Privacy Policy

This is an English translation of the Ukrainian original, provided for convenience. If the two versions differ, the Ukrainian version prevails.

1. General provisions

1.1. This Privacy Policy (the “Policy”) explains what personal data the Vikonce service (the “Service”) processes, for what purpose and on what legal basis, how long it is kept, who receives it, and what rights the people whose data is processed have.

1.2. The Service is an AI receptionist for businesses in messengers: Telegram bots that answer a business’s clients and book them for services, online booking pages of businesses at booking.vikonce.org, an admin panel in Telegram and a web admin panel for the business owner and staff, and the website vikonce.org.

1.3. The controller of personal data within the meaning of the Law of Ukraine “On Personal Data Protection” is Pavlo Viacheslavovych Stoichev, an individual (“Vikonce”, “we”). Contact us on any personal data matter: vikonce.support@ukr.net, +380 95 560 36 71.

1.4. This Policy applies to:

• visitors of the website vikonce.org;
• businesses that use the Service (“Customers”), their owners and staff who have access to the admin panel;
• people who write to Customers’ bots or book on Customers’ online booking pages (“Customer’s clients”).

1.5. The rules for using the Service are set out in the Terms of Use.

1.6. Personal data is processed in accordance with the Constitution of Ukraine, the Law of Ukraine “On Personal Data Protection”, the Law of Ukraine “On Electronic Commerce” and other laws of Ukraine. If the EU General Data Protection Regulation (GDPR) applies to you, you also have the rights it provides.

2. Vikonce’s two roles

2.1. For the data of website visitors, Customers and their staff, Vikonce is the controller and decides on the purposes and means of processing.

2.2. For the data of a Customer’s clients, the controller is the Customer, the business the person wrote to. The Customer decides what the data is for: booking a service, reminding about a visit, answering a question. Vikonce is a processor in this case: it processes the data only on the Customer’s instructions and only to provide the Service to that Customer. The terms of such processing are set by the agreement between Vikonce and the Customer.

2.3. If you are a Customer’s client and want to exercise your personal data rights, the shortest way is to contact the business you wrote to. You can also write to us at vikonce.support@ukr.net: we will pass your request on to the Customer and help fulfil it.

3. What data we process

3.1. Website visitors

3.1.1. The website has no registration forms and does not collect contact details. It sets cookies only with your consent, for Google Analytics statistics (clause 3.1.2).

3.1.2. Anonymous visit statistics are provided by Cloudflare Web Analytics. It sets no cookies and creates no device identifiers; we only see totals: page views, pages, countries, device types.

If you click “Accept” in the consent banner, Google Analytics (Google LLC) also runs on the website. It receives a random browser identifier from a cookie, the pages you viewed, the page you came from, link clicks, device and browser type, language and approximate location (country, city) derived from the IP address; Google Analytics does not store the IP address itself. We only see aggregated reports and do not link them to your name or contact details. Google signals for advertising and ad personalisation are turned off. Without your consent Google Analytics is not loaded, and you can withdraw consent with the “Cookie settings” button at the bottom of any page of the website.

3.1.3. The website is hosted on Cloudflare’s infrastructure, which processes technical request data (IP address, browser type, time of the request) to deliver pages and protect against attacks, under its own privacy policy.

3.1.4. If you go from the website to Telegram (the demo bot or the start bot), Telegram’s rules and section 3.3 of this Policy apply from there.

3.2. Customers and their staff

To run the admin panel we process:

• the Telegram user ID, name, username and profile photo link, which Telegram itself provides when you sign in with Telegram;
• a phone number and password, if the person set them for signing in; the password is stored only as a cryptographic hash;
• the staff member’s role, access rights and working schedule within the business;
• sign-in session data: a hash of the session token, the sign-in method, the date, the browser type;
• the admin panel action log: who changed what and when;
• the browser notification subscription address, if the person turned notifications on;
• a temporary counter of failed sign-in attempts (IP address, phone number), kept only in the server’s memory for up to 15 minutes and never written to disk;
• the application in the start bot: the business name and niche, the plan, the number of specialists and locations, a contact phone number, and the price list if it was sent;
• correspondence with the start bot, including replies generated by an artificial intelligence model, and with us about onboarding, payment and support;
• subscription payment details: the amount, the date, what was paid for, and a screenshot of the transfer if one was sent.

3.3. A Customer’s clients

When a person writes to a Customer’s bot or books on the Customer’s online booking page, we process:

• the Telegram user ID, name and username, and the language of communication;
• the phone number, if the person provided it;
• on the online booking page: the name and phone number the person entered in the form, optional wishes for the visit, and for a car service, the car’s make and model; the page does not verify the phone number;
• where a booking from the page came from (Instagram, a QR code, Google Maps), if the person followed such a link;
• technical request data for the online booking page (IP address), to prevent abuse; the request rate counter is kept only in the server’s memory for up to one hour and never written to disk;
• the text of the conversation with the bot, including transcripts of voice messages, and with the AI assistant on the online booking page; the audio itself is not stored;
• bookings: the service, date and time, specialist, location, booking status, history of visits, cancellations and no-shows;
• marks that a conversation was handed over to a human receptionist, and the reason;
• technical statistics of AI model usage (the number of tokens per request).

