On this page
1. Scope and our two roles
This policy explains how TelePong LLC (“we”, “us”, “TelePong”) handles personal data in connection with the website telepong.com, the application app.telepong.com, the TelePong Telegram bots and the browser extension (together, the “Service”).
We act in two different roles, and it matters which one applies to you:
- As a controller for the data of website visitors, of the people who sign in to the Service (workspace owners, managers, chatters and other team members), and for billing, security and support records. The rest of this policy describes that processing.
- As a processor for the data of Fans — the people who message the Telegram and OnlyFans accounts that an agency manages through TelePong. The agency (our Customer) decides why and how that data is processed; we process it only on the agency’s instructions under the Data Processing Addendum. If you are a Fan, section 10 explains how to exercise your rights.
2. What we collect
Sign-in and profile data
When you sign in with Telegram Login we receive the data Telegram shares: your Telegram ID, first and last name, username, profile photo and the authorisation timestamp. We never receive your Telegram password, phone number or one-time codes through sign-in. If you add a passkey, we store the public key and a credential identifier — never the private key, which stays on your device. Your interface language and other preferences are stored with your profile.
Workspace and team data
The name and settings of the workspace, your role and permissions, invitations, shift schedules and working-time records, notification preferences, templates, notes, tags and rules you create, and the actions you take in the Service (for example sending, editing or deleting a message, uploading a file, changing a setting), which are kept as an activity log visible to the roles the workspace owner chooses.
Connected Accounts
To link a Telegram account the owner enters its phone number, the code Telegram sends and, where enabled, the two-factor password; these are used once to create a session and are not stored except for the resulting session, which is kept under access controls. We also store the account’s profile (name, username, photo), a stable device profile presented to Telegram, the proxy server you assign, health and restriction status, and for OnlyFans accounts the session established through the browser extension and the public profile data of that account.
Fan data (processed for the agency)
Messages and media exchanged with Connected Accounts, Fan profiles (name, username, photo, language, biography, stories and profile media that Telegram or OnlyFans make available), payment and purchase history, notes, tags and lists the team keeps, contact details Fans share in chat (which we mask from some roles), reactions, call records, and clicks on tracking links including the approximate location and device derived from the request. We do not create accounts for Fans and do not contact them for our own purposes.
Content you upload
Media in the vault, posters and thumbnails we generate, edited versions, voice samples used for voice synthesis, and the technical metadata of files. Location and device metadata (EXIF) is removed from photos at upload.
Billing data
Workspace billing history, invoices from our cryptocurrency payment partner, the wallet or transaction identifiers of your payments, referral codes and credit, promotional discounts and the number of connected accounts billed. We never see card numbers; we do not accept cards.
Technical and security data
IP address, browser and device information, request timestamps, error and performance logs, security events (failed sign-ins, suspicious requests, screenshot-attempt signals from the content-protection layer, Content-Security-Policy reports), the result of the anti-bot check at sign-in, and the heartbeats that keep connections and shifts alive.
Support communications
What you write to us by email or Telegram, and the context needed to help you.
Analytics and cookies
See section 11.
3. Why we process it and on what basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Providing the Service: signing you in, running your workspace, syncing Connected Accounts, storing content, delivering messages, recording payments, showing analytics | Performance of the contract with the Customer; for team members, our legitimate interest in providing the Service the Customer asked for |
| Billing, invoicing, referral credit, preventing payment fraud | Performance of the contract; legal obligation (accounting, tax); legitimate interest |
| Security: protecting accounts and sessions, detecting abuse, bots and attacks, keeping audit logs, enforcing our policies | Legitimate interest; legal obligation |
| Automated features you switch on: translation, transcription, detection of payment details and risky content, auto-replies, voice synthesis | Performance of the contract (on the Customer’s instructions) |
| Service messages: important notices about your workspace, payments, incidents and policy changes | Performance of the contract; legitimate interest |
| Improving the Service: aggregated usage statistics, product analytics with consent, error diagnostics | Legitimate interest; consent where cookies or similar identifiers are used |
| Responding to legal requests, complaints and takedown notices; establishing or defending legal claims | Legal obligation; legitimate interest |
We do not use personal data for automated decisions that produce legal or similarly significant effects on you, and we do not sell personal data.
4. Machine translation, transcription and other AI features
Several features use machine-learning models. Where a model runs on our own infrastructure, the data stays with us. Where a third-party provider is used, we send only the text or audio needed for that request and rely on the provider’s commercial terms, under which inputs are not used to train the provider’s models by default; provider-side abuse monitoring and short-term retention may still apply.
