Version of 5 November 2026. Service owner — the hotelpro.uz project (legal details to be added).
1. What data we receive
Your Telegram profile: ID, name, username, language.
The mailbox you connect: e-mail address, server settings and password (usually an "app password").
Your e-mail: headers and text of new messages (to write summaries), your commands, drafts.
Voice commands (if you use them) — to convert them to text.
Technical data: number of AI calls and tokens (for plan limits), an action journal.
2. AI processing (USA)
E-mail text, your commands and drafts are sent via API to the Claude model of Anthropic PBC (USA) to produce summaries,
replies and agent actions. Under Anthropic's terms, data sent through the API is not used to train models. Card and passport
numbers are masked before sending. Voice messages, depending on configuration, are sent for transcription to Yandex SpeechKit
(Yandex Cloud) or OpenAI (USA).
3. Where and how it is stored
Data is stored on servers in Europe.
Mailbox passwords, e-mail subjects and summaries, drafts — encrypted with AES-256-GCM.
We do not store full e-mail bodies — they are read from your mail server when needed.
E-mail records and drafts are deleted automatically after 30 days, the journal after 90 days.
Never type your password in the chat: it is entered only in the «Connect mail» window (Telegram Mini App).
4. What we do not do
We do not sell your data and do not share it for advertising.
We do not send e-mail without your consent (a button press).
We never delete e-mail permanently: "delete" means moving it to Trash.
5. Deletion
The /uzish command in the bot immediately deletes all your data (mailboxes, passwords, summaries, drafts, rules, journal,
settings). A single mailbox can be disconnected via /pochtalar. Only payment records required by law (amount, date, plan) and a
one-way marker that the free trial was used (an HMAC of the Telegram ID, not the ID itself) are kept.
6. Third parties
Telegram (messaging), Anthropic (AI), the selected speech-recognition service, the payment provider (Click) and the hosting
provider. Each receives only the data required to provide the service.