Privacy Policy

XBOT. Last updated 21 October 2026.

This page explains, in plain language, what data the service stores, why, and what we never do with it. XBOT is operated by MarketSync Global, Rajshahi, Bangladesh. Contact: mail@sojibahmmed.com.

What we store

Account identity. When you sign in — with Telegram, or through OneAuth (oauth.1ai.bd), once its registration completes — we store your platform user id, the provider identity (for example your Telegram id and username), and your sign-in times.
Channel messages. Messages sent to and from the agent on the channels you connect (Telegram today; your own WhatsApp business number as it rolls out), so the agent can hold a conversation, remember context, and show you your inbox and history.
Connection metadata. Which channels and apps you have connected, their channel-side ids and display names, and — for apps you connect — the access tokens needed to act on your instruction.
Usage records. Counts of agent and AI usage per account, kept so plan limits are applied fairly and billing can be checked.
Support tickets. Tickets you open with the agent and their contents, so support can follow up.
Waitlist email. If you join the payments waitlist on the pricing page, the email address you give us — used only to tell you when payments open.

What we never do

We never sell your data.
We never read your chats beyond the channels you connected to the agent. The agent only ever sees conversations it is part of.
We never send, post or publish anything in your name without your confirmation.

Who processes data for us

We use service providers to run the product: hosting and database (Supabase), AI model providers (to generate replies and transcribe voice notes — your messages are processed by them to produce the answer), and web-research tooling (your research questions are sent to fetch public web sources). When you pay, the payment provider (EPS for BDT, NOWPayments for crypto) receives the details that payment needs, under its own privacy policy.

Cookies and browser storage

Our web pages do not set advertising or tracking cookies. Pages store a sign-in session marker in your browser's local storage, and — only on operator-guarded tool pages — the key you type stays in that browser tab's session storage, on your own device.

How long we keep it

Account, channel and connection data is kept while your account is active. Support tickets, usage records and payment records are kept longer, for our records and legal obligations.

Your choices

You can ask us to export or delete your data at any time: message the agent and ask for a support ticket, or email mail@sojibahmmed.com. Deleting your account removes your channel bindings and stored channel data, except records we are required to keep (for example payment records).

Security

Stored data is reachable only from our servers — no public or browser-level access. We work to protect it, but no system is perfectly secure; if a breach ever affects your data, we will tell you.

Changes

If this policy changes materially, we will say so on this page and in the product before the change takes effect.