Privacy Policy

Last updated:

This page explains how ai.topsmm.uz (an AI customer-service assistant operating over Telegram, Instagram, Facebook Messenger and a web widget, hereinafter the "Service") collects, uses, stores, and protects personal data. The Service is owned and operated by TOPSMM LLC. Using the Service (connecting as a business owner, or messaging as a customer) constitutes acceptance of this policy.

1. What data we collect

• Cabinet owners (businesses): email, name, password (stored hashed with bcrypt, never in plain text), business name.
• Customers (end users): message text sent via Telegram/Instagram/Messenger, the user's platform-provided ID/username, and any image/audio/video files sent (used for AI analysis).
• For the Instagram integration (Meta Platform Data):
  • Instagram Business/Creator account ID and username;
  • connected Facebook Page ID and name (when connected via that method);
  • page/account access token (stored encrypted in our database);
  • Direct message text;
  • post/reel comment text and the commenter's ID.
  This data is used SOLELY to generate AI customer-service replies and manage comments. Instagram Insights (analytics) is not currently collected by the Service.
• Payment receipts: screenshots uploaded to top up an account balance — kept only to confirm the payment.

2. How we use the data

• To generate automatic AI replies to customer messages, including Instagram Direct messages and comments.
• To show the business owner their own customers' message history (in the cabinet).
• To improve service quality, detect errors, and maintain security.
• To confirm payments and maintain the account balance.

3. AI provider and third parties

Customer message text (and any image/audio, where applicable) is sent to Google Gemini API (Google LLC) to generate a reply. Meta Graph API is used to send/receive Instagram Direct messages and comments; Telegram Bot API is used for Telegram messaging. Data is NEVER sold for advertising purposes or rented out to third parties.

On AI model training: how Google uses data sent through the Gemini API (including whether it is used to train models) is governed by Google's own API terms, not by this Service — this depends on the agreement in place with Google, not on the Service itself. See: Google Gemini API Additional Terms of Service.

4. Data retention and deletion

Message history is retained until the business owner deletes their account, or per the following: Message history: 24 months after the last activity. Instagram/Facebook access tokens: deleted from our database immediately when the connection is removed ("Disconnect Instagram" in the cabinet). Accounting/tax records (payment receipts and transactions) are kept for the period required by Uzbekistan law. See the Data Deletion page for the full procedure.

5. Security

Sensitive data (bot tokens, Instagram/Facebook access tokens) is stored encrypted in our database using AES-256-GCM (authenticated encryption). Passwords are hashed with bcrypt. Cabinet sessions are protected via httpOnly cookies. Every Instagram/Facebook webhook request is verified via a cryptographic signature (X-Hub-Signature-256).

6. Your rights and revoking access

You have the right to access, correct, or request deletion of your data. You may disconnect Instagram at any time from the cabinet (or from your Instagram/Facebook settings). The full deletion procedure is on the Data Deletion page.

7. Contact

Service owner: TOPSMM LLC. For privacy questions: support@topsmm.uz