Skip to content
CARO
RUEN
Open
  1. CARO
  2. Documents

Privacy policy

As of 4 October 2026Version 2026-10-04

What data the CARO service processes, why, who receives it, how long it is kept and how to delete your account or individual data.

1. Who processes the data

The personal data controller is Individual Entrepreneur KHAMDAMOV IKROMJON KOBILOVICH, Republic of Uzbekistan, individual entrepreneur (YaTT) registration No. 7999753 of 9 September 2026, taxpayer ID (TIN / PINFL) 31101986180053 (the “Operator”). Address: 5 Rokhat, Motrid Bogi, Samarkand, Samarkand Region, 140100, Republic of Uzbekistan. Contact: support@ferzmedia.app, phone +971 50 135 7662.

This Policy covers the Telegram bot @Ferz_aibot, its mini app and the website ferzmedia.app (together, the “CARO Service”).

2. What data we process

  • Telegram data: user ID, first and last name, username, profile photo link, language. Telegram passes them when you open the mini app or write to the bot. The Service does not ask for your phone number.
  • Account settings: interface language, time zone (taken from your device), notification and retention settings.
  • Content: chat messages, including those with the bot; the text of documents you attach (the document is read in your browser and only its text is sent to the server); uploaded JPG, PNG and WebP images; voice messages — the audio itself is not kept, the recognized text is.
  • Results: the texts, images, carousels and videos created, and their versions.
  • Projects and brand: name, niche, audience, tone, goals, colours, fonts, logos and examples; facts the assistant remembers about you and your business. The assistant does not remember passwords, codes, bank card data, document numbers or diagnoses.
  • Payment records: orders, amounts, currency, statuses and payment identifiers. The Operator never receives or stores card numbers or other card data.
  • Support requests and the correspondence about them.
  • Technical data: in session records, hashes of the IP address and browser (the IP address and browser are not stored in clear), sign-in and activity times; a hash of the IP address to limit request rates; an operations log without IP addresses or request content (section, response code, duration, request number).
  • Cookies and browser storage — see “Cookies”.

3. Why

  • to provide the service: create, store, show and deliver results to Telegram, keep projects and the assistant's memory;
  • to account for credits and payments and to make refunds;
  • to answer support requests;
  • to keep the Service secure and prevent abuse: sign-in, request rate limits, checking requests against the Service rules;
  • to meet legal requirements, including accounting for payments;
  • to monitor how the Service works using anonymous technical metrics.

We do not sell data, do not show ads and do not use data for advertising.

4. Legal grounds

Performance of the agreement (offer) you enter into by starting to use the Service; your consent, given when you accept the offer and this Policy, including separately before a payment; the Operator's legitimate interest in the Service's security; legal requirements.

5. Who receives the data

  • Telegram — messages, files and notifications in the bot chat, mini app sign-in.
  • Cloudflare, Inc. (USA) — hosting: the application, database, file storage, image processing and slide rendering.
  • OpenRouter, Inc. (USA) — access to AI models. For a generation it receives the request text, chat history, memory facts and brand data, photos for the generation, voice message audio for recognition and the text of a reply to be voiced. The request is run by the model of the selected developer (including OpenAI, Google, Anthropic) under the rules of OpenRouter and of the model's developer.
  • fal.ai (USA) — only if you use the image and video Studio: the materials and the description of the request for the generation.
  • Openverse and Wikimedia Commons — a stock photo search sends only the search query (the topic), without account data.
  • The Operator's own servers: backups of the database and files, speech recognition for dictation in the mini app and as a fallback for Telegram voice messages (a local model; the audio is deleted right after processing, the text after 30 minutes), video assembly.
  • The IntellectMoney payment service — order data (number, amount, currency); you enter your card details directly on its page.
  • Public authorities — only where the law requires it.

6. Cross-border transfer

The recipients above are located outside your country of residence, including in the USA, and Cloudflare processes data in its global network. By accepting the offer and this Policy you consent to such transfer. Only what is needed to carry out your request is transferred.

