What Nicegram Business holds, where it sits, and who else touches it
Specific enough to be checked, because it is written from how the system actually works rather than from a template.
This statement describes how Nicegram Business handles data. The data processing agreement a customer signs is the binding document, and where the two differ the agreement governs.
Last updated
- 01Who is who
- 02What is collected
- 03How long it is kept
- 04Where it sits
- 05The exception to that, stated beside it
- 06Who else processes it
- 07How it is protected
- 08The employee's side
- 09Deletion and requests
- 10When it ends
- 11If something goes wrong
Who is who
For a customer's business accounts, the customer is the controller and Nicegram is the processor. Nicegram is a controller only for its own account and billing records. A counterparty who talks to a managed account is a data subject, and their rights are exercised through the customer or directly with us.
What is collected
Messages and their metadata, chat and contact records, the media itself, session and access events, and the analytics aggregates derived from them. For a connected personal account, only the chats the employee explicitly shared: a chat outside that selection is never fetched, so it can never be indexed, retrieved or cited.
How long it is kept
Two different numbers. History depth is how far back the first import walks, ninety days by default. Retention is how long we keep what was imported: thirty days for every organization, counted from the moment of import rather than from when the message was written. Quoting one without the other is misleading, so both are always stated.
Where it sits
The archive, the session vault and the stored media are hosted in a European region on DigitalOcean. Because DigitalOcean is a United States provider, the transfer relies on Standard Contractual Clauses and a transfer impact assessment.
The exception to that, stated beside it
Transactional email metadata does not stay in the European Union. Our email provider stores account data, email metadata, logs and API records in the United States regardless of the sending region. What crosses is recipient addresses, subject lines, timestamps and delivery events. What never crosses is message content, which is a hard rule in the system rather than a policy preference.
Who else processes it
Number and SMS supply for provisioned accounts. Model providers, on no-training terms, for the message content sent for search and analysis. The hosting provider, for compute, the database and file storage. The transactional email provider, for the alerts that warn an owner collection has stopped. Separately from any of that, this public website measures which parts of it get used, through Google Analytics and only after you allow it; that measurement never touches an organization's archive and is not part of the processing described above. You can change or withdraw that answer at any time from Cookie settings at the foot of every page, and withdrawing stops the measurement and deletes its cookies. Adding a subprocessor requires customer notice under the agreement.
How it is protected
Data is isolated per organization and every query carries that scope. Sessions are encrypted and stay on the backend; nobody is handed one. Stored media is encrypted before it is written, with a key belonging to that organization. Backups and export artifacts in file storage carry no additional at-rest encryption, and are protected by credential control and an enforced expiry, which we would rather write down than leave you to assume.
The employee's side
Consent is recorded before an account is connected, and it is a gate rather than a step. Every managed employee has a standing page showing which of their accounts are collected, since when, how long it is kept and what disconnecting does. It gives them knowledge rather than a veto over data already collected, and it says so in those words.
Deletion and requests
A data subject request runs an erasure cascade across messages and their versions, embeddings, graph edges, index rows and stored media objects. Immutable daily aggregates survive as counts with no bodies, and that is stated at the point of confirmation rather than discovered afterwards. A message deleted inside Telegram is not deleted here; removing it from the archive is a separate act only an owner can take.
When it ends
On the last day sessions end and the archive is deleted rather than kept in case the customer comes back. The agreement carries the clause; this page carries the intent.
If something goes wrong
A personal data breach triggers notification to the supervisory authority within seventy two hours, and to affected data subjects where the risk requires it.
Questions, or a data subject request: contact@nicegram.ai