Data processing agreement
This agreement describes how Lanka processes bot visitors' data on behalf of the bot's owner. It supplements the Terms of use and applies to every owner who agreed to them. Last updated on 2 November 2026. Questions go to support@lanka.bot.
1. Roles
The bot's owner is the controller of their bot visitors' data. Lanka is the processor that processes this data on the owner's behalf.
Lanka processes the owners' own data as the controller under the Privacy policy, and this agreement does not cover it.
2. Subject of processing
- Whose data: the people who write to the owner's bot.
- What data: listed in section 4 of the Privacy policy: Telegram details, messages, variables, Mini App data, payments, channel access. What exactly the bot collects is the owner's decision.
- Purpose: running the bot as the owner set it up.
- Duration: as long as the bot or the owner's account exists.
3. The owner's instructions
The owner's instructions are their bot's settings: flows, broadcasts, scripts, jobs, panels. Lanka processes visitors' data only by them, does not use it for its own purposes and does not sell it.
Lanka discloses data to public authorities only on a lawful request, and tells the owner about it where the law allows.
4. Access and security
Only Lanka's administrators have access to the server and the database, and they keep the data confidential. The security measures are described on the Security page.
5. Subprocessors
Lanka uses the subprocessors listed on the Subprocessors page. Lanka announces a new subprocessor at least 30 days ahead, in Lanka or through Telegram. An owner who disagrees may stop using Lanka under section 9 of the Terms. Lanka answers to the owner for its subprocessors as it does for itself.
The services the owner connects themselves (the AI step, scripts, payment providers) are the owner's subprocessors, and the owner answers for them.
6. Visitors' requests
The owner sees visitors' data in Lanka and can correct or delete it. A visitor's request that reaches Lanka we pass on to the owner.
7. Data breach
If Lanka learns of a breach of visitors' data, it notifies the owner through Telegram without undue delay: what happened, which data it concerns and what has been done. This lets the owner meet their duties to visitors and supervisory authorities.
8. After the account is closed
Before closing the account, the owner can export visitors as XLSX or CSV from the Visitors panel. Deleting a bot removes its visitors and their messages from the database at once. We delete an account within 30 days of the request. The data leaves the backups within 30 days, when the copy expires.
9. Information for review
On the owner's request, Lanka provides the information needed to show that it keeps to this agreement.
10. Changes
We announce material changes to this agreement at least 30 days ahead, in Lanka or through Telegram.