Privacy Policy
Review version: review-draft. This Policy explains how StickerKit handles personal data.
Who we are
StickerKit operates the @stickerkit_bot Telegram bot and the StickerKit Mini App at app.stickerkit.app.
- Data controller
- Not published in this review build.
- Seller
- Not published in this review build.
- Postal address
- Not published in this review build.
What we process, and why
- Your photo. We use the photo you send to make the stickers you asked for and keep it in private storage so we can finish, repeat or extend your order. We don't use it for anything else: never to build a database of faces and never to train a model. You can ask us to delete it at any time (see Your rights).
- A record of your upload. We keep a short record of your order in progress: the style and emotions you chose and a pointer to your photo, so the bot and the Mini App can carry on with the same order or start it again if it was interrupted.
- The stickers we make. Previews, the sheets the model draws, sticker images and the pack we publish are kept in private storage so we can show them to you, publish them, add to them and restore them if something goes wrong. Our team sees them in the service notifications described below.
- Error reports. When something breaks, an error-monitoring service receives a technical report about it. We set it up not to include personal details by default.
- Account and usage data, stored in our database: your Telegram user ID and the profile details Telegram gives the bot (first and last name, username, language, Premium flag, profile photo link); the link that brought you to the bot; whether the bot can still message you; your orders with their style, emotions, status and price; your packs and their Telegram names; free stickers and rewards you received; events such as a story that mentions the bot; and which reminders we have sent you. The product does not ask for your phone number or email address.
- Payments. Purchases are made with Telegram Stars. Telegram processes the transaction – we never see or store your card, bank, or wallet details. We store the amount, currency, status and Telegram's payment identifiers, and, when a friend pays for your pack, their Telegram user ID.
- What you choose to share. If you let us show your pack in our public Telegram channel, we post a picture of its stickers there with a link to the pack. A story you post is published by Telegram from your account. If you ask a friend to pay for your pack, they see a picture of it and your Telegram name, and after payment we tell you who paid.
- Mini App session recordings. When you use the Mini App, a session-recording service records the screens you see and what you do there (taps, scrolling, errors), linked to your Telegram user ID and username, so we can find and fix problems. The data that signs you in is removed from recordings.
- Notifications for our team. Our team receives service notifications in a private Telegram chat: new users (name, username, Telegram user ID, language), orders, payments, rewards, and pictures of the stickers generated for each order. We use them to watch quality and fix problems.
Our legal basis for processing (GDPR)
- Performance of the service at your request (Art. 6(1)(b)) to stylize the photo you choose and deliver previews and packs. StickerKit does not use the photo to uniquely identify or authenticate you and does not build a biometric template.
- Purpose limitation. StickerKit does not use your photo for advertising, unique identification, authentication, or training its own model.
- Legitimate interest (Art. 6(1)(f)) to prevent abuse, diagnose errors through error reports and Mini App session recordings, watch generation quality through our team's notifications, and understand product usage through the event log.
- Consent (Art. 6(1)(a)) to show your pack in our public Telegram channel. You can withdraw it at any time by asking us to remove the post.
- Legal obligations (Art. 6(1)(c)) to keep payment records where the law requires it.
Where your data is processed
Telegram handles messaging and Stars payments under its own terms. Enabled infrastructure and processors, their processing scope, and their retention or logging settings are identified below. StickerKit does not sell personal data or use it for third-party advertising.
- Application hosting
- Not published in this review build.; region: Not published in this review build.
- Database
- Not published in this review build.; region: Not published in this review build.
- Object storage
- Not published in this review build.; region: Not published in this review build.
- AI generation provider
- Not published in this review build.
- AI processing locations or scope
- Not published in this review build.
- AI provider retention
- Not published in this review build.
- AI request-response logging
- Not published in this review build.
- AI provider training use
- Not published in this review build.
- Edge, CDN, and DNS provider
- Not published in this review build.
- Edge processing scope
- Not published in this review build.
- Diagnostics provider
- Not published in this review build.
- Diagnostics data scope
- Not published in this review build.
- Source-media metadata handling
- Not published in this review build.
- Subprocessor register
- Not published in this review build.
- Register version
- Not published in this review build.
- Register SHA-256
Not published in this review build.- Transfer safeguards
- Not published in this review build.
How long we keep things
The schedule below applies by data category rather than by a particular runtime, filesystem, or database implementation.
- Retention policy version
- Not published in this review build.
- Source uploads and generation inputs
- Not published in this review build.
- Generated previews, stickers, and share assets
- Not published in this review build.
- Account, entitlement, consent, and usage records
- Not published in this review build.
- Orders, payments, refunds, gifts, and subscriptions
- Not published in this review build.
- Provider usage and cost records
- Not published in this review build.
- Diagnostics and security events
- Not published in this review build.
- Disaster-recovery backups
- Not published in this review build.
Your rights
If GDPR applies to you, you can ask us to access, correct, delete, or export your data, or to restrict or object to processing, and you can complain to the data protection authority in your country. You can ask us to delete your photos, stickers and account data; we will do so unless the law requires us to keep a record, for example of a payment. Blocking the bot or deleting the chat does not delete them automatically, and the original Telegram message remains subject to Telegram’s retention and your chat history. Equivalent rights may apply under the LGPD in Brazil and other applicable laws. Start a request through privacy support in the bot or use the contact details below. Support may need to verify that the account is yours and will explain the next steps; opening the chat does not delete data automatically or immediately.
Age and other people in your photo
StickerKit is for users aged 18 or older. By using the service you confirm this yourself; we do not verify a birth date or identity. Only upload a photo of another person – or of a minor – if you have their consent, or a parent's or guardian's consent, to turn it into a sticker pack. Don't upload photos of people who haven't agreed to this.
Security
- Production technical and organizational measures
- Not published in this review build.
No system is perfectly secure. If StickerKit learns of a personal-data breach, it will notify affected people and the relevant authority where applicable law requires notification.
Changes to this policy
We'll update the date above whenever we make changes, and flag significant ones in the bot.
Contact
Questions, privacy requests, and notices can be sent by email or through bot support.