Privacy Policy

This policy explains what data Inkwell collects and how we use it: to run the service, keep it secure, and improve our products, including training our AI models. The website itself has no tracking.

1. Who we are

Inkwell (“Inkwell”, “we”, “us”) operates inkwellchat.com (the website) and app.inkwellchat.com (the app), together “the service”. For questions about this policy or your data, contact us at [email protected].

By using the service, you acknowledge that your data will be handled as described in this policy.

2. Our roles

We handle personal data in two capacities:

• On our own behalf for data about people who visit our website or use our app: agency owners, team members and creators (“customers”), and for the de-identified data we use to improve our products and train our AI models.
• On behalf of our customers for data about the fans who chat with their Telegram bots, which we use to provide the service under our data processing terms.

If you are a fan and want to exercise your rights, please contact the creator or agency you were chatting with. If you contact us, we may pass your request on to them.

3. Visiting the website

The website sets no cookies and uses no analytics. When you visit, two things happen:

• Our hosting provider (Cloudflare) processes your IP address and basic request data (such as browser type and the page requested) to deliver the page and protect it from abuse. This may appear in short-lived server and security logs.
• Your browser loads fonts from Google Fonts, so Google receives your IP address.

4. Data about customers

Account and login

You log in with Telegram, so we never handle passwords. We receive and store your Telegram user ID, username, display name and profile photo link, plus when you created your account and last logged in.

Workspace and team

Agency name, time zone, team members and their roles, invite links, and the @usernames you enter when inviting someone. We also keep an audit log of important actions in your workspace.

Billing

Your plan, balance and usage, billing name and VAT ID if you provide them, and payment records: amount, currency, the payment address and the blockchain transaction hash. Payments are handled by NOWPayments; we don’t receive or store private keys or card details.

Models, personas and content

For each creator (“model”) you set up: her Telegram bot details (the bot token is stored encrypted), persona and style notes, boundaries, chat history you provide for training, message templates, sequences, and the photos, videos and voice notes you upload to the vault.

Security

To protect the service we use your IP address and session to apply rate limits. These are held in memory only and not written to our database.

5. Data about fans (processed for our customers)

When a fan writes to a creator’s Telegram bot connected to Inkwell, we process on our customer’s behalf:

• the fan’s Telegram user ID, username, first name and language setting;
• the messages exchanged, including media and paid-media offers;
• notes the AI keeps to remember the fan, such as preferences and things the fan has shared;
• purchases made with Telegram Stars and clicks on links sent in the chat;
• conversation metadata used to time replies and offers, such as the conversation stage and an estimate of how interested the fan is in buying.

Automated processing. Our AI reads messages to decide how and when to reply and when to make an offer. This involves profiling within the meaning of the GDPR. It doesn’t produce decisions with legal or similarly significant effects on the fan, and a person on the customer’s team can review or take over any conversation.

Improving our AI. As our customers authorise in our Terms, we also use fan conversations to improve Inkwell and to train our AI models. Before that, we remove fans’ Telegram user IDs, usernames and names.

Our customers are responsible for having a legal basis for this processing and for informing fans, including telling them, where the law requires it, that they are interacting with an AI system and how their messages are used.

6. How we use data

We use the data described above to:

• provide, operate and support the service, including generating replies and timing offers;
• process payments and manage accounts;
• secure the service and prevent fraud and abuse;
• communicate with you about the service, including changes and offers;
• analyse how the service is used, improve it and develop new products and features;
• develop, train, fine-tune and evaluate our AI models, including models offered to other customers, using customer content and conversations from which fans’ identifiers have been removed;
• comply with the law and enforce our Terms.

Where the GDPR or similar laws apply, we rely on performing our contract with you, our legitimate interests in running, securing and improving our products (including training our AI models), and our legal obligations.

7. Who we share data with

We don’t sell personal data and don’t share it for advertising. We use these service providers (sub-processors) to run Inkwell:

We may also disclose data to our affiliates and professional advisers; when required by law or to respond to legal requests; to enforce our Terms or protect our rights, users or the public; and to a buyer or successor as part of a merger, acquisition, financing or sale of assets.

8. International transfers

We and our service providers process data in the United States and other countries, which may have different data protection rules from where you live. Where the law requires safeguards for these transfers, such as for data from the European Economic Area or the UK, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses.

9. How long we keep data

• Login session: 7 days, or until you log out.
• Account and workspace data: for as long as your account is active, and up to 180 days after you close it.
• Fan data and vault media: for as long as the customer’s workspace is active, and up to 180 days after it is closed.
• Training data and AI models: data that has been de-identified, aggregated, or included in training datasets or trained AI models is kept indefinitely and is not deleted when you delete content or close your account.
• Backups: overwritten within 30 days.
• Billing records: as long as tax and accounting law requires, typically 5 years.

We may keep data longer where needed to comply with the law, resolve disputes or enforce our agreements.

10. Security

Traffic is encrypted with HTTPS, bot tokens are encrypted at rest, sessions use secure HttpOnly cookies with CSRF protection, and every request is rate-limited. Access to production data is limited to people who need it to run the service. No system is perfectly secure, but we’ll notify you and the relevant authority of any breach where the law requires it.

11. Your rights

Depending on where you live, you may have the right to access, correct or delete your data, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it. To use these rights, write to [email protected]. We’ll respond within the time the law requires and may need to verify your identity first.

Deleting your data or account removes it from the service. It doesn’t extend to de-identified or aggregated data, or to data already included in training datasets or trained AI models, which no longer identify you. Some rights may also be limited where we need data for legal reasons.

If you’re in the EU or UK, you can complain to your data protection authority.

12. Age

Inkwell is a business tool for adults. Customers must be 18 or older, and the service must not be used to chat with anyone under 18.

13. Changes

We may update this policy at any time by posting the new version here with a new date at the top. For material changes, we’ll also notify customers in the app or on Telegram. By continuing to use the service after a change, you accept the updated policy.