Privacy Policy

Who is responsible for your data, and what this policy covers

The controller of your personal data is Yevheniia Vasiuta, Ukraine. Full registration details and a postal address for formal correspondence are available on request: write to the email in section 15.

This policy covers two things: the ai-lifechanger.com website and your contact with the Telegram bot @ai_lifechanger_bot. It does not cover:

• AI agents I build for clients. Such an agent runs on the client’s side, with the client’s data, in the client’s accounts, and under the client’s own privacy policy. The client is responsible for the data processed there, not me.
• third-party websites and services linked from here — they have their own rules.

What the website collects

The website is static: no forms, no hidden trackers, no third-party fonts or scripts loaded from someone else’s servers. It collects very little:

• Your language choice and your cookie decision — stored only in your browser and never sent anywhere.
• Hosting server logs — the server that delivers the pages records your IP address, the time of the request, and your browser type. This is how any web server works: without it, a page cannot be served and an attack cannot be blocked.
• Google Analytics — only if you clicked “Accept” in the cookie banner: an anonymized identifier, your IP address, pages viewed, and the referral source. If you declined, or simply clicked nothing, not a single request goes to Google.
• An anonymous visit counter — it counts page views without cookies and without identifiers. That is why it works before you answer the banner at all: these data cannot identify an individual.

The Telegram referral tag. When you tap a button that leads to the bot, a short technical tag is appended to the link: which button you tapped, the page language, and a source code — for example “came from Instagram” or “from search”. If you consented to analytics, an anonymized Google Analytics identifier is added next to it. This lets me see which channel brings people in without asking you about it in chat. The tag contains neither your name nor your contacts, and only the bot can see it.

What you send through the bot

Most of the conversation happens in Telegram. When you message @ai_lifechanger_bot, I process:

• your messages and the description of your business;
• voice messages and any files you send;
• technical details of your Telegram profile — name, username, and user ID.

You decide how much of this there is: the bot pulls nothing from your device, does not read your other chats, and does not see your phone number unless you send it yourself.

What you should not send

To scope out automation, a description of your processes is enough. So please do not send the bot:

• special categories of data — health, political or religious views, biometrics, criminal records;
• passwords, access keys, tokens, or payment card details;
• other people’s databases, customer exports, or scans of third-party documents — if the conversation can work without them.

If such data does arrive, I delete it as soon as I notice and do not use it in my work. Sending it is your decision, and the responsibility for it is yours (section 9).

Why and on what legal grounds I process data

I process data only when there is a lawful basis for it:

• your consent — for cookie analytics on the website; you can withdraw it at any time;
• entering into and performing an agreement — when you message the bot to get a game plan or order a service;
• legitimate interest — running the website, protecting it from abuse and attacks, keeping business correspondence, and defending against potential claims;
• legal obligation — records relating to paid services that I am required to keep for tax purposes.

Who your data is shared with

I list categories of recipients — the specific set of services changes over time, and I will name the current one on request:

• The website’s hosting provider — the company that serves the pages and sees the technical request logs.
• Telegram — the platform the bot runs on; it processes the conversation under its own privacy policy. It is someone else’s system: I do not control it and am not responsible for it.
• Google Analytics — only after you consent in the cookie banner.
• AI model providers — services that help process your description and prepare the game plan. I choose providers that operate in API mode and do not use what is sent to train their models.
• An accountant, a bank, a legal adviser — if it comes to payment or a dispute, and only as far as the law requires.

I do not sell your data, do not share it with advertisers, and do not add you to mailing lists without your consent.

Transfers outside Ukraine

Some of the services in section 6 process data outside Ukraine — mainly in the EU and the US. For those transfers, providers rely on recognized safeguards: adequacy decisions, the EU-US Data Privacy Framework, or Standard Contractual Clauses (SCCs). I choose providers that use such safeguards — though, like any customer, I cannot audit what happens inside their operations.

How long data is kept

• Analytics — 14 months, then deleted automatically.
• Hosting logs — a short technical period set by the provider, usually a few weeks.
• Bot conversations and the materials you send — for as long as we are talking, plus a reasonable period afterward: so that I can return to the conversation, confirm what was agreed, and defend against a potential claim. The exact period depends on how the conversation ended, and I will tell you on request.
• Records of paid services — as long as tax law requires.

You can ask me to delete the conversation sooner — I will delete everything I am not required to keep by law or to establish and defend legal claims.

Data about your customers and staff: who is responsible for what

When you send me data about other people — your customers, employees, or partners — you remain the controller of that data. You decided to collect it, you determine the purpose, and you are the one who must have a lawful basis to pass it on to me. In that part I act as a processor: I handle such data only on your instructions and only for the work we agreed on.

Three things follow from this:

• checking that the transfer is lawful is your obligation, not mine;
• if your customer exercises their rights — access, deletion — you are the one who answers them, and I help on the technical side;
• I will sign a separate data processing agreement (DPA) on request — just ask.

AI and automated decisions

The game plan is prepared with the help of AI models, but no decision about you is made automatically. I do not build a profile of you, do not score you, and do not make automated decisions that would have legal effects for you. Everything the AI prepares is reviewed by a human — me — before it is sent.

AI output can be inaccurate; what you do with it is your call. Your messages are not used to train models.

Security and incidents

I take reasonable technical and organizational measures: only I have access to the conversations, work accounts are protected with separate passwords and two-factor authentication, data travels over encrypted channels, and anything unnecessary is deleted.

And here is what no marketing page will tell you: there is no such thing as absolute security on the internet. Neither I, nor Telegram, nor any hosting provider can guarantee that systems will never be attacked. I am responsible for taking reasonable measures — not for the non-existence of attackers.

If a breach occurs that puts your rights at risk, I will notify you without undue delay, and the supervisory authority as well where required, within the deadlines set by law. You can help too: do not send more than necessary (section 4) and protect access to your own Telegram account — its security is not in my hands.

Your rights

At any time, you can:

• find out what data I hold about you and get a copy of it;
• have inaccurate data corrected;
• ask me to delete your data — the “right to be forgotten”;
• restrict the processing or object to it;
• receive your data in a portable format so you can take it elsewhere;
• withdraw your consent — for example, change your cookie decision via “Cookie settings” in the website footer. Withdrawal does not undo what was already done on the basis of consent before it.

Just write to me — contact details are in section 15. I respond within 30 days; if a request is complex, I will say so and give you a new deadline. Sometimes I will need to confirm that you are who you say you are: otherwise handing over data would mean handing it to a stranger.

If you believe your rights have been violated, you can complain to the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, to the supervisory authority in your country. But write to me first: most questions are settled in a single email.

Children

The website and the bot are meant for business owners and are not directed at children. I do not knowingly collect data from anyone under 18. If you believe a child has sent me their data, write to me and I will delete it.

Changes to this policy, and the language of the document

From time to time I update this document — for example, when I connect a new service. The current version is always on this page: the date at the top, the change history at the bottom. Data collected earlier is governed by the version that was in effect when it was collected.

This policy exists in Ukrainian, Russian, and English. These are translations of one document; if the versions differ, the Ukrainian version prevails.

Contact

Privacy questions, requests for registration details, a DPA, or deletion of your data: vasiuta.yevhenia@gmail.com or via Telegram.