Last updated: 20 August 2026 · Version 3.0 · Russian version
Kai is an AI assistant that configures and manages the user's CRM account on the user's instructions, delivered through the Telegram bot @aiicrm_bot (the "Service"). The data controller for the processing described in this Policy is Tsikhan Varabyou, the operator of the Service ("we", "us").
You can reach us about anything in this Policy at ai.crm.2000@gmail.com or via Telegram at @aiicrm_bot. We handle data-protection requests through the same channels we operate the Service on — no separate portal or form is required.
This Policy applies to personal data processed when you interact with the bot, connect your CRM account to it, or pay for a subscription. It does not govern the CRM platform you choose to connect, Telegram itself, or any other service you use alongside Kai — each has its own privacy terms.
The Policy is drafted on the framework of the EU General Data Protection Regulation (GDPR). If you use the Service from outside the European Union, you are entitled to equivalent protections to the extent provided by the applicable data protection laws of your jurisdiction; nothing in this Policy limits rights those laws grant you, and references to GDPR articles should be read alongside their local counterparts.
We deliberately keep the data footprint narrow: the Service handles only what is needed to act on your instructions inside your CRM account. Specifically:
| Category | Details | Source |
|---|---|---|
| CRM connection data | OAuth 2.0 access and refresh tokens (stored encrypted) and your account address (subdomain) on the CRM platform you choose to connect | The CRM platform, when you authorize the connection |
| Telegram identity | Your Telegram user ID and username | Telegram, when you start the bot |
| Content you send the bot | Text messages, voice messages, screenshots and other images, and Excel/CSV files you upload for import | You |
| CRM working data | Objects the Service reads or creates in your CRM account on your request (pipelines, stages, fields, contacts, tasks, automations) and the plans generated from your answers | You; your CRM account |
| Billing data | Subscription status and payment confirmations. We never receive or store full card numbers — card data is handled entirely by the payment provider | Payment providers |
| Site analytics | A first-party cookie kai_vid — a pseudonymous visit identifier (one-year lifetime) — together with the pages viewed, the referring source and the language. Set only after you consent via the cookie banner; if you chose "Only necessary" or have not chosen yet, analytics never starts and nothing is sent. Used solely for our own site statistics; no third-party analytics services are integrated and the data is not shared with anyone. The legal basis is consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the "Cookie settings" link in the site footer |
Your browser — after you consent to analytics |
| Strictly necessary storage | Your cookie choice (kai_cookie_consent) and your selected site language (kai_lang) are kept in browser localStorage. These are strictly necessary entries: they hold your own preferences, are never used for tracking and are never transmitted, so they do not require consent |
Your browser |
Under Article 6 GDPR (and the corresponding provisions of other applicable data protection laws), each processing operation rests on one of the following bases:
We do not sell personal data, do not share it with advertisers, and do not use it to train our own or anyone else's models.
Kai relies on a small set of processors, grouped by category, each receiving only what its function requires:
| Category | What it receives | Purpose |
|---|---|---|
| The CRM platform you connect | The API calls needed to execute your instructions in your account, made through the platform's official API | Reading and writing the CRM objects you asked for |
| AI providers (OpenAI, Anthropic) | The text of your requests and, for voice messages, the audio for transcription. Your OAuth tokens and credentials are never included in these calls | Understanding your messages and generating responses and plans |
| Payment providers (card processing, Telegram Stars, USDT crypto payments) | The data each provider needs to process your payment | Subscription billing. Card details stay with the processor; we only see the confirmation |
Some of these providers operate outside the European Economic Area. Where personal data leaves the EEA, the transfer is safeguarded by the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism maintained by the provider. For users outside the EU, transfers are carried out in accordance with the applicable data protection laws of your jurisdiction.
Under the GDPR — and, for users elsewhere, under the applicable data protection laws of your jurisdiction — you may at any time:
/delete command in the bot;Revoking CRM access does not require contacting us at all: disable the connection in your CRM platform's settings and the Service loses access instantly.
OAuth tokens are stored encrypted at rest. Transport between the bot, our servers, the CRM platform, and every processor uses TLS. Access to production data is restricted to the operator and is not shared with third parties outside the processors listed above. We follow a data-minimisation approach: the Service does not request CRM permissions it does not use, and does not copy your CRM database to our servers — it operates on your data inside your account, on your instruction.
The Service is a business tool and is not directed at anyone under 16. We do not knowingly process minors' data; if you believe a minor has used the Service, contact us and we will delete the associated data.
When we materially change this Policy, we will notify active users through the bot and update the version and date at the top of this page. The current version is always available at this address. Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.