Privacy Policy
This Privacy Policy explains how Telebux ("we", "us") handles information when you use the Telebux website at telebux.xyz and the Telebux application at app.telebux.xyz (together, the "Service"). Telebux is a CRM that runs on top of your own Telegram account.
1. Information we collect
Account information
When you create an account we collect your email address, a password, and optionally your name. Your password is never stored in plain text; it is stored as a hash. We also store your timezone, your workspace name and type, and a record that you accepted our Terms of Service. You may optionally enable two-factor authentication.
CRM data you create
Telebux stores the data you put into your workspace: contacts, organizations, deals, tasks, calendar events, notes, tags, custom fields, message templates, reminders, and campaigns. This data lives in your workspace and is visible to the members of that workspace.
Telegram data
You connect your own Telegram account to Telebux, which acts as a Telegram client (like Telegram Desktop). To keep you connected, we store your Telegram session in encrypted form.
We do not keep a copy of your Telegram conversation history in our database. Your chats and messages are loaded live from Telegram when you open a conversation. What we do store is limited to: the encrypted session, basic chat details you turn into CRM records (such as a chat's title and type for a lead), your own notes and tags, timestamps used for response-time analytics, reminders, the message templates you save, and any message you schedule, which is kept only until it is sent.
Google data (optional)
If you connect Google, Telebux requests these permissions: your email address (userinfo.email), Google Calendar events (calendar.events), Google Meet link creation (meetings.space.created), and Gmail read and send (gmail.readonly and gmail.send). Your Google access and refresh tokens are stored in encrypted form. Each user connects their own Google account.
Gmail messages are fetched from Google when you open the Mail view and are matched to your CRM contacts by email address. Regarding Gmail data specifically:
- Telebux does not sell Gmail data.
- Telebux does not use Gmail data for advertising.
- Telebux does not use Gmail data to train, fine-tune, or improve AI models.
- Telebux does not transfer Gmail data to AI providers except when you explicitly choose an action that sends selected CRM context to an AI feature.
- Telebux accesses Gmail data only for the CRM features you activate.
AI assistant data (optional)
The AI assistant uses your own Anthropic API key, which you provide and which we store in encrypted form. When you use an AI action, Telebux sends only the CRM context needed for that action to Anthropic (for example, deal details for an invoice). Your AI conversations are stored so you can revisit them. You are billed directly by Anthropic for your usage; there is no separate AI charge from Telebux.
Payment data
Payments are processed through Helio using cryptocurrency (SOL or USDC). In connection with a payment we store your wallet address and the transaction signature. We do not collect or store card or bank account details.
The marketing website
The telebux.xyz marketing site does not use analytics or advertising trackers. The only thing it stores in your browser is your light or dark theme preference.
Technical data
Our hosting and email providers process standard technical information, such as IP addresses and request logs, as a normal part of delivering and securing the Service.
2. How we use information
- To provide the Service: run your CRM, sync your Telegram, and power the calendar, mail, campaigns, and integrations you enable.
- To authenticate you and keep your account secure.
- To process your subscription and payments.
- To send you service-related email such as email verification, team invitations, and notifications.
3. Who we share information with
Telebux relies on the following third parties to provide the Service, and shares only what each needs to perform its function:
- Telegram - your conversations and account, which you connect.
- Google - Gmail, Calendar, and Meet, if you connect them.
- Anthropic - AI features, using your own API key, if you enable them.
- Helio - cryptocurrency payment processing.
- Railway - application hosting and database.
- Netlify - hosting and delivery of the web frontend.
- An email delivery provider - to send service-related email.
- Notion and Zapier - only if you connect them.
We do not sell your personal data.
4. How we store and protect your data
Your workspace data is stored in a managed Postgres database hosted on Railway. We protect it with measures including:
- Password hashing (bcrypt), so passwords are never stored in readable form.
- AES-256-GCM encryption for sensitive credentials, including your Telegram session, your Google tokens, and your Anthropic API key.
- Encryption at rest: our database host, Railway, encrypts stored data at rest at the infrastructure level by default.
- We limit access to your data to what is needed to operate and support the Service.
- Workspace isolation, so within the app a workspace's data is only visible to its members.
- Optional two-factor authentication on your account.
No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
5. How long we keep your data
We keep your workspace data for as long as your account is active. You can delete records, or an entire workspace, at any time, and deleted data is removed from your workspace. If you want to close your account, contact us using the details below.
6. Your choices and rights
- You can disconnect Telegram or Google from Telebux at any time, and you can revoke Telebux's access from your Google Account permissions page or from Telegram's active sessions list.
- You can edit or delete the CRM data in your workspace.
- To access, correct, or delete your personal data, contact us using the details below.
7. International data
Your data is stored and processed by the providers listed above, including Railway and Netlify, which may process data in different regions depending on their infrastructure.
8. Children
The Service is not intended for children, and we do not knowingly collect information from anyone under the age required to consent in their country.
9. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the date at the top, and we may notify you of significant changes by email or an in-app notice.
10. Contact
Questions about this policy or your data can be sent to dusanio@telebux.xyz.