Privacy

What we know about you, and why

Last updated 28 July 2026 · English version

Written to be read, not to be survived. If anything here is unclear, ask us — the contact details are at the bottom and a real person answers.

1. Who is responsible for your data

Controller: [to be published]
Address: [to be published]
NIP: [to be published]
Email: support@chatahunter.com
In Telegram: @ChataHunterBot → /support

"We", "us" and "Chata Hunter" below mean that person. There is no separate company, no data-protection officer (we are too small to be required to appoint one), and no sales or marketing department that gets a copy of your data.

2. What we store

Everything in this table is data you gave us by using the bot, or that the bot produced while working for you. We do not buy data about you, and we have no way to see your Telegram account beyond what Telegram passes to a bot you have started.

What	Specifically	Why we have it
Your Telegram identity	Your numeric Telegram ID, your @username and first name if you have them, and your Telegram language setting.	It is the only way to know which chat to send a match to. We never see your phone number or your contact list.
Your searches	Each saved search: city, districts, price range, room count, size, and the filters you set.	This is the product — without it there is nothing to match listings against.
Your places ⚠️	Any location you save for commute times, as a label you chose plus its exact latitude and longitude, and the calculated travel times from listings to it.	To tell you how far a flat is from your work or your kid's school. This is the most sensitive thing we hold — if you save your home, we hold your home's coordinates. You can delete a place at any time in the app, which deletes its coordinates and its cached travel times.
What we sent you	Which listings were delivered to you, when, why they matched, whether delivery succeeded, and which listings you saved as favourites.	So we don't send you the same flat twice, and so we can tell whether the bot is actually working.
Your conversations with the AI	The full text of your messages in `/chat` and the AI's replies, kept as a thread so it remembers context between messages.	To hold a conversation instead of starting from zero every message. See section 4 — these messages are sent to Google.
Support messages	What you write via `/support` and the replies. We keep tickets as a record rather than deleting them.	So a complaint has a paper trail, in your interest as much as ours.
Payments	What you bought, when, how many Telegram Stars, and the resulting subscription state. We never see your card, bank or Telegram Wallet details — Telegram handles the payment and tells us only that it succeeded.	To give you what you paid for, to handle refunds, and because tax law requires us to keep records of sales.
Product analytics	A log of events — that a search was created, a card delivered, a chat opened — each with your Telegram ID and a timestamp.	To see which parts of the bot work and which are broken. It is counted, not read as a story about you.
Where you came from	If you arrived through a link with a referral code (for example from an ad), the code itself.	To know which channels bring real users, so we stop paying for the ones that don't.

On this website

This site sets no cookies and runs no third-party analytics, no advertising pixels and no tracking scripts — nothing here reports your visit to anyone. It stores nothing at all in your browser: the language you are reading is decided by the address you are on (/pl/, /uk/, /ru/), not by anything we kept about you. Our hosting provider processes standard server logs (IP address, request time, browser string) to serve the page and absorb attacks.

3. Why we are allowed to hold it (legal bases)

To perform our contract with you (GDPR Art. 6(1)(b)) — your identity, searches, saved places, deliveries, favourites, chat threads and subscription state. Without these the bot cannot do the thing you asked it to do.
Our legitimate interests (Art. 6(1)(f)) — product analytics, abuse and fraud prevention, and keeping support tickets as a record. We have weighed this against your privacy: the analytics are aggregate-facing, and none of it is sold, shared for advertising, or used to profile you as a person.
Legal obligation (Art. 6(1)(c)) — payment and invoicing records, which Polish tax law requires us to retain.

We do not rely on consent for any of the above, which means there is no consent for you to withdraw — but you can object to the legitimate-interest processing, and you can delete your data entirely. See section 6.

4. Who else sees your data

We do not sell your data. We have never sold your data, and the business model does not depend on ever selling your data. The following services process some of it because the bot cannot function without them:

Who	What they get	Where
Telegram	Everything you send or receive, because it is the messenger the bot lives in. Your relationship with Telegram is governed by Telegram's own privacy policy, not this one.	Outside the EEA
Google (Gemini API)	The text of your AI-chat messages, and listing photos when photo analysis runs. Sent to generate a reply, per Google's API terms for paid API use.	Outside the EEA
Geoapify	Coordinates — a listing's, and your saved place's — to calculate travel time between them. No identity, no Telegram ID.	Germany (EEA)
OpenStreetMap (Nominatim / Overpass)	Addresses and coordinates from listings, to turn a street name into a map pin and find what is nearby. Not your personal locations.	EEA / United Kingdom
Hetzner	Hosts the server and the database — so technically, all of the above sits on their hardware.	Germany (EEA)
Cloudflare	Serves this website and the in-Telegram app, and sees the network requests that reach them.	Global

Transfers outside the EEA. Telegram and Google are the two that take data out of Europe. Both are used under their standard data-processing terms, which incorporate the European Commission's Standard Contractual Clauses. If you would rather no AI provider ever received your words, do not use /chat — every other part of the bot works without it, and it is the only feature that sends your own writing to a third party.

5. How long we keep it

While you use the bot — your account, searches, places and settings stay until you delete them or ask us to delete the account.
Delete a place or a search yourself and it is removed from the live database immediately, along with anything derived from it, such as cached travel times.
Delete the whole account yourself — send /deletemydata in the bot and confirm once. It is removed from the live database immediately, not queued for later. If you would rather ask a person, email us or use /support and we do it by hand within 30 days.
Payment records we must keep for 5 years from the end of the tax year, because Polish tax law says so. These survive an account deletion — but stripped of any link to you. What is left is an anonymous record that a sale happened; your identity goes with the rest of the account.
Support tickets we keep as a record of what was asked and answered. They are your own words, so deleting your account deletes them too. You can also ask us to delete a single ticket, unless it relates to an open payment dispute.

6. Your rights

Under the GDPR you can ask us to:

Show you everything we hold about you, as a file you can keep (access and portability).
Correct anything wrong.
Delete your account and its data (erasure) — yourself, in seconds, subject only to the anonymised payment records above.
Restrict or object to processing based on our legitimate interests, including the product analytics.

How to actually do it: to erase everything, send /deletemydata in the bot. It lists exactly what is about to be destroyed, asks you to confirm once, and then does it on the spot — no email, no ticket, no waiting on us. For anything else on this list — a copy of your data, a correction, an objection to the analytics — message /support in the bot or email support@chatahunter.com and one person, the one named in section 1, will handle it. We answer within 30 days and in practice much faster.

If you think we have handled your data badly, please tell us first — it is usually a mistake we can fix the same day. You also have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or to the authority in the EU country where you live.

7. Things we do not do

We do not sell or rent your data, to anyone, for any price.
We do not take money from landlords or agencies to rank a listing higher. Nothing on the bot is a paid placement.
We do not use your data for advertising, and we do not run advertising trackers.
We do not make automated decisions that have a legal effect on you. The AI's opinion about a flat is advice you are free to ignore; nothing decides anything about you.
We do not read your chat threads for entertainment. They are read when you ask for support, or when we are debugging something broken.

8. Children

Chata Hunter is not for children. You must be at least 18 to use it, because renting a flat and paying for a subscription are both things a minor cannot do. If you tell us an account belongs to a child, we will delete it.

9. Changes to this policy

If we change how we handle your data in a way that matters, we will change the date at the top and — for anything significant — tell you in the bot. We will not quietly widen what we do with your data and rely on you not re-reading this page.

10. Contact

Email support@chatahunter.com, or send /support in @ChataHunterBot. Write in English, Polish, Ukrainian or Russian — all four are read.