Contexter Privacy Policy

EN · RU — русская версия

Contexter is a workspace for keeping personal and shared project contexts available across Telegram, ChatGPT, Claude, the Contexter web workspace, and other compatible clients. This Privacy Policy explains what personal data Contexter processes, why it is processed, who can receive it, how long it is kept, and what choices you have.

This Policy applies to contexterai.com, the Contexter web workspace, the @ai_contexter_bot Telegram bot, the Contexter MCP server, and related integrations (together, the Service).

1. Who is responsible for your data

The data controller is:

Individual Entrepreneur Maksim Shirokov (Georgia), operating as Contexter
Address: 4a Tamarashvili Street, Tbilisi, Georgia
Privacy contact: privacy@contexterai.com

In this Policy, "Contexter", "we", "us", and "our" refer to this controller.

Third-party services you choose to connect—such as Telegram, ChatGPT/OpenAI, Claude/Anthropic, or another MCP-compatible client—process data under their own terms and privacy policies. Contexter does not control how those services handle data in your account with them.

2. Data we process

We process only the data needed to operate the features you use.

Account and connection data

• your Telegram numeric user ID and, when Telegram provides them, your display name and username;
• your internal Contexter user ID, selected language, access-approval status, onboarding state, and preferences;
• information about connected clients, OAuth grants and scopes, access and refresh tokens, connection status, and revocation events;
• shared-context membership, invitations, permissions, and confirmation records. In a shared context, other participants (and the AI surfaces they use) can see your display name, the surface a record came from, and your internal Contexter member identifier — a service ID used for access management; your Telegram ID is never exposed to them.

Telegram does not give the bot your phone number by default. Contexter never asks for the password to your Telegram, ChatGPT, Claude, or other third-party account.

Content you choose to provide

• messages and files that you send to the Contexter bot after activation;
• context names, descriptions, notes, source messages, attachments, and other records;
• AI-generated results or files that you explicitly ask a connected client to save;
• edits, deletion and restoration requests, sharing choices, and other actions;
• authorship, source surface, timestamps, and audience information attached to records.

Content may include personal data about you or other people. Do not submit another person's data unless you have a lawful reason and the right to share it. The Service is not intended for passwords, authentication secrets, complete payment-card data, official medical records, biometric templates, or copies of government identity documents.

Voice messages

When you send a voice message to the bot in a private chat, its audio is transcribed automatically so that the words can be kept as a record. To do that, Contexter sends the audio itself to OpenAI, the transcription provider named on our Subprocessors page, and it does so without asking you a separate question first. You should know this before you record: images are sent to an AI provider only after you confirm the particular request that needs them, but a voice message is transcribed as soon as it arrives.

Transcription runs only for people who have already connected an external AI client, and it is bounded: a recording longer than five minutes is not transcribed, and no more than thirty minutes of audio per person per day is transcribed. The file name and the media type your device declares are not passed on; only the audio and a media type determined on our side leave the server. The recording is then kept as an attachment and its text as the record, under the rules in section 9.

Telegram group data

In a Telegram group where the bot has been activated:

• a participant must opt in before their contributions can be stored;
• only eligible messages deliberately sent to or in reply to the bot are stored as context content;
• ordinary group conversation is not stored as context content;
• limited service events, commands, opt-in or opt-out events, and membership changes are processed to operate consent and access controls.

Reading is governed by a different rule from writing, and section 7 sets it out: the room's own contexts can be opened by any member of that chat, including a member who never opted in.

Telegram may technically deliver additional group messages to a bot if the bot is made a group administrator or if Telegram Privacy Mode is disabled. Contexter's application layer is designed to reject non-eligible messages without storing their content or writing it to application logs. Group administrators should not disable Privacy Mode or grant unnecessary administrator rights.

Technical and support data

• IP address, browser or client type, request time, session and authentication events, requested method or tool name, response status, and error information;
• support requests and any information you include in them.

Application logs record operational events such as method and tool names but are designed not to contain the content of your records, messages, or files.

How you arrived

If you open the bot through a link that carries a campaign marker — the button on this website, an advertisement, or a public context link — that marker is written once onto your user record, at your first contact with the bot, and is not changed afterwards. It is a short label, such as the name of the advertising campaign that brought you. We use it to understand which channels people come from and to choose the language of your first screen. It is kept for as long as the account exists.

Service operation metrics

The operator of the Service uses an internal panel to see whether the Service is working and where people get stuck. For each person it shows the display name, the date the account was created, the time of the last activity, and counters of messages, records, contexts, files, rooms and connected clients. It shows counts, names and dates only; the content of records, messages and files does not appear on it.

