English
Negahban Privacy Notice
Last updated: 5 September 2026
This notice explains how Negahban processes personal data under the GDPR.
1. Controller
Ali Talebpoor Amirhandeh, trading as Ahura, Warnstedtstraße 57k, 22525 Hamburg, Germany · info@ahura.cloud
2. Scope and data categories
We process account and authentication data; connected group and administrator identifiers; message/content data the bot must inspect for configured moderation or AI features; rule, task and report data; support communications; device, audit, security and diagnostic logs; and billing identifiers, plan and transaction status. We do not store full card details.
3. Purposes and legal bases
We provide the account, dashboard and requested automation under Art. 6(1)(b) GDPR; protect users, prevent abuse and improve reliability under legitimate interests, Art. 6(1)(f); comply with accounting and legal duties under Art. 6(1)(c); and use optional analytics or other optional processing only with consent under Art. 6(1)(a).
4. Telegram group content
The bot receives only events Telegram sends under the permissions granted by a group administrator. Content is processed to apply the configured moderation, assistant, summary or scheduling function. Group administrators are responsible for an appropriate member notice and lawful basis. Do not enable unnecessary bot permissions.
5. AI processing
When an AI feature is enabled, the minimum content and instructions needed for the requested output may be sent to the configured AI provider. Administrators should avoid sending special-category, secret or unnecessary personal data. We do not sell message content for advertising.
6. Payments
When Paddle is the checkout provider, the Paddle entity identified at checkout acts as merchant of record and processes payment, tax, fraud and billing data under its own notice. Negahban normally receives customer/transaction identifiers, email, plan, amount, currency, subscription and refund status—not full card data.
7. Cookies and local storage
Required cookies support sign-in, security and interface language/theme. Optional analytics runs only when a lawful consent mechanism is active. You can remove local preferences in your browser; blocking required session storage can prevent login.
8. Recipients and international transfers
Data is disclosed only to providers needed for hosting, database, email, AI, Telegram connectivity and payment, and to authorities where legally required. Processing outside the EEA uses an applicable safeguard such as an adequacy decision or EU Standard Contractual Clauses.
9. Retention
Account and active configuration data is kept for the service term and normally deleted or anonymised within 30 days after closure; recoverable backups cycle out within 90 days; routine security logs within 90 days; support correspondence within 24 months; and billing records for the statutory period. Incident or dispute records may be retained until resolved.
10. Your rights
You may request access, correction, deletion, restriction, portability or object, and withdraw consent, at info@ahura.cloud. You may complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information. Some requests require identity verification.
11. Security and automated decisions
We use access controls, hashed credentials/tokens, transport encryption, least-privilege administration and audit logging. Negahban's moderation suggestions are not intended to make legal or similarly significant decisions without human review.
12. Changes
Material changes are dated here and communicated where required. Privacy questions and requests can be sent to info@ahura.cloud.