- Translation of messages: a translation model hosted by us, or DeepL (DeepL SE, Germany) and Anthropic (Anthropic PBC, USA) when the hosted model is unavailable or the workspace chooses a cloud provider.
- Voice message transcription: a speech-recognition model hosted by us.
- Voice synthesis: a text-to-speech model hosted by us, trained on voice samples the Customer uploads with the speaker’s consent.
- Content and payment-detail detection in outgoing messages: rule-based and model-based checks that run on our infrastructure.
Outputs of these features are shown to the team as drafts or signals; a person remains responsible for what is sent or published.
6. International transfers
Our primary servers are in the European Union. Some providers (for example Anthropic, Cloudflare, Google, GIPHY) process data in the United States or other countries. Where data leaves the EEA or the UK we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses and the UK Addendum, or another lawful transfer mechanism, together with the providers’ own safeguards. Copies of the relevant clauses are available on request.
7. How long we keep data
We keep personal data only as long as needed for the purposes above, and then delete or anonymise it. In particular:
- Your account — while it exists. When you delete your account it is deactivated immediately and permanently deleted after 30 days; the grace period lets you undo an accidental deletion.
- A workspace — while it is active or suspended for non-payment. When the owner deletes it, a short grace period of 3 days applies during which the deletion can be cancelled; the workspace and its content are then removed from live systems.
- Connected Account sessions — until the account is disconnected, the session is revoked by the Platform, or the workspace is deleted.
- Messages and Fan data — for as long as the workspace keeps them. Media mirrored from Telegram that was deleted in Telegram is removed from our storage within about 60 days; chat uploads and cached media have a shorter configured retention. Link-click records are kept for the retention period set for the workspace.
- Voice models and samples — until the Customer deletes them or the workspace is deleted.
- Billing records — for the period required by accounting and tax law.
- Technical logs and security events — typically up to 90 days, longer only while an incident or investigation is open.
- Backups — encrypted backups are rotated on a fixed schedule; deleted data disappears from backups when the backup that contains it expires.
Where the law requires us to keep certain records longer (for example to respond to a legal claim or a report of illegal content), we keep only what is needed and restrict access to it.
8. Security
We protect data with technical and organisational measures appropriate to the risk: encryption in transit (TLS) for every connection; access controls and role-based permissions inside workspaces; signed and time-limited requests between the application and our servers; passkey (WebAuthn) sign-in; a strict Content-Security-Policy; isolation of Connected Account sessions; per-viewer watermarks and screenshot-attempt alerts for protected media; removal of location metadata from uploads; audit logs; monitoring and alerting; regular encrypted backups stored separately from production; and limited, logged staff access.
No system is completely secure. Keep your Telegram account protected with two-step verification, add a passkey, give team members only the permissions they need, and tell us promptly if you suspect unauthorised access.
9. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to processing, to data portability, to withdraw consent where processing is based on consent, and to complain to your data-protection authority.
To exercise a right, write to [email protected] from the contact details linked to your account, or use the account and workspace deletion controls in the application. We answer within one month, or tell you if we need longer. We may ask you to confirm your identity first.
Team members: because your workspace owner decides what is kept in the workspace (for example your activity log), requests about workspace records should go to the owner; we will help them respond.
10. If you are a Fan
If you have messaged a creator whose account is managed through TelePong, the agency running that account is the controller of your data. Please contact the agency or creator you dealt with to access, correct or delete your data, or to object to its processing.
If you cannot reach them, or if you believe content involving you is being used without your consent, write to [email protected] (data requests) or [email protected] (illegal or non-consensual content). We will forward your request to the agency and, where the law requires it or the agency does not respond, act on it ourselves. Our Complaints & Takedown policy describes the procedure and timelines.
12. Children
The Service is for business use by adults. We do not knowingly collect personal data from anyone under 18 as a user of the Service. Our Customers are required to ensure that every person appearing in their content is an adult and to stop any interaction with a Fan who turns out to be a minor. If you believe a minor is involved in any way, report it to [email protected].
13. Changes to this policy
We will post changes on this page and update the effective date. Material changes are also announced in the application or by message to the workspace owner before they take effect.
14. Contact
Controller: TelePong LLC.
Data-protection requests: [email protected]. Other legal questions: [email protected].