Data Deletion

What data can be deleted

• The user profile (account identifier, email, Telegram ID, name and profile name, Google sign-in data, password hash).
• Connected social and messaging accounts (Threads, Instagram, WhatsApp Business and other services connected by the Author): encrypted access keys, the account identifier, name and profile picture (if the network provides them), and automatic reply settings.
• Content published or scheduled through the Platform (the content plan).
• Conversations with customers in connected channels (Telegram bot, Instagram Direct, WhatsApp), including trigger-word comments, the AI assistant’s replies and data recognised from receipts.
• Customer data, orders and analytics.
• Payment and transaction history, subject to the limits in “What is kept after deletion”.

How to request deletion

You can request deletion in any of the following ways:

1. By emailWrite to support@onim.app with the subject “Data deletion” (or marked “personal data”), stating your Telegram ID or account email and what should be deleted: the whole account or particular data (for example, conversations or the content plan).
2. On TelegramMessage support at @onimsupport.
3. Yourself (social account access key)Disconnect the account in the cabinet (my.onim.app → “Apps” → “Social and messengers” → “Disconnect” next to the account; details: “Revoking access to social accounts”) or remove the Onim app in the Threads or Instagram settings. A Telegram bot is disconnected differently: see “Revoking access to social accounts”.

Deletion of the whole account, the content plan and customer data is carried out through support. In the Telegram cabinet an Author can delete conversations with selected customers personally (“Удалить насовсем” (Delete permanently) in the dialog archive); payment records are kept in that case, and deletion of these conversations from the copy kept in the Republic of Kazakhstan is carried out on request through support.

Before deleting, the Platform verifies that the request comes from the owner of the account or contact and may ask you to write from the email or Telegram account linked to the account or to confirm the request in another way. The Platform may decline to act on a request until it is verified. A request on behalf of another person is accepted from a legal representative or under a power of attorney with supporting documents. The Platform grants access to data or deletes it at the request of heirs, co-owners or other third parties only on the basis of notarised documents or a court decision. If ownership of an account is disputed, the Platform may suspend the request until the parties agree or a court decides.

Revoking access to social accounts

When you connect an account, Onim stores an encrypted access token, the account identifier, name and profile picture: this is enough to publish and reply on your behalf. Posts you prepared or scheduled through Onim (text, image and a link to the published post) are stored in your content plan. If you connected Instagram Direct or WhatsApp, the Platform processes messages addressed to your business in those channels to run the assistant, record orders and recognise receipts; the Platform does not receive users’ conversations outside the connected channels. The content plan and conversations are stored while your account is active or until you or your customer request their deletion.

Disconnecting a social account erases the access token and cancels the posts scheduled for that account. The content plan itself (texts, images, links to published posts) and conversations with customers are not deleted by this: they are deleted on request through support (see “How to request deletion”).

Access can be revoked in three ways:

• In the cabinet: my.onim.app → “Apps” → “Social and messengers” → “Disconnect” next to the account. For WhatsApp, there is an “Open” button instead: “Open” → “Remove”. For Threads connected directly: “Open” → “Threads” → choose the account → “Disconnect account”. Instagram connected directly by signing in with Instagram cannot be disconnected in the cabinet: remove the Onim app in the Instagram settings (next item) or contact support. Your own TikTok and YouTube: “TikTok and YouTube with the Onim app” → “Disconnect”. The access key is erased immediately. A Telegram bot cannot be disconnected in the cabinet: revoke its token in @BotFather with the /revoke command and request removal of the bot token from Onim through support.
• In the network’s settings: remove the Onim app (Threads: Settings → Account → Website permissions; Instagram: Settings → Website permissions → Apps and websites). Onim’s access then ends on Meta’s side. On receiving a notice of disconnection or a data deletion request from Meta, the Platform erases the token (for Instagram connected directly through the Onim app, together with the automation settings) without you contacting support. Delivery of these notices is Meta’s responsibility. To make sure the token is erased immediately, also disconnect the account in the Onim cabinet where this is available; for Instagram connected directly, contact support.
• By request to support: see “How to request deletion” above.

