Onim Privacy Policy

This Privacy Policy explains how AlmaStars Group (sole proprietorship, the Onim platform) collects, uses, stores and protects personal data. It follows applicable data protection law, including the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V of 21 May 2013 for users who are citizens of Kazakhstan.

1. Legal basis for processing

• Consent — given by registering on the platform and accepting this policy
• Performance of a contract — processing needed to provide the platform: accepting payments, granting access, handling orders and bookings, AI replies to the seller’s customers
• Legitimate interests — service security, fraud prevention, record keeping

2. What we collect

• Account identifier, username, profile name (Telegram ID when signing in with Telegram)
• The channel or group the seller connected the bot to
• Product texts, prices and settings created by the seller
• Identifiers of the seller’s customers (Telegram ID plus subscription or order status)
• Payment history and AI usage records
• Order form data for goods with delivery or services: full name, phone, city, delivery address and any other fields the seller configured
• The customer’s address when a service is delivered on site
• Payment receipt images uploaded by a buyer to confirm payment (these may contain the payer’s name and other details printed by the bank)
• Conversations between the seller’s customers and the AI assistant — for reply context and service quality

3. What we do NOT collect

• We do not read the seller’s private messages outside their own bot
• We do not share data with third parties other than the processors listed in section 4 (infrastructure, AI providers) and cases required by law
• We do not sell personal data, do not pass it to advertising platforms, and do not use order form answers or sensitive details for ad targeting. To measure our own campaigns we may compute aggregate figures inside Onim by UTM tag, order stage, number of purchases and revenue — without exposing Telegram IDs, form answers or receipts
• We do not store buyers’ card data

4. Who has access

• The seller — to all of their own data through the app
• The seller’s customers — to their own data through the customer app
• AI providers (Anthropic, Google, OpenAI, DeepSeek, xAI) — receive only the context required to generate a specific reply, and only to the extent needed to provide the service, under commercial API agreements; where the provider’s terms guarantee it, transferred data is not used to train models. The list of providers may change. Transfers outside Kazakhstan are described in section 5
• PS Cloud Services (ps.kz) — infrastructure provider storing and processing personal data of users who are citizens of Kazakhstan. Data centres are physically located in Kazakhstan (Almaty, Makataev St. 117A, LOTOS business centre)
• The Onim team — access limited to technical staff for incident resolution, under NDA

5. Where data is stored

Personal data of users who are citizens of Kazakhstan is hosted and processed on the infrastructure of the Kazakhstani cloud provider PS Cloud Services (legal entity: PS Internet Company LLP), whose data centres are physically located in Almaty, Kazakhstan (Makataev St. 117A, LOTOS business centre). This follows Article 12 of Law No. 94-V on localisation of Kazakh citizens’ personal data.

Cross-border transfer. Personal data of Kazakh citizens is stored in Kazakhstan. The content of requests processed by AI providers (Anthropic, Google, OpenAI, DeepSeek, xAI) to produce replies may be transferred and processed outside Kazakhstan. Such transfer is based on the user’s consent under Article 16 of Law No. 94-V and only to the extent needed to provide the service.

Storage access is protected by a service account with API keys issued by PS Cloud Services. Data travels over TLS 1.3. Backups run daily on PS Cloud Services infrastructure.

6. Retention

Data is kept while the account is active and for 6 months after closure (to resolve possible disputes), except records of transactions and settlements that must be kept for the periods set by Kazakh tax and accounting law. After those periods data is deleted or anonymised. You can request deletion earlier — see the data deletion page.

7. Connected social accounts (Threads, Meta, TikTok, YouTube)

If a seller connects their Threads, Instagram, Facebook, TikTok or YouTube account to publish content, we receive and use data only as far as publishing on the seller’s behalf requires:

• Access tokens (OAuth) — stored encrypted (AES-GCM) and used only to publish or schedule content
• The identifier, username and profile picture of the connected account, shown in the cabinet so the seller can see which account a post will go to
• Basic profile information provided by the platform at authorisation

We publish only when the seller presses Publish, we never read private messages, and we do not pass this data to third parties. We do not store copies of published posts: the post lives in your Threads profile, and we keep only the publication result.

You can disconnect at any time in the cabinet (my.onim.app → Social → Disconnect). If instead you remove the Onim app in your Threads or Meta settings, Meta calls our uninstall and deletion endpoints and we delete the stored token automatically. Our use of Meta data complies with the Meta Platform Terms and Developer Policies. See the data deletion page.

8. Your rights

Under applicable law you may:

• Obtain information about what data we hold and how we process it
• Ask us to correct inaccurate data
• Request deletion of your account and all related data (except records we must keep by Kazakh law) via @onimsupport, [email protected] or the data deletion page — deletion is completed within 30 calendar days (backups are purged within 90 days)
• Withdraw consent (this ends provision of the service)
• Complain to the competent data protection authority

9. Payments

Buyers pay the seller directly using the seller’s own payment details (through their bank or payment app). The platform does not take part in settlements, does not hold funds and is not a payment agent; it receives confirmation of payment (a receipt) and the amount, in order to grant access or create an order. Buyers’ card data is never collected or stored by the platform.

10. Security

• API access is verified by the cryptographic signature of Telegram init_data or by a session token
• All connections use TLS 1.3
• Logs, backups and third-party access tokens are encrypted
• Staff access to data is logged

11. Cookies

onim.app uses only technical cookies and local storage needed for the site and the cabinet to work. We do not use analytics or advertising cookies and do not run advertising pixels on our own pages.

12. Changes

We notify users of material changes through the app and/or a message from the platform bot @onimappbot.

13. Contact

Questions about personal data:
AlmaStars Group (sole proprietorship), individual identification number 930309351177
Registered address: 79 Nurkent, Almaty, Republic of Kazakhstan
Email: [email protected]
Telegram support: @onimsupport