4. Purposes and legal bases

4.1. We process personal data only to:

• provide the Service: answer a client, book them, remind them of a visit, show bookings and conversations to the Customer;
• enable signing in to the admin panel, separate access rights and protect accounts against unauthorised access;
• provide support, issue invoices and perform the agreement with the Customer;
• monitor the stability and cost of the Service and fix errors;
• comply with the law.

4.2. Legal bases (Article 11 of the Law of Ukraine “On Personal Data Protection”):

• concluding and performing an agreement to which the data subject is a party or which is concluded in their interest, for Customers and their staff;
• the data subject’s consent: a Customer’s client voluntarily writes to the bot or fills in the form on the online booking page and decides what data to share; consent can be withdrawn by contacting the Customer or us;
• a website visitor’s consent: for Google Analytics statistics; it can be withdrawn with the “Cookie settings” button at the bottom of a page of the website;
• the controller’s legitimate interest: the security of the Service, prevention of abuse, anonymous website statistics;
• performance of a duty provided by law.

4.3. We do not sell personal data, do not use it for advertising and do not transfer it to third parties for their own purposes.

4.4. The bot’s replies are generated automatically by an artificial intelligence model based on the information the Customer provided. The Service makes no decisions with legal consequences for a person: a visit can be booked, moved or cancelled only on the person’s own command in the chat or on the online booking page, and the Customer’s human receptionist can review the conversation and step in at any time.

5. Who receives the data

5.1. We use the following providers to run the Service. Each receives only the data without which its part of the work is impossible:

5.2. AI models receive the conversation text to the extent needed for a reply and do not receive encryption keys or other databases. We use the Gemini API on paid terms under which Google does not use prompts and responses to train its models.

5.3. Data may be provided to public authorities only in the cases and in the manner expressly provided by law.

5.4. A Customer’s client data is seen by the Customer and by those of its staff to whom the Customer granted the relevant rights. Each Customer’s data is kept in a separate database and is not available to other Customers.

6. Cross-border transfer

6.1. The Service’s server is located in the USA, and the providers in section 5 process data outside Ukraine. Transfers are made in accordance with Article 29 of the Law of Ukraine “On Personal Data Protection” for the purpose of providing the Service, under agreements with the providers and with the safeguards described in section 8.

6.2. By using the Service, the Customer and its staff agree to such transfer. The Customer, as the controller of its clients’ data, must inform its clients about it.

7. Retention periods

7.1. After the agreement ends, the data of the Customer and its clients is deleted within 30 days, unless the Customer earlier asked to export it or to delete it immediately. Backups containing it disappear when the period above expires.

7.2. Correspondence with us about the agreement and payment is kept as long as accounting and tax laws require.

8. How we protect data

• phone numbers and conversation texts are encrypted in the database with a separate key for each Customer;
• each Customer works with a separate database;
• connections to the website and the admin panel are made only over HTTPS;
• passwords and session tokens are stored only as hashes; so are the secret of a “My booking” link from the online booking page (the link opens only the bookings made through it) and the secret of a conversation with the AI assistant on that page;
• access rights are checked on the server for every action, not only in the interface;
• in backups on the server, phone numbers and conversations stay encrypted, and the off-server backup is fully encrypted with a key that is neither on the server nor next to the backup;
• technical logs contain no message texts, and phone numbers in them are masked;
• only Vikonce has access to the server.

No method of transmission or storage is absolutely secure, but we apply measures that are reasonable for the nature of the data and the risks. We notify the Customer of an incident affecting its data without undue delay and no later than 72 hours after becoming aware of it.

9. Your rights

9.1. Under Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to:

• know who processes your data, how, why, and where it is stored;
• access your data;
• have inaccurate or outdated data corrected;
• have data deleted or its processing stopped if the processing is unlawful or no longer needed;
• withdraw consent to processing;
• object to processing;
• know about transfers of data to third parties;
• complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

9.2. To exercise your rights, write to vikonce.support@ukr.net. We will reply within 30 calendar days of receiving your request. To protect your data, we may ask you to confirm that the request is yours, for example by writing from the same Telegram account.

9.3. A Customer’s client can stop talking to the bot or block it in Telegram at any time. This stops new messages but does not delete data already stored: to have it deleted, contact the Customer or us.

10. Cookies and local storage

10.1. The website vikonce.org sets Google Analytics cookies only with your consent. The online booking pages set no cookies. The web admin panel uses one strictly necessary session cookie, without which signing in is impossible. We use no advertising cookies.

10.2. The full list of cookies and local browser storage, and of the third-party services working on our pages, is in the Cookie Policy.

11. Children

The Service is intended for businesses and is not aimed at children. We do not knowingly collect data of persons under 14. If you believe such data has reached the Service, write to us and we will delete it.

12. Changes to this Policy

We may change this Policy when the Service or the law changes. The current version is always published on this page with the date of the last update. We notify Customers of material changes in advance by email or in Telegram.

13. Contacts

On personal data matters: vikonce.support@ukr.net, +380 95 560 36 71.