Privacy Policy
Last updated: 29 October 2026 · ai-xodim.uz
· brandbox.uz@mail.ru
Ai Xodim (ai-xodim.uz, the “Service”) helps businesses automate Instagram — keyword auto-replies to comments and Direct messages, account analytics — and lets them connect their own AI assistant (Claude, ChatGPT, Gemini and others) to their Instagram through the Model Context Protocol (MCP). The Service is operated by the sole proprietor Yakka tartibdagi tadbirkor JABBOROV SANJAR RADJABOVICH, Republic of Uzbekistan (“we”, “us”). This policy explains what data we process, why, and what control you have over it.
1. Roles
- For the account data of our customers (“Merchants”) we are the controller.
- For data about people who interact with a Merchant’s Instagram account (commenters and people who write in Direct) the Merchant is the controller and we process that data on the Merchant’s behalf, only to provide the Service.
2. Data we process
Merchant account
- Name, login, and optionally email and company name; password stored only as a one-way hash.
- If you sign in with Google or Apple: the name, email address and profile photo that the provider shares with your consent, and an identifier of that sign-in. Apple may give us a private relay address instead of your real email. Sign-in goes through Google Firebase Authentication, which keeps its own record of the sign-in; it is deleted together with your account.
- Connected AI applications: the application name, when access was granted, and OAuth tokens (revocable at any time on the “AI connector” page).
- Mobile app push-notification tokens, if you use our iOS or Android app.
- If you subscribe to Ai Xodim Pro in the app: the purchase record from the App Store or Google Play — product, transaction or order identifiers, status, trial and renewal dates — and a random account identifier we attach to the purchase so it can be matched to your account. Payment itself is handled by Apple or Google; we never receive your card details.
- When your free trial without a store purchase starts, or we open Ai Xodim Pro for you for a set period: when it starts and ends, and for the trial — where it started (the website, an app or the AI connector) and in which language.
- Payments for Ai Xodim Pro: the amount, currency and date of each App Store or Google Play charge and of each payment made through us, and whether it was refunded.
- If we open the AI agent for your account: the instructions and knowledge-base materials you add, and a log of the agent’s answers — the reply, whether it handed the conversation over to you and why, and what the answer cost.
Connected Instagram account
Obtained through the official Instagram login with the account owner’s explicit consent. We never see or store Instagram passwords.
- Instagram account ID, username and the access token issued by Meta (encrypted at rest), with its expiry date.
- Profile counters (followers, following, posts), recorded once a day to show growth over time.
- Posts, reels, comments and insights (reach, views, interactions, audience demographics) — read from Instagram when you open analytics or your AI assistant asks for them, and cached for a few minutes.
- Your automation settings: keyword rules, reply texts, default reply.
People who interact with a Merchant’s Instagram account
- Instagram-scoped user ID, username and display name.
- Text of incoming Direct messages and of comments that matched an auto-reply rule, with timestamps.
- Voice messages in Direct: if the Merchant has Ai Xodim Pro, they are transcribed into text automatically, and the transcript is stored encrypted. The audio itself is not kept: it waits on our server only until it is transcribed and is deleted right after, and so is Instagram’s link to it, kept encrypted until then.
- The automatic replies sent, and how the person reached the account (a comment under a post, a story reply, an ad or a link).
- Whether the person opted out of automated messages (by writing “stop”).
- Whether the person follows the Merchant’s account — Instagram tells us when they tap a button in a message the Merchant set up to hand material to followers. We keep only whether they followed before the request or after it.
Personal Telegram (if you connect the Telegram secretary)
- Your Telegram user ID, name and username, and whether the Ai Xodim bot is connected to your account with which permissions.
- Messages of the private chats you allowed the bot to see, received after you connected it: text (stored encrypted), time, who wrote it, and the other person’s name and username. Voice messages and video notes are transcribed into text automatically, and the transcript is stored encrypted like the text; the audio itself is not kept — it waits on our server only until it is transcribed. Photos, videos and other media are noted by type and length, without their content. Telegram gives the bot nothing from before the connection.
- Replies sent through the bot on your command.
People who write to a Merchant’s own Telegram bot (if the Merchant connects one to the AI agent)
- Their Telegram user ID, name, username and language; the phone number, if they share it with the bot’s button; the link they opened the bot with; whether they blocked the bot.
- Their messages to the bot and the bot’s answers (text stored encrypted). Voice messages are noted without their content.
- Leads the AI agent takes in any of its channels: the name, phone number or username, and what the person asked for.
Our voice-to-text Telegram bot
- If you use our Telegram bot that turns voice messages into text: your Telegram user ID, name, username and language; how many minutes of voice messages you have had transcribed and how many you have left — free and of your packages; the length of each voice message, which is what it takes off your balance; whether the bot is connected to your account as a secretary.
- The voice messages and video notes you send or forward to the bot, and — while it is connected as your secretary — those other people send you in the private chats you allowed it to see: we receive them from Telegram, turn them into text and send you the text in your chat with the bot — from your chats, together with the voice message itself. Of the person who sent such a message we keep only the name and username, to head the text with. The transcript is stored encrypted until it reaches you and is then deleted; the audio is not kept — it waits on our server only until it is transcribed.
Support requests
- If you write to us through the feedback form on the site or in the app: your message, the name and the contact you leave so that we can answer, and — if you are signed in — the account you wrote from.
Technical data
- IP address, browser user agent and request errors — for security and troubleshooting.
3. Why we use it
- To send the auto-replies the Merchant configured — in Direct and under comments.
- To show the Merchant analytics and a log of what the automation did.
