Privacy policy

Who runs the service

The data controller is Pavel Ulitin, sole proprietor, tax number 732812384867, Russia. WidgetChat is a BOZEX service.

Write to info@bozex.ru about anything related to personal data: the same address takes requests to correct, block or delete data and to withdraw consent.

The controller is listed in the Roskomnadzor register of personal data operators under number 34-26-045552.

Where this policy applies

It covers widgetchat.ru, the dashboard, the api.widgetchat.ru gateway, the chat widget on customer sites, the WordPress plugin, the amoCRM application, the service bots in Telegram and the public API.

The service takes messages from site visitors, brings them to the operator in Telegram or a CRM, and returns the reply into the chat window on the site.

Who is the controller of what

For the data of account owners, their staff and the visitors of widgetchat.ru itself, we are the controller.

Conversations that happen on your site we process on your behalf: there you are the controller and we are the processor. Telling your visitors about the chat and about the data it passes on is your job, in your own privacy policy.

What data is processed

• Account Email address, name, sign-in identifiers from Yandex, VK or Telegram, the list of connected sites and the widget appearance settings.
• Connection keys Bot tokens and channel keys that the owner entered in the dashboard. They are stored encrypted and are never returned to the outside.
• Conversations Message text, attached files and screenshots, voice messages and their transcripts, read marks.
• Chat visitor The identifier the widget keeps in the browser so that a returning visitor sees their own history; the address of the page they wrote from; the IP address and browser details.
• Messages from marketplaces and messengers The name or nickname in that channel, the ticket or order number, the phone number, exactly as the channel itself sends them.
• Technical logs Date and time of actions, errors, security events, request identifiers.

Why

• To deliver the message Carry the message from the visitor to the operator and bring the reply back into the chat window.
• To show the history A returning visitor sees the earlier conversation, and the operator sees one thread instead of scattered fragments.
• To notify Sound, unread counter and the tab title in the browser, notifications in Telegram.
• To support and to fix Handle the account owner's request to our support and find the cause of a fault.
• To protect the service Cut off abuse, key guessing and load that gets in the way of other customers.
• To comply with the law Answer lawful requests from authorities.

What we do with the data

Collection, recording, organising, accumulation, storage, correction, retrieval, use, transfer (provision and access) in the cases listed in the section on recipients, blocking, deletion and destruction.

Processing is automated: the data passes through the service servers and travels over the internet on encrypted connections. We take no decisions with legal effect for a person based on automated processing alone.

On what grounds

The account owner's data is processed to perform the contract with them, that is the terms of use. The conversations of their site visitors we process on their instructions, as a processor.

Analytics on widgetchat.ru runs only after the consent given in the cookie banner; refusing it does not prevent you from using the site or the dashboard.

Who receives the data

Only the services without which the message would not arrive: Telegram, so that the operator receives it and replies; WhatsApp (Meta), MAX, Wildberries and the site owner's CRM, if that channel is connected.

Widget texts (greeting, button labels, hints) that the account owner translates with the button in the setup wizard are sent for translation to OpenRouter (USA), Google Gemini model. Visitor conversations are never sent there. If the greeting contains an operator's name, the name goes along with the text.

Voice messages are transcribed by our own service on our servers in Russia, and the recording is not kept afterwards. Sign-in emails are sent by our own mail server mail.bozex.ru.

We do not sell data, do not pass it to advertising networks and do not use conversations to train models. Apart from the channels listed above and cases directly required by law, conversations go nowhere.

Where the data is stored

The service databases are hosted on servers in Russia. Part of the technical infrastructure (the Telegram gateway and the attachment storage) runs on servers in Germany, so a cross-border transfer takes place.

In both cases the recipient is the service's own infrastructure, not an outside company.

How long it is kept

• Conversations and attachments Until the site owner asks us to delete the site: deleting it on request to info@bozex.ru deletes its conversations.
• Account data While the account exists; after deletion up to thirty days, until backups expire.
• Technical logs Up to twelve months; security event records up to three years.
• Backups No longer than thirty days; what was deleted is not restored from them.

How the data is destroyed

Data is destroyed once the purpose is achieved, the retention period ends, the person withdraws consent or asks for deletion, or the processing turns out to be unlawful: within 30 days, and within 10 working days for unlawful processing (article 21 of Russian law 152-FZ).

Records are removed from the working databases irreversibly and leave the backups when those expire, within 30 days. Each destruction is confirmed by a record, as required by Roskomnadzor order No. 179.

Cookies and analytics

The widget keeps a technical identifier in the visitor's browser: without it there is no way to show a person their own conversation on the next visit. That is a technical necessity and needs no separate consent.

Yandex Metrica runs on widgetchat.ru. It starts only after the visitor accepts analytics in the cookie banner; before that the counter is not loaded at all.

Security measures

Under articles 18.1 and 19 of law 152-FZ a person responsible for data processing is appointed; database access is granted by role only to those who need it for their work; keys and tokens are stored encrypted; actions with data are logged; software is kept up to date and backups are verified.

Database access is closed, keys and tokens are stored encrypted, and traffic between the widget, the gateway and the channels goes over TLS. Staff access to conversation content happens only on the account owner's request and only to fix a fault.

If a breach affects customer data, we inform the account owner and the supervisory authority within the time limits set by law.

Your rights

You may ask which of your data is processed, have inaccurate data corrected and unnecessary data deleted, withdraw your consent and complain to the supervisory authority or to a court.

Send the request to info@bozex.ru; we answer within 10 working days, or, if more time is needed, within 5 more working days and we tell you why. If the request concerns a conversation on someone else's site, we forward it to the owner of that site: there they are the controller.

• Terms of use

Children

The service is not meant for children and does not knowingly collect their data. We do not ask for special categories of data or biometrics; if such details end up in a conversation by accident, they are used for nothing except answering that message.

Changes to this policy

The page carries a version date. Significant changes are announced in the dashboard; continuing to use the service after the announcement means you accept the new version.