Privacy Policy

1. Who we are

Gategram is a brand of COMMIT MEDIA SARL, a company registered in Luxembourg (registration number LU34811132), with its registered office at 147 route de Thionville, L-2611 Luxembourg.

Contact: bob@openletz.com

2. Data we collect

We collect the minimum data necessary to operate the service:

• Telegram user data: Your Telegram user ID, username, and first name, provided by the Telegram Mini App SDK when you open Gategram. We do not access your phone number, contacts, or message history.
• Creator profile data: Legal name, email address, country, and payout details (IBAN or PayPal email), provided voluntarily when you set up payouts.
• Transaction data: Purchase records including product ID, buyer ID, amount paid, payment method, and timestamp.
• Consent records: The terms version, time, source, IP address, and user agent recorded when a buyer or creator accepts the applicable terms.
• Usage data: Public-site page views and interaction events via Google Analytics only after you opt in.

3. How we use your data

• To authenticate you via Telegram and provide access to the service.
• To process purchases and deliver paid content to buyers.
• To calculate and process creator payouts.
• To generate invoices for payout accounting.
• To prevent fraud, abuse, and duplicate transactions.
• To improve the service through anonymized analytics.

4. Data storage and security

Your data is stored in a Turso (libSQL) database hosted in the EU (AWS eu-west-1, Ireland). All data is encrypted in transit (TLS) and at rest. New digital-goods payments are handled by Telegram Stars. We retain limited historical Stripe transaction identifiers for refunds, dispute handling, and accounting, but do not store card details.

Authentication uses Telegram's HMAC-SHA256 initData validation with timing-safe comparison and replay protection.

5. Data sharing

We do not sell your data. We share data only with:

• Telegram: For payment processing via Stars.
• Stripe: Only for historical refund, dispute, and accounting records from the retired card flow.
• Google Analytics: Public-site usage data only after explicit consent.

6. Your rights

Under GDPR, you have the right to access, rectify, delete, or export your personal data. You can also object to processing or request restriction.

To exercise these rights, contact us at bob@openletz.com. We will respond within 30 days.

7. Data retention

Transaction and associated terms-acceptance records are retained for the duration required to establish transactions and meet Luxembourg accounting or legal obligations (normally 10 years for accounting records). Creator profiles are retained while the account is active and deleted upon request where no legal retention duty applies. Processed webhook update IDs are retained for 3 days and then automatically purged.

8. Cookies

We use sessionStorage to cache Telegram authentication for the session and localStorage to remember your analytics choice. Google Analytics is not loaded unless you accept; if accepted, Google may set analytics cookies under its policy. Global Privacy Control or Do Not Track is treated as a decline when no choice has been saved.

9. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the service constitutes acceptance of the revised policy.