7. How long data is kept

  • The account and its data — as long as the account exists.
  • Messages, uploaded files and results — as you choose in the settings: “until I delete” (the default), 30 or 90 days; the choice applies to new materials.
  • Deleted projects and chats stay in the trash for 14 days and are then deleted.
  • A carousel archive for download — 7 days; an account data export — 24 hours.
  • Memory facts — until you delete them or until the period chosen for them.
  • Voice messages: the audio is not kept; service records of their processing and of message delivery are deleted after 30 days.
  • Sign-in sessions: up to 30 days (up to 7 days without activity); their records are deleted 30 days after they end.
  • Request rate-limit records (an IP address hash) — no longer than two days.
  • Raw notifications from the payment service — 30 days.
  • Support requests — until the account is deleted; copies sent to the service's support chat in Telegram stay in Telegram.
  • Records of orders, payments, refunds, credit transactions and the action log are kept without a time limit as evidence of settlements, including after the account is deleted.
  • Backups — up to 35 days.

8. Your rights and how to use them

  • Get a copy of your data: Settings → Security and sign-in → Your data → Export my data. The ZIP archive is available for 24 hours.
  • Correct your data: profile data is updated from Telegram at sign-in; projects, brand and the assistant's memory can be edited in the mini app.
  • Delete individual data: chats and projects go to the trash (which you can empty at once), memory facts are erased at once, files in the mini app; you can tell the assistant in Telegram what to forget.
  • Delete the account: Settings → Security and sign-in → Delete account. It takes two confirmations, the second with the word DELETE. After 14 days the account is deleted permanently; until then the deletion can be cancelled with a code shown once. Projects, chats, messages, files, results, memory, brands and sessions are deleted; the profile is anonymized. Settlement records are kept (see “How long data is kept”).
  • Withdraw consent, object to processing or ask a question — write to support@ferzmedia.app; we answer within 10 working days. Withdrawing consent to processing needed for the service means deleting the account.
  • Complain to the data protection authority of your country of residence.

9. Cookies and browser storage

  • __Host-caro_session — the mini app sign-in session (HTTPS only, not readable by scripts, up to 30 days). Required.
  • __Host-caro_tg_oidc — temporary, 10 minutes, when signing in with Telegram in an ordinary browser. Required.
  • caro_tg_layout — screen measurements for the owner's control panel; set only on its pages, for 30 minutes.
  • Browser storage (localStorage and sessionStorage): message drafts, language, theme and accent colour, time zone and service markers — they stay on your device and are cleared when you sign out.
  • The mini app loads the Telegram Web App script from telegram.org, needed to work inside Telegram.
  • The Service uses no advertising or analytics trackers. The pages of ferzmedia.app (the home page and the documents) set no cookies.

10. Security

Data travels only over secure connections (HTTPS). Files are kept in private storage and served only to the account owner; sign-in tokens are stored as hashes; only the Operator can administer the Service, and administrative actions are logged; access keys to AI providers are stored encrypted.

11. Children

The Service is intended for persons aged 18 or over; we do not knowingly process children's data. If you believe a child has given us their data, write to support@ferzmedia.app — we will suspend the account and help delete the data.

12. Changes to this Policy

A new version is published on this page with its version number and date. The version of the documents in force at the time of a payment is saved in the order record.

13. Operator details

Seller
Individual Entrepreneur KHAMDAMOV IKROMJON KOBILOVICH
Country of registration
Republic of Uzbekistan
Registration number of the individual entrepreneur (YaTT)
7999753 of 9 September 2026
Taxpayer ID (TIN / PINFL)
31101986180053
Legal and actual address
5 Rokhat, Motrid Bogi, Samarkand, Samarkand Region, 140100, Republic of Uzbekistan
Phone
+971 50 135 7662
E-mail
support@ferzmedia.app
Telegram bot
@Ferz_aibot

As of 4 October 2026, version 2026-10-04. Other documents: Public offer (Terms of Service) · Payment, service delivery and refunds