152-FZ · GDPR

Privacy policy

Working draft for the product. Counsel should review it for the operator’s legal entity. Dated 11 September 2026.

Who processes data

The operator of Corus (contact: Telegram @corus_ai_bot). Russian 152-FZ applies if you are in Russia. GDPR applies if you are in the EEA.

What we store

• Telegram user id, username, language, messages, voice notes, photos, files.
• Durable memory the bot keeps when you ask it to remember something.
• Encrypted Google and Yandex refresh tokens.
• Usage counters: LLM turns, STT seconds, web searches per day — for quotas.

Subprocessors

Telegram; Google (Gmail, Calendar, Drive/Docs/Sheets/Slides, OAuth); Yandex (Mail, Calendar, Disk, OAuth); the LLM provider; OpenAI Whisper; AnyAgent Search; hosting (AWS EC2 + Postgres). Sentry, if enabled, for application errors.

Why

To provide the assistant, authenticate you via Telegram, connect mail and calendar, stop one user from burning the shared API key, and meet legal duties.

Retention

Chats, memory, and tokens stay while you use the service. /delete wipes chats and memory and disconnects Google/Yandex. An admin can fully Erase an account. Postgres backups may retain a copy until rotation (target ~14 days).

Your rights

Access, correction, erasure: write in the bot or send /delete. Complaints in Russia: Roskomnadzor. In the EEA: your local supervisory authority.

Cookies

The public site is static, with no analytics and no cookies. The admin UI sets a session cookie only for the operator login.