The figures on that panel are calculated from current data each time it is opened, so they describe the whole life of an account rather than a fixed window. Separately, an hourly snapshot of the same aggregate figures is stored, and those snapshots are deleted after 90 days, except for the most recent one, which is kept until a newer snapshot replaces it.

3. What Contexter does not collect automatically

Connecting an AI client does not import your AI chat history. Contexter receives a tool request only when you or your client invokes a Contexter action. We do not automatically copy entire ChatGPT, Claude, or Telegram conversations into Contexter.

In a private Telegram chat, messages you send to the activated bot are treated as content submitted to the Service. In a connected AI client, a new record, file, edit, deletion, or share is created only through an explicit tool action under the permissions you granted.

4. Why we process data and our legal bases

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. Some core processing is necessary to provide the Service; if you do not provide the necessary data, the relevant feature may not work.

This Privacy Policy is a notice, not a consent form. When the law requires consent, Contexter asks for it separately and in context.

5. AI clients and other third-party services

Connected AI clients

When you ask ChatGPT, Claude, or another connected client to read from Contexter, Contexter returns the requested content to that client. The AI provider may then process it under your account, plan, settings, and its own privacy policy. When you save from an AI client, Contexter receives only the tool payload submitted to the Service, not the whole surrounding chat unless the client explicitly includes it.

Review the policies of the services you connect:

• Telegram Privacy Policy
• OpenAI Privacy Policies
• Anthropic Privacy Center

The Telegram assistant, and what reaches the model provider

The assistant inside the Contexter Telegram bot is the case in which Contexter itself sends data to an AI provider, rather than answering a request that started with your own client. That provider is identified on our Subprocessors page. We do not send unrelated contexts in order to answer a request, but what we do send is more than the words of your prompt, and it is worth stating item by item. When answering a request requires them, the provider receives:

• the full text of a record you asked the assistant to open;
• shorter excerpts of records when the assistant lists or summarizes them;
• titles, times, and the surface a record came from;
• the display names of the people who wrote those records, which in a shared context means the names of people other than you;
• the display names of the people in a context's audience, up to twenty per context, together with the number of people in it;
• images, and only after you have confirmed the particular request that needs them;
• the audio of a voice message, for transcription.

Internal identifiers are deliberately held back. The provider does not receive your Telegram ID, your Contexter user ID, or the database identifiers of records, contexts and people; the model works with short references that are issued for one conversation and mean nothing outside it. Display names are sent because a person reading the answer needs to know who said what; identifiers would add nothing to the answer and would be additional personal data leaving the Service.

Contexter does not use your content to train a proprietary AI model. A third-party AI provider's own handling of data is governed by the applicable service agreement and privacy terms described on the Subprocessors page or in your own account with that provider.

6. When data is disclosed

We may disclose personal data only as needed:

• to people you choose: members of a shared context can see the full contents of that context, its contributors, and its provenance information;
• to anyone holding a public link: when the owner of a context publishes it by link, the fields listed in section 8 become readable by any person with that link, without a Contexter account and without signing in;
• to connected services you choose: when you invoke a connector or authorize a client to act for you;
• to service providers: hosting, storage, AI, security, and other infrastructure providers that process data to help us operate the Service;
• for legal and safety reasons: where reasonably necessary to comply with law, a valid legal request, protect rights or safety, investigate abuse, or defend legal claims;
• if the operator changes: as part of a merger, acquisition, financing, reorganization, or sale of the Service, subject to appropriate safeguards and notice where required.

The current service-provider list, processing purpose, and hosting region must be published at https://contexterai.com/subprocessors.

We do not sell personal data. We do not use your content for third-party advertising.

7. Shared contexts and audience controls

A shared context is not private to one person. Everyone shown in its audience can read all records placed in it, including records created before they joined. Record cards may show the contributor's display name, source surface, and time.

Before an action widens the audience for existing content, or adds new content to a context that other people can see, Contexter shows the intended audience and requires an explicit confirmation. That rule is about contexts, and it is not a general promise that every disclosure is preceded by a question: it does not cover publishing a result into a Telegram chat, described below, and it does not cover what you yourself choose to send to a connected AI client.

The owner can revoke a member's future access. Revocation does not erase:

• records that the member authored and that remain lawfully stored;
• copies the member already downloaded or exported;
• information already sent, at a user's request, to an external AI client or other third-party service.

Removing a record from one context is not the same as deleting the underlying record. It may remain in its owner's personal record pool or in another context.

