Privacy Policy

Last updated: 6 November 2026

This policy covers the GRAMSHIP website, Dashboard, connected AI assistants and hosted Telegram bot service. Features are being introduced during early access; availability is shown in the Dashboard.

1. Who is responsible

GRAMSHIP is a product of LEMMA, operated by Konstantin Prokhorov. For privacy questions or requests, email hello@lemma.company.

2. Information we process

• Your account. Telegram user ID, display name and username, sign-in verification data, sessions and the AI connections you authorize. Ordinary accounts do not require an email address or password. We do not request your phone number.
• Your projects. Generated source, version history, bot descriptions, configuration, connected bot identity and management credentials, execution state, diagnostic codes and usage counters.
• Bot interactions. Telegram sends events addressed to your connected bots, including messages, callback selections, sender and chat identifiers and any supplied media metadata. We process these events to run your bot and send its replies. GRAMSHIP records conversation text, callback selections, media metadata and delivery results for the bot owner to view in the Dashboard. Media files are not copied into conversation history. Your bot code may also keep information in persistent state. When an owner configures an HTTP integration, the bot can send its programmed request payload to that endpoint. The owner is responsible for describing that use and selecting an appropriate service. Integration configuration and project secrets are encrypted and withheld from AI tools and generated bot code. If you bind a secret to an HTTP integration, GRAMSHIP sends it as the authentication header to the endpoint you select. Choose a service you trust. Replacing a secret affects a running bot after you test and publish its configuration; revoke compromised credentials with the issuing service. Connecting GRAMSHIP does not grant access to your personal Telegram chat history.
• AI requests. When enabled, source and descriptions are checked for abuse. When a bot calls AI, its configured prompt and the content it submits are processed by OpenAI, along with generated responses for moderation. Your AI assistant separately processes the information you give it and receives project information through the tools you authorize. Secret values are not returned through MCP.
• Payments, when enabled. Telegram identity, selected plan, Stars amount, invoice and transaction identifiers, subscription status and expiry. Payment authorization occurs through Telegram; GRAMSHIP does not receive card details.
• Service and contact data. IP addresses, request paths, timestamps, response codes and browser information used for operations and abuse prevention; correspondence you send by email or Telegram.

3. Cookies and third-party components

The Dashboard uses essential secure cookies for sign-in and sessions. The session expires after seven days; a sign-in challenge expires after five minutes. Telegram login and Mini App scripts are loaded from Telegram. We do not use advertising trackers or third-party analytics. Following links or using Telegram or your AI assistant is also subject to their own privacy policies.

4. Purpose and legal basis

We process information to authenticate you, provide your projects and authorized connections, execute bot behavior, enforce usage limits, handle payments where available and respond to requests. Where a legal basis is required, this includes performing our agreement with you, legitimate interests in securing and maintaining the service, complying with legal duties and consent where required.

Bot creators are responsible for the information their bots collect and must tell their users how it will be used. Do not use GRAMSHIP to collect passwords, authentication tokens, payment card information, government identifiers or sensitive health information.

5. Providers and disclosures

GRAMSHIP is hosted with Veesp in the Netherlands. Telegram provides identity, bot messaging and Stars payment services. OpenAI processes moderation and bot AI requests when those functions are enabled. Email and other communication providers process correspondence. A connected AI client receives the project information returned by your authorized tool calls. Conversation content is available to connected AI assistants only after the project owner enables AI history access in Chats. Owners can disable that access at any time. Broadcast text is processed for moderation and sent to the confirmed audience through Telegram.

Some providers may process data outside your country. Applicable provider terms and transfer arrangements depend on the service involved; contact us for information about your use case. We may disclose information when legally required or necessary to investigate abuse or protect rights. We do not sell personal data.

6. Retention

Accounts, project versions, configuration and persistent bot state remain until deleted or until a retention request is processed. You can delete projects in Settings and revoke AI connections in the Dashboard. Contact us to request account deletion or an export.

Processed message-queue payloads are cleared after handling; completed incoming queue records are retained for up to seven days, and application diagnostic events for up to fourteen days. Unprocessed events remain queued until handled or failed. Expired sign-in records are cleaned periodically. Usage and payment records may be retained to operate billing, prevent abuse, resolve disputes or satisfy legal obligations.

Conversation messages, completed outgoing delivery records and broadcast drafts/results are retained for up to 30 days, with periodic cleanup. Chat identity metadata and broadcast preferences remain until the project is deleted. Recipients may send /stop to the bot to stop broadcasts and /subscribe to resume them.

Deployment backups may contain an earlier copy of stored data and are restricted to service administration. Deleted information may remain in a backup until it is replaced or removed. Correspondence is retained for as long as reasonably needed to handle your request and legal duties.

7. Security

GRAMSHIP uses HTTPS, access controls and encrypted storage for bot management tokens and project secrets. Generated code runs in a restricted execution environment. These safeguards reduce risk but do not guarantee that any service is immune to security incidents. Do not send credentials in chats or general support enquiries.

8. Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete or receive your data, restrict or object to processing, withdraw consent where relevant and complain to a data protection authority. Email hello@lemma.company; we may need limited information to verify your identity. For information collected by a bot, contact its creator as well so they can address their use of your data.

9. Updates

We will update this policy as the service changes. The date above identifies the current version. Product illustrations on the landing page remain design previews and do not imply that every proposed feature is available.