Privacy Policy

Last updated: 18 October 2026

Controller

Valentyn Vihandt, sole proprietor (Einzelunternehmer), Kollergasse 17/4, 1030 Vienna, Austria, email valentyn@kindt.agency. When a business uses Dobby for its team, that business is the controller of its business data; we then process it as a processor under an agreement pursuant to Art. 28 GDPR.

What Dobby is

Dobby is an AI agent you use in Telegram. He carries out tasks in accounts and services you connect (e.g. email, calendar, customer portals), on the service's own devices and on the computer (e.g. documents, research, video editing). Outward steps — sending, paying, publishing, deleting — happen only after you confirm them in the chat.

Which data we process

• Account data: name, Telegram ID and username, email address and phone number if provided.
• Content you send to Dobby: messages, voice messages, photos, files and tasks.
• Data from connected accounts and services, only as far as your tasks require, and the access credentials (tokens) granted for them.
• Balance, payments and task history; technical logs.

Payment card data is processed by the respective payment provider; we do not store card data.

Purposes and legal bases

Providing the service and billing (contract, Art. 6(1) lit. b GDPR); security and abuse prevention (legitimate interest, Art. 6(1) lit. f GDPR); statutory retention duties (Art. 6(1) lit. c GDPR). We do not sell data, do not use it for advertising and do not use your content to train AI models.

Connected accounts

Dobby accesses an account only after you have connected it yourself — via the provider's sign-in page or a one-time Dobby page; passwords never appear in the chat. Credentials are stored encrypted with restricted access and are never passed to an AI model. You can disconnect any connection at any time: in the chat, at the provider or by emailing us.

Instagram and Facebook data (Meta)

When you connect an Instagram professional account (Business or Creator), you sign in on Instagram's own page and grant the app “KINDT Marketing Agent”, through which Dobby is connected to Meta, the permissions shown there; we never receive your password. We receive an access token and, for the connected account only: user ID, username, name, profile picture, follower and media counts; posts, reels and stories with captions, permalinks and insights (views, reach, likes, comments, saves, shares, watch time); account insights and aggregated audience demographics; comments on your media and your replies; and, if you grant it, direct-message conversations (read only — Dobby does not send direct messages).

When you connect a Meta ad account (Facebook Login for Business), we receive for the selected ad accounts: names and IDs, currency, campaigns, ad sets, ads, their statuses and budgets, targeting summaries and performance statistics. Changes (pause, activate, budget) and publications happen only after your “Yes” in the chat.

We do not access personal Facebook profiles, friend lists, other people's accounts or payment details. Meta data is used only for your requests, never shared with other customers and never used for advertising, profiling or AI training. Data and tokens are kept until you disconnect or end the service. How to delete them: Data deletion.

Where and by whom data is processed

• Hosting: Hetzner Online GmbH (Germany), servers in the EU (Germany, Finland); encrypted backups on our own devices in Vienna.
• AI models: Anthropic PBC and OpenAI (USA). Content needed for a task is sent to the model to understand requests and write answers; it is not used there for training. If you connect your own AI access (e.g. Google Gemini), your provider's terms apply to that content.
• Telegram transports the chat messages; Meta Platforms and other services you connect act as data sources.

Transfers outside the EEA rely on an adequacy decision (EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

Retention

Connected-account data and tokens until you disconnect or the service ends. Chat history, files and logs on request and no later than 90 days after the service ends; billing records as long as tax law requires (7 years in Austria).

This website

This website sets no cookies and uses no analytics. The web server logs technically necessary access data (IP address, time, page requested) for at most 14 days. Fonts are loaded from Google Fonts, which transmits your IP address to Google.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and may withdraw consent at any time. Write to valentyn@kindt.agency. You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.