If an Instagram account is connected through the provider InstantDM, or a WhatsApp number through 360dialog, disconnect it in the Onim cabinet: this erases the provider’s key in Onim but does not revoke the provider’s own access to your account or number. To revoke it, disconnect the account in the provider’s dashboard. Data held by the provider itself is stored and deleted under the provider’s rules.

Data of an Author’s customers

If you bought from an Author or wrote to the Author’s bot, Instagram or WhatsApp, the Author is the operator of your data: send your deletion request to the Author. If you contact Onim, the Platform may forward the request to the Author and invite the Author to respond within the period stated in that notice to the Author. If the Author does not respond within that period, cannot be found, or the law so requires, the Platform may carry out the request itself in its own storage and notify the Author. Purchase records are kept to the extent described in “What is kept after deletion”.

As the operator of its customers’ data, the Author obtains their consent to processing itself, including consent to transfer to the Platform, its processors and outside the Republic of Kazakhstan, responds to their requests itself, and is responsible for data it has copied, obtained from the cabinet or processes outside the Platform. The Platform is not responsible for such data. The Author compensates the Platform for losses under claims caused by the Author’s lack of a lawful basis for processing, under the rules of the Terms of Service.

Deleting an Author’s account

An Author’s account is deleted on request through support. Before making the request, the Author must fulfil paid orders and subscriptions or refund the money for anything not provided, and notify buyers who have active access. The Author’s obligations to buyers survive deletion of the account (Terms of Service, Refund terms).

• Postponement. Until obligations are settled (active marketplace orders and disputes, the Author’s debts, including for refunds, chargebacks and a negative token balance, pending payouts, and access or orders paid for by buyers but not yet provided), the Platform may postpone deletion of the account and keep the data needed to perform and defend those obligations on the grounds provided by law (performance of a contract, protection of rights and legitimate interests, legal requirements). During that time the Platform may suspend acceptance of new payments and the Author’s storefront. Data not needed for these purposes is deleted on request in the ordinary way. The Author’s debt to the Platform does not end with deletion of the account.
• Tokens. Purchased tokens are payment for the Platform’s services: money for them is not refunded, and they are not exchanged for money or withdrawn, except in cases expressly provided for by law and for an erroneous or duplicate payment; bonus and gift tokens are never refunded. Use the tokens or apply for a refund (where one is due) before requesting deletion: after the account is deleted, the remaining tokens cannot be used. Records of purchased tokens are kept in the accounts, and deletion of the account does not end any rights the law gives the Author. Partner programme remuneration is withdrawn under the rules of the Terms of Service once the withdrawal threshold is reached; submit the withdrawal request before requesting deletion. Marketplace earnings are not withdrawn in money; they may be spent on the Platform’s services before deletion. A balance below the threshold is not paid out in money. The Platform may set off the Author’s debts against amounts due to the Author. Deletion of the account ends partner links and future accruals under them.
• Domains. When the account is deleted, the Platform may immediately disconnect a domain purchased through the Platform from the site, switch off auto-renewal and not renew the registration. A transfer of the domain can be requested before the account is deleted: the Platform may transfer it under the rules of the registrar and the registry if the renewal is paid and there are no debts or complaints. A custom domain connected through DNS stays with the Author; the site stops being shown on it and redirection from onim.app/<handle> stops.
• The onim.app/<handle> address may be assigned to another user after a period set by the Platform.
• Data of the Author’s buyers is deleted together with the account within the timelines in “Deletion timelines”, except purchase records needed for disputes and accounting (see “What is kept after deletion”). Buyers’ claims related to the Author ceasing operations are made against the Author. At a buyer’s request, the Platform may provide the buyer with the Author’s contacts and the stored records of the buyer’s purchase.