Reading a room's contexts in a Telegram group

In a Telegram group where the bot has been activated, the /contexts command answers any member of that chat. It is a question about the room rather than about the person asking, so it is answered even for a member who never opted in to having their own messages stored. The reply lists the room's contexts, and a member who opens one is shown the records in it: their titles, excerpts of their text, the display names of the people who wrote them, and the display names of the people in the context's audience.

What lies in a room's context is therefore visible to the room. This is deliberate: a context that belongs to a chat belongs to everyone in that chat. If you would rather your name or your contribution were not shown to everyone in a group, do not put them into that group's context.

Delivering a result into a Telegram chat

You can ask a connected AI client to publish its result into a Telegram group that you take part in. That publication is immediate. Contexter does not show a confirmation screen before it, and once the message has been sent it cannot be recalled or edited through Contexter. A connected client may decide, on its own, to ask you for approval before it acts, but that is a behaviour of that client and not something Contexter guarantees. What Contexter checks is only where the message may go: the group must be one that is actively collecting, and you must take part in it.

8. Public contexts, public links, and subscribers

A context can be published by link, and a published context is readable by people who are not in its audience and do not have a Contexter account.

Only the owner of a context can publish it, only from the Contexter web workspace, and only after a screen that states what is about to become public: how many records go out, that everything added later goes out as well, and — when the context has other members — that what those other people wrote goes out too. A context that belongs to a Telegram room cannot be published this way at all.

A published context has a page at an address of the form https://contexterai.com/c/<code>. That page opens without any sign-in: anyone holding the link can read it. It shows:

• the title of the context;
• its description, shortened to 280 characters;
• the display name of the owner, as Telegram provides it;
• the number of records in the context and the number of subscribers;
• the titles of the three most recent records and the beginning of the body of each of them, up to 160 characters per record.

Those three excerpts include records written by other members, when the context is shared. The page names no person except the owner: the display names of the people who wrote the records are not shown on it. Nothing beyond the fields listed above is published through the page — no files, no full record texts, and no list of the audience.

The page is closed to search engines, both by an instruction inside the page and by a header on the response. It is, however, deliberately left reachable by the robots that draw link previews, so that a card appears when the link is pasted into a chat. That preview card carries the title of the context, the two counts, and a fixed image; it carries no record content.

A person who opens a published context can subscribe to it. A subscriber is not a member of the audience: a subscriber may read the context, may not write into it, and is not shown who else has access. The fact that you subscribed, and the time you did so, are stored.

Switching the link off does not disconnect the people who already subscribed. It closes the door to new ones: the public page stops answering and nobody else can subscribe, but everyone who subscribed while the link was live keeps reading the context. This is a deliberate decision, not an oversight. A subscriber can stop subscribing at any time, and deleting the context ends access for everyone, subscribers included.

Publishing the link again does not revive the old address. Each time the link is switched on, a new address is issued, and the previous one stays dead.

9. Retention and deletion

• Active account and content: kept while your account is active and until it is deleted at your request, unless a longer period is required by law. There is no self-service account deletion inside the bot or the web workspace; account deletion is carried out by the operator on a request sent to the privacy address, and it is not reversible.
• Deleted records: the "Delete record" action removes a record everywhere and places it in a recoverable state for 7 days. During this period the author can restore it. After the recovery window, the content and stored attachments are permanently removed from active storage, subject to legal retention requirements.
• Removed records: "Remove from context" only removes the link from that context; it does not delete the underlying record.
• Deleted contexts: deleting a context deletes the context itself and its access list after the 7-day recovery window, but does not automatically delete the underlying records from their owners' pools.
• Web sessions: the protected web session cookie lasts for up to 30 days and ends earlier if you sign out, the session expires, or the linked access is revoked.
• OAuth connections: grants and tokens are retained until they expire, are revoked, or are no longer needed for the connection.
• Subscriptions to published contexts: a subscription is kept until you unsubscribe or the context is deleted. Switching the public link off does not end existing subscriptions.
• The campaign marker recorded at your first contact: kept for the life of the account.
• Hourly snapshots for the operations panel: deleted after 90 days, except for the most recent snapshot, which is kept until a newer one replaces it.
• Operational and security logs: retained for 30 days and then deleted or aggregated.
• Support and legal records: kept only as long as needed to resolve the request and meet legal or limitation-period requirements.
• Backups and infrastructure snapshots: automatic server backups are taken by the hosting provider (DigitalOcean) in the same hosting region (Amsterdam, the Netherlands), encrypted at rest, and rotated on a rolling basis so that no backup is kept longer than about four weeks.

Deleting a Telegram message does not delete the corresponding Contexter record because Telegram deletion events are not a reliable deletion instruction for the Service. Use Contexter's "Delete record" action or send a privacy request.