- To let the Merchant’s connected AI assistant read and act on the Merchant’s Instagram when the Merchant asks it to — and, if the Merchant connected the Telegram secretary, read the Merchant’s new Telegram messages and send the replies the Merchant approves, and — with Telegram auto-replies switched on — answer new messages by the Merchant’s own rules.
- With the AI agent switched on — to answer the Merchant’s customers in Instagram Direct and in the Merchant’s Telegram by itself, from the Merchant’s instructions and knowledge base, and to hand a conversation over to the Merchant when a person is needed.
- To keep the Service secure, prevent abuse, and provide support.
We do not sell personal data, and we do not use it for advertising.
4. Who receives data
- Meta (Instagram) — replies and actions are sent through the official Instagram API.
- AI applications the Merchant connects — when a Merchant connects an AI assistant (for example Claude by Anthropic, ChatGPT by OpenAI or Gemini by Google) and asks it a question, the data needed to answer — analytics, posts, comments, Direct messages of that Merchant’s account — is sent to that application and processed under its provider’s terms and privacy policy. The Merchant chooses and authorizes these applications and can revoke access at any time.
- Our AI provider — when a Merchant switches on the AI agent, the new messages of a person writing to the Merchant in Instagram Direct or the Merchant’s Telegram (voice messages as their transcripts), the recent conversation with that person and the Merchant’s instructions and knowledge base are sent to Anthropic (the Claude API) to write the reply. For the optional “content analysis” feature, captions of the Merchant’s posts are sent to our language-model provider (Google Gemini or OpenAI) to group them by topic.
- The Merchant’s CRM — if a Merchant connects amoCRM or Bitrix24 to the AI agent, every lead it takes — the name, phone number, username and profile link, what the person asked for and the channel — is sent to that Merchant’s CRM account, into the fields the Merchant chose, and is processed under that CRM provider’s terms. The Merchant can disconnect the CRM at any time.
- Infrastructure providers — hosting (Akamai/Linode, United States), Firebase Cloud Messaging for mobile push notifications and Firebase Authentication for signing in with Google or Apple.
- Apple and Google — subscriptions are bought through the App Store or Google Play; we check the purchase with the store and receive its status updates.
- Telegram — if you connect the Telegram secretary, messages reach us from Telegram, and the replies you approve and your auto-replies are sent through the Telegram Bot API. If a Merchant connects their own bot, the messages of people writing to it reach us from Telegram, and the bot’s answers are sent through the Telegram Bot API. If you use our voice-to-text bot, voice messages reach us from Telegram, and their text is sent to you through the Telegram Bot API.
- Voice messages — transcribed in-house — voice messages in Instagram Direct and voice messages and video notes of the Telegram secretary and of our voice-to-text bot are transcribed by speech-recognition software we run on our own equipment in Uzbekistan. The audio is not passed to third-party speech services and is deleted as soon as it is transcribed.
5. Storage and security
- Data is stored on servers in the United States. By using the Service you acknowledge this transfer.
- Passwords are hashed; Instagram access tokens are encrypted; all traffic uses HTTPS.
- Instagram webhooks are verified with Meta’s signature; AI connections use OAuth 2.1 and can be revoked by the Merchant.
6. How long we keep it
- Logs of incoming Direct messages, with the transcripts of voice messages, and of matched comments — 90 days, then deleted automatically.
- If a person unsends a Direct message, we delete our copy of its text or transcript.
- Contacts, rules and daily snapshots — until the Merchant disconnects the Instagram account (which deletes them immediately) or deletes their account.
- Support requests — up to 12 months, or until you delete your account.
- Telegram secretary messages, with the transcripts of voice messages, — 90 days, then deleted automatically; at once when you disconnect Telegram in the cabinet or app, or delete your account. Without an active Ai Xodim Pro they are kept 7 more days after Pro ends (after you link Telegram, if Pro never started), then deleted, and new messages are not stored until Pro is active again.
- The AI agent’s answers log — 90 days, then deleted automatically. Its instructions and knowledge base — until the Merchant deletes them or the account.
- Chats of a Merchant’s own Telegram bot — 90 days, then deleted automatically; at once when the Merchant disconnects the bot or deletes the account. Leads — until the Merchant deletes them or the account.
- Our voice-to-text bot: a transcript — until it reaches you, then deleted; a record of each voice message without its content (time, length, language, result) — 90 days; your Telegram details and packages — while you use the bot, or until you ask us to delete them.
- Payments — until the account is deleted.
- Technical logs — up to 30 days.
- When a Merchant account is deleted, all related data is deleted within 30 days.
7. Your rights
Depending on where you live (for example under the GDPR in the EEA/UK), you may have the right to access, correct, export or delete your data, and to object to or restrict its processing. Merchants can disconnect Instagram, revoke AI applications and delete their whole account themselves — in the dashboard (Profile → Delete account) or in the mobile app. For anything else, email brandbox.uz@mail.ru. If you wrote to or commented on a business that uses Ai Xodim, see Data deletion — we will also forward your request to that business, who controls your data.
8. Children
The Service is intended for businesses and is not directed to children under 16.
9. Cookies
Only functional cookies: the sign-in session, security token and interface language. No advertising or third-party analytics cookies.
Our video guides are YouTube videos shown in its privacy-enhanced player. Nothing is requested from YouTube until you open a guide; when you do, YouTube (Google LLC) receives your IP address and device information and, once the video plays, may store its own data on your device — under Google’s privacy policy.
10. Changes
We will publish any changes on this page and update the date above; material changes will be announced to Merchants by email or in the dashboard.
11. Contact
Yakka tartibdagi tadbirkor JABBOROV SANJAR RADJABOVICH, Republic of Uzbekistan · brandbox.uz@mail.ru