Deletion timelines

Access keys of connected accounts are erased immediately when disconnected in the cabinet and, for Threads and Instagram, also after Meta notifies us that the Onim app was removed in the network’s settings (see “Revoking access to social accounts”). Deletion of an account and related personal data under a verified request is carried out within the periods set by Law of the Republic of Kazakhstan No. 94-V “On Personal Data and Their Protection” and, where the law does not set a period, no later than 30 calendar days from the day it is verified that the request comes from the owner of the account or contact. If deletion is postponed under “Deleting an Author’s account”, the period runs from the day the obligations are settled. Data is deleted in the Platform’s working storage, including the copy of personal data of citizens of Kazakhstan on a server in the Republic of Kazakhstan.

Backups are not edited selectively: the Platform makes backups daily and keeps them for a limited period, after which they are overwritten on rotation. Until overwritten, the backups are used only to recover from a failure. Deletion on request is irreversible: the Platform is not obliged to restore data deleted at your request and does not accept requests to restore it. If working storage is restored from a backup after a failure, the Platform takes reasonable measures to ensure that data previously deleted on request does not return to use.

What is kept after deletion

• Accounting. Records of transactions, receipts, refunds, commissions and payouts that the Platform must keep under the law of the Republic of Kazakhstan (tax and accounting) are kept to the minimum extent necessary for the periods set by law.
• Disputes and investigations. The Platform may keep data on transactions, access, order-related conversations, refunds and chargebacks until a dispute ends or, if no dispute is raised, within the limitation period for claims related to the transaction under the Civil Code of the Republic of Kazakhstan. Data needed to investigate fraud or to comply with requests of competent authorities is kept until the investigation ends or the request is fulfilled. In these cases the Platform may refuse or postpone deletion. Where there are signs of fraud, the Platform may keep data, suspend the account and payouts, and provide data to the competent authorities of the Republic of Kazakhstan on their lawful request. Requests from foreign authorities are fulfilled only in the manner provided by the law of the Republic of Kazakhstan. The Platform may keep records of a deletion request and how it was carried out (date, channel, contact, scope of deleted data), and the minimum identifiers of an account blocked for violations, to prevent repeat registration.
• Data held by other services. Messages in Telegram, Instagram and WhatsApp remain with those services and with the other party to the conversation. Data passed to AI providers (listed in the Privacy Policy) and Meta pixel events already sent to the Author’s ad account are stored and deleted under the rules of those services. Payment records held by the banks and payment services through which a payment passed, and by channel connection providers (for example, InstantDM and 360dialog), are stored and deleted under their rules and the applicable law. The Platform stops passing data to these services but does not control their storage and cannot delete it.

Retained data is used only for the purposes for which it is kept: accounting, resolving disputes, refunds and chargebacks, settlements, protecting the Platform’s rights and legitimate interests, preventing fraud, and complying with the law and requests of competent authorities. The Platform may use anonymised information that cannot identify a person for statistics and service improvement.

Confirmation

Once the request is processed, we send a deletion confirmation to the contact you provided (Telegram or email). If deletion is postponed or refused in part, we state the reason unless the law prohibits it. Requests received from Meta are confirmed by the code and status page described in “Revoking access to social accounts”.

Changes to this page

The Platform may change this page. A new version is published at onim.app/data-deletion with its date and takes effect 7 calendar days after publication, unless it states a later date. Changes required by law or a competent authority may take effect on the date of publication. The Platform may additionally notify Authors through the cabinet, @onimappbot or by email. A deletion request is carried out under the version in force on the date it is received, unless the new version is more favourable to the requester. Previous versions are available on request to support.

Governing law and disputes

Relations concerning the processing and deletion of data are governed by the law of the Republic of Kazakhstan. Claims are sent to support@onim.app or @onimsupport and are considered within the periods set by the law of the Republic of Kazakhstan. Disputes with Authors are resolved in the manner provided by the Terms of Service. A user may appeal against the Platform’s actions to the authorised body for personal data protection or to a court. A buyer who is a consumer retains the mandatory consumer protection and personal data rules of the buyer’s country of residence. In case of discrepancy between the Russian and English versions, the Russian version prevails.

Contact

Questions about data deletion:

Requests are accepted at any time and answered in the order received. Deletion requests are carried out within the timelines in “Deletion timelines”.