Effective and last updated: October 21, 2026
This Privacy Policy explains how GramClaw processes information when you use its website and services, including the inbox, CRM, campaigns, and connected Telegram accounts. The Cancellation Policy explains subscription cancellation separately.
Who operates GramClaw
GramClaw is a founder-operated SaaS project based in Greece and is currently operated by its founder, Marinos Veisllari. For privacy requests or questions, use the Telegram contact listed below.
Information we process
Depending on the features enabled for your account and how you use the service, we process account and sign-in information, workspace and membership records, connected Telegram account identifiers and status, synchronized conversations and contact details, campaign content and delivery results, CRM notes and stages, tags, suppression records, follow-up reminders, API-key metadata, and subscription and billing references. If you provide files, we process and store them for the requested feature.
If an AI feature is enabled and you choose to use it, your prompt and the relevant conversation, contact, or workspace context may be sent to OpenAI to produce the requested output. Feature availability can vary; an item described in product materials is not necessarily enabled for every account. GramClaw does not ask you to provide your Telegram password in its own interface. Telegram authorization is handled by GramClaw's Telegram connection service.
Why we use information
We use information to provide and maintain GramClaw, authenticate users, manage workspaces and connected accounts, deliver inbox and campaign features, provide support, process billing, protect the service, and meet legal obligations. Depending on the processing, our legal basis may be performance of our contract with you, our legitimate interests in operating and securing the service, your consent where requested (including optional analytics), or compliance with a legal obligation. You can withdraw consent at any time where processing relies on consent.
Account registration and authentication
You can authenticate using Google sign-in or an email magic link, subject to the sign-in options enabled for the service. Supabase Auth processes authentication information. GramClaw uses session cookies to maintain your sign-in; the application configures these cookies as HTTP-only, and production cookies are marked Secure and SameSite=Lax.
Telegram connections and conversations
When you authorize a Telegram account, GramClaw's own Telegram service, which uses TDLib and runs on Railway, processes the account authorization and session data needed to connect and synchronize that account. Session data is kept in the service's configured persistent storage. We do not ask for your Telegram password through GramClaw. Telegram separately processes activity on its network under Telegram's own terms and privacy practices.
Messages and contact information synchronized into GramClaw are stored as application data in Supabase so workspace members can use the inbox, CRM, campaigns, and reporting. Disconnecting or releasing a Telegram connection stops GramClaw's use of that live connection; the current account-release flow preserves the TDLib session storage and GramClaw conversation and campaign history. Disconnecting is not a data-deletion action.
Campaigns, CRM, and workspace data
We process campaign messages and configuration, recipient details, send and reply status, pipeline values, notes, tags, suppression records, and follow-up information to operate the service, enforce workspace access, and show campaign and inbox history. Workspace members may be able to view or change this information according to their role and permissions.
Teams: who can see what
In a team, each connected Telegram account is either a Team account or a Private account. Members of the team can read and reply to the conversations of Team accounts. The conversations of a Private account are available only to the person who connected it; other members, including the team admin, can see that the account exists, its name, and who connected it, but not its messages.
To run the team, GramClaw shows members each other's names, shows "Sent by" with a member's name on messages they send from a Team account, and shows the team admin activity counts per member (for example, how many messages they sent and campaigns they started). These counts never include message text. Teammates use the team admin's AI credits, so the admin's billing history shows that usage. When a member is removed, their access ends; their Private accounts are disconnected from the team and the team's history is kept.
Payments
Stripe processes subscription checkout and payments. GramClaw stores subscription status, Stripe customer and subscription references, plan and account-slot information, and related billing state. Payment card details are handled by Stripe; GramClaw does not intentionally store full card numbers.
Cookies, local storage, and analytics
GramClaw uses authentication cookies to keep you signed in. The application configures these cookies as HTTP-only, SameSite=Lax, and Secure in production. Browser local storage is used for display preferences such as theme and font size. A first-party cookie records your analytics choice for up to 180 days.
Google Analytics is optional. It is not loaded until you choose “Allow analytics.” Choosing “Reject analytics” prevents it from loading. You can change or withdraw your choice using “Privacy settings” in the site footer or dashboard Settings. When you withdraw consent, GramClaw stops further Google Analytics use in the page and attempts to remove Google Analytics cookies accessible on the GramClaw domain. Withdrawal cannot recall data already sent to Google. Google Analytics may use cookies or similar identifiers while enabled. Analytics remains disabled unless you opt in.
Service providers and infrastructure
The GramClaw web application, background worker, and GramClaw-operated TDLib Telegram service run on Railway. Supabase provides authentication, the application database, and file storage. Stripe processes subscription checkout and payments. Google provides Google sign-in where used and Google Analytics for website measurement. OpenAI processes prompts and relevant context when an enabled AI feature is used. These providers process information to provide their respective services. Telegram is an independent platform and separately processes activity on its network.
Retention and deletion
GramClaw does not publish a fixed automatic deletion period or a backup-retention period. Canceling a subscription or disconnecting/releasing a Telegram account does not delete synchronized conversations, campaign records, or TDLib session storage. The account-release flow preserves these records; it is not an account-data deletion feature. GramClaw does not currently provide a self-service account or workspace deletion control or an automated privacy-request form. Requests for access or deletion are received through our Telegram support contact and handled manually. We may request information needed to verify your identity and workspace authority before responding. Where the GDPR applies, we will respond without undue delay and normally within one month of receiving the request. If a request is complex or we receive multiple requests, the law may allow an extension of up to two further months; if so, we will inform you within the first month and explain why. Applicable law may also permit us to decline or limit a request. A request does not itself delete data, and we do not promise immediate deletion. We will explain the scope of any action and information that must be retained.
Security
GramClaw uses HTTPS for its public services, HTTP-only authentication cookies, server-side authorization checks, and scoped API keys stored as hashes rather than reusable plaintext. Supabase manages the application database and file-storage infrastructure. TDLib session data is held in the persistent storage configured for the Telegram service on Railway. We do not claim separate application-layer encryption for individual database fields or independently verified storage-encryption settings. No method of transmission or storage can be represented as completely secure.
More detail is available in the Security and Data Practices page.
Your privacy choices and requests
Depending on where you live, privacy law may give you rights to access, correct, delete, restrict, or object to certain processing, or to receive a copy of some information. Where the GDPR applies, you may also complain to your local data-protection supervisory authority; in Greece, this is the Hellenic Data Protection Authority. You can contact GramClaw to make a request or ask a question. We may need to verify your identity and workspace authority. You can reach the operator, Marinos Veisllari, at @mar_gramclaw on Telegram.
Changes and review
We may update this policy when our data practices or legal requirements change. The effective and last-updated date above identifies the current version.