We do not sell personal data. We may disclose data where required by law, to establish or defend legal claims, or during a business reorganization subject to appropriate confidentiality and data-protection safeguards.

5. International transfers

Some providers operate outside the European Economic Area, particularly in the United States. Transfers are protected, as applicable, by an adequacy decision (including the EU–US Data Privacy Framework for participating organizations), the European Commission’s Standard Contractual Clauses, and supplementary measures. Contact us for information about the safeguard relevant to a particular recipient and a copy of it, with commercially confidential information redacted where necessary.

6. Retention

• Account and saved-contact data: while the account is active, then deleted or anonymized after account closure, subject to backups and legal claims;
• Inactive accounts: reviewed and ordinarily deleted after two years of inactivity, after advance notice where practicable;
• One-off search and enrichment data: only for the time needed to return, secure and troubleshoot the result, unless the user saves it as a contact or it is required for fraud prevention;
• Telegram sessions and tokens: until revoked, disconnected, expired, or the account is deleted;
• Security, API and error logs: normally no longer than 12 months, unless needed to investigate an incident or legal claim;
• Anonymous analytics data: according to the Databuddy configuration and retention schedule, for no longer than 25 months;
• Advertising data: according to TinyAdz’s and Google AdSense’s applicable retention schedules; the website’s advertising choice lasts for the browser session unless withdrawn earlier;
• Support and complaint records: up to five years after closure of the request where needed to establish or defend claims;
• Invoices and accounting records: ten years to comply with French law;
• Consent or objection evidence: for the applicable limitation period.

Backup copies are isolated and deleted on the provider’s normal rotation schedule. Data may be retained longer where a legal hold applies.

7. Cookies, advertising and similar technologies

Strictly necessary storage supports authentication, security, payment flow and preferences and does not require consent. Databuddy does not set tracking cookies or create cross-site profiles. It processes anonymous usage events, immediately discards raw IP addresses after deriving country or region, and may use local or session storage for anonymous session operation. Any other non-essential terminal storage or access will be activated only after consent where required by Article 82 of the French Data Protection Act. Where consent is required, you can accept or withdraw it at any time. Free sponsored access and paid ad-free access are presented as separate choices.

Free users are shown sponsored content across the website when they choose “Use free with sponsors.” TinyAdz and Google AdSense are disabled until that choice is made. If enabled, their scripts may use cookies or local storage, load advertising and fraud-detection frames, and process page, device and interaction signals to select, display, measure and protect advertisements. Search inputs and returned Telegram profile fields are not intentionally supplied to either advertising provider. Premium members and users with an active credit pack are not shown sponsored content. You can use “Withdraw ad consent” in the website footer at any time; the page reloads so the advertising script is no longer active.

8. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction, objection (including to processing based on legitimate interests and at any time to direct marketing), and data portability. Where processing relies on consent, you may withdraw it at any time without affecting earlier processing. You may also define instructions concerning your data after death under French law.

Send a request to valentin@telegram-finder.io. We normally respond within one month. We may request only the information reasonably necessary to verify identity. You may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or with your local EEA supervisory authority.

9. Security

We use proportionate technical and organizational safeguards, including encrypted transport, access controls, authentication, database row-level controls, rate limiting, logging, and provider security measures. No system is completely secure; please protect your password, API key and Telegram session and report suspected compromise promptly.

10. Children and changes

The Service is not directed to children and accounts are restricted to adults. If we learn that a child provided data directly, we will take appropriate steps to delete it. We may update this Policy to reflect legal or operational changes. Material changes will be brought to account holders’ attention before they take effect where appropriate; the effective date above identifies the current version.