Records and contexts you can delete yourself, from the bot, the web workspace or a connected client. Account deletion and export of your data are not self-service: request them at privacy@contexterai.com and we will carry them out by hand. Privacy, export and deletion requests are not conditional on a paid plan.

10. Cookies

The web workspace uses a strictly necessary cookie to keep you signed in for up to 30 days. It is used for authentication and security, not advertising.

The website also remembers your light or dark appearance choice in a cookie named contexter-theme. It is written only when you choose an appearance yourself, it holds nothing but that preference, and it is not used to recognize you anywhere else.

Contexter uses Google Analytics to measure how the public pages of the website are used. The Google Analytics tag is loaded when you open a public page, unless you have turned analytics off. On your first visit a notice tells you that visits are counted, and it offers three things:

• OK: the notice goes away and your choice is remembered for one year in a cookie named contexter-analytics;
• Turn off: analytics is switched off and that is remembered for one year in the same cookie. From the next page you open, nothing from Google is loaded and no Google cookie is set by our pages;
• closing the notice: analytics stays on. The closing is remembered until you close your browser, so that the notice is not repeated on every page.

When the tag is loaded, Google sets its own cookies in your browser and receives usage information about your visit, such as the pages you view, characteristics of your browser and device, and an approximate location derived from your IP address, and processes it as described in its own privacy terms. Google is listed on our Subprocessors page. You can turn analytics off or back on at any time: every public page carries a Cookies control in its footer, which shows the current state and turns it over in one press. Turning analytics off rewrites the contexter-analytics cookie straight away; a tag already loaded into the page you are on cannot be taken back out of it, so the first page loaded without it is the next one you open.

This Privacy Policy, the Terms of Service and the Subprocessors page carry no analytics at all and never show the cookie notice.

Contexter does not use advertising cookies or cross-site tracking cookies.

11. Security

Contexter uses technical and organizational safeguards appropriate to an early-access service, including:

• HTTPS in transit and OAuth 2.1 for connected clients;
• server-side permission checks and scoped access;
• explicit confirmation for actions that widen the audience of a context, including publishing it by link;
• protected web sessions with revocation checks;
• short-lived, single-use file download links;
• minimization of content in application logs.

No online service can guarantee absolute security. Keep your connected accounts secure, review audiences before sharing, and do not store secrets that the Service is not designed to protect. If we identify a personal-data incident that requires notice, we will notify affected users and the competent authority as required by applicable law.

12. Your rights

Depending on applicable law, you may have the right to:

• know whether and how we process your personal data;
• access it and receive a copy;
• correct, update, or complete inaccurate data;
• delete data or terminate processing;
• restrict or block processing;
• withdraw consent;
• object to processing based on legitimate interests;
• receive data you provided in a structured, commonly used, machine-readable format where applicable;
• complain to a data-protection authority or court.

Contexter does not make solely automated decisions that produce legal or similarly significant effects about users.

To exercise a right, contact privacy@contexterai.com. We may verify the request through your linked Telegram account or another proportionate method. We respond within the period required by applicable law. Under Georgian law, many access, correction, and deletion requests must generally be handled within 10 working days, subject to lawful exceptions and permitted extensions.

If you are in Georgia, you may also contact the State Audit Office of Georgia—Personal Data Protection. If you are in the EEA or another jurisdiction, you may contact your local supervisory authority.

13. International data transfers

Contexter is operated from Georgia and hosts primary data in the Netherlands (Amsterdam, DigitalOcean). Connected clients and service providers may process data in other countries. The Service is available to people in the European Economic Area, and it is offered to them on the same terms as everywhere else. A representative in the European Union under Article 27 of the GDPR has not been appointed.

Where applicable law requires safeguards for an international transfer, we use an available lawful mechanism, such as an adequacy decision, contractual safeguards, or the data subject's informed instruction or consent where appropriate. Details of current providers and regions are available on the Subprocessors page.

14. Children

The Service is not directed to children under 18, and they must not use it or submit personal data. The Terms of Service set the same age requirement. If you believe a child has provided data without valid authorization, contact privacy@contexterai.com so we can investigate and delete it where appropriate.

15. Changes to this Policy

We may update this Policy when the Service, providers, or legal requirements change. The page will show the new effective date. If a change materially affects how we process existing data, we will provide additional notice through the Service where required.

16. Contact

Questions, complaints, access, export, or deletion requests:

Individual Entrepreneur Maksim Shirokov / Contexter
Email: privacy@contexterai.com
Address: 4a Tamarashvili Street, Tbilisi, Georgia