Privacy policy.

1. Controller and processor split

In the context of the services provided by Shallotbots, the client organisation (the entity deploying the bot into their operations) acts as the Data Controller. Shallotbots acts solely as a Data Processor on behalf of the client. We process operational data exclusively according to the client's documented instructions and configurations.

2. Explicit processing boundary

Shallotbots is deployed into the client's existing Telegram groups and is designed to minimize data collection in those noisy environments. Only messages, voice notes, and media that explicitly tag the bot are processed. All other ordinary group chatter is ignored and is not ingested, stored, or analyzed by our systems.

3. Categories of data processed

When the bot is explicitly tagged, we process the following categories of data to provide our service:

• Text messages: The contents of the message directed at the bot.
• Voice notes: Audio recordings tagged for the bot to transcribe and extract action items.
• Photographs and media: Images of site defects, machinery, or progress milestones submitted for tagging and context extraction.
• Sender identity and metadata: The sender's Telegram identifier, timestamp, and group context, used to accurately attribute reports.
• Derived records: The structured tickets, spreadsheet rows, and summary reports generated by the AI from the raw input.

4. Purposes and lawful basis

The processing of this data is strictly for the purpose of delivering the Shallotbots service: compiling operational updates, generating structured records, providing on-site remediation steps based on client SOPs, and alerting relevant personnel. The lawful basis for processing this data is the performance of the contract between Rhythmake and the client organisation.

Client operational data is never used to train our foundational AI models.

5. Sub-processors

To deliver our service, we engage third-party sub-processors. These sub-processors are restricted by contract to process data only as necessary to provide their specific functions. The categories of sub-processors we use include:

• Cloud infrastructure and secure hosting providers.
• Speech-to-text and specialized AI model providers (accessed via secure APIs with zero-retention or non-training agreements).
• Spreadsheet synchronization and email delivery services designated by the client for report output.

6. Retention and security

Operational data is retained on a defined schedule agreed upon with the client organisation. Once data is successfully structured, exported to the client's systems (for example, the dashboard or spreadsheets), and the operational retention window expires, the raw chat inputs and media are securely deleted.

We implement robust technical and organizational measures to ensure a level of security appropriate to the risk, including encryption in transit and at rest, strict access controls, and auditable logging.

7. Data subject rights

Individuals whose data is processed by Shallotbots have rights regarding their data, including the right to access, correct, delete, or export their information. Because we act as a Data Processor, requests regarding data subject rights should be directed to the client organisation (the Data Controller). We will assist the controller in fulfilling these requests as required by law.

8. International transfers

Where operational data is transferred across international borders, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses, to maintain the security and legality of the transfer under applicable data protection laws.

9. Policy updates

We may update this Privacy Policy periodically. Significant changes will be communicated directly to client organisations via their designated operational contacts before the changes take effect.