This Policy describes what personal data the owner and administrator of the Multogram service (the Operator) processes when you use the website multogram.com, the personal account and the Multogram software, for what purpose, on what legal basis, to whom it is transferred and how you can exercise your rights.
The Policy has been drawn up in accordance with the General Data Protection Regulation (GDPR), which applies because the Operator's infrastructure is located in the European Economic Area, and takes into account the requirements of the data protection law in force where the user is located. Where the applicable legal systems impose different requirements on the same matter, the Operator follows the strictest of them.
The Policy forms an integral part of the Terms of Use. By registering and using Multogram, you confirm that you have read the Policy and agree to the processing described in it.
1. General provisions
1.1The Operator is the person holding the exclusive rights to the Multogram software and administering the site, trading under the commercial designation "Multogram". Contact for personal data matters: [email protected].
1.2Enquiries about the processing of personal data are sent to the e-mail address above or through the support system in the personal account, and are answered within the time limits set in section 9. Identification and registration details of the Operator are disclosed to a data subject upon a reasoned request, and upon a lawful demand of a competent authority.
1.3The Policy applies to the processing of data of users of the site, the personal account and the licensing part of the Multogram software. It does not apply to third-party websites and services that may be linked from the interface and the documentation; users review their rules themselves.
1.4The terms "personal data", "processing", "operator" and "data subject" are used in the meaning given to them by the applicable personal data law. For the purposes of the GDPR, the Operator is the controller of the data listed in section 3.
1.5Multogram is intended for persons over the age of 18. The Operator does not deliberately collect data of persons who have not reached that age.
2. Data that stays on your device
2.1Multogram is a desktop program that runs on the user's equipment. Working data is processed locally and is not transmitted to the Operator's servers. It includes:
- Telegram accounts, session files and tdata, phone numbers and confirmation codes;
- texts of messages, comments and posts, and attached media files;
- target lists for mailings, inviting and other tasks, parsing results;
- addresses, logins and passwords of proxy servers;
- mode settings, schedules, task execution logs and their results.
2.2The Operator has no access to this data, does not store it and cannot provide it to third parties, including competent authorities: there is no technical means of doing so.
2.3If you use Multogram to process personal data of third parties — for example, to collect usernames and phone numbers or to send messages to recipients — you are the operator (owner, controller) of that data. You determine the purposes and means of processing yourself, ensure a legal basis, comply with the law of your country and of the country where the data subjects are located, and are answerable to them and to supervisory authorities. The Operator takes no part in such processing and is not a party to those relations.
Responsibility for the lawfulness of collecting and using other people's personal data lies with the Multogram user. The Operator does not provide databases, lists or information about third parties.
2.4The exception is data you pass to the Operator on your own initiative — for example, by attaching it to a support request. Do not include passwords, confirmation codes, session files or personal data of third parties in your requests.
2.5A separate note on the AI assistant: if you use the built-in AI assistant, the text of your request and the context needed to answer it are sent to the Operator's servers and on to the language-model provider. Do not include personal data, passwords or other information that must not leave your device in your requests.
3. What data the Operator processes
3.1The Operator processes the following categories of data:
| Category | Content | When collected |
|---|---|---|
| Account data | e-mail address, username, password as an irreversible hash, account role and status, registration date, date of the last sign-in | at registration and during use |
| Verification data | the confirmation code sent to your e-mail; the result of the Cloudflare Turnstile check | at registration and when restoring access |
| Technical browser fingerprint | platform, time zone, screen resolution and colour depth, scaling, number of logical cores, amount of memory, graphics adapter vendor and model, and irreversible hashes of canvas, WebGL, audio and font-set rendering | once, at registration |
| Device data | hardware identifier as a hash (HWID), the device name you set, the last IP address, the User-Agent string, the time of last activity | when a device is bound and when the licence is checked |
| Payment data | the payment identifier at the provider, the item and type of purchase, the chosen payment method, amount, currency, status and time of payment, the promo code applied | when paying for a plan, a module or a slot |
| Bonus and partner programme data | personal referral code, the code of the partner or referral link through which you arrived at the site and the fact that you followed it, "referrer — referred" links, completed tasks and the confirmations you submitted (links to posts, usernames), points credited and debited, rewards received, partner earnings and balance, balance-to-points exchanges, payout requests and the wallet details you provided, individual terms where set | when you follow a partner or referral link and when you take part in the bonus and partner programme |
| Requests and correspondence | subject and text of the request, correspondence, files you attached; for e-mails to the Operator's addresses, also the sender's address and whatever you stated in the e-mail, such as name, position and organisation in a commercial enquiry | when you create a request in the personal account or send an e-mail to the addresses listed in section 14 |
| Activity log | action code and category (sign-in, settings change, purchase, device binding, etc.), result, IP address, time, service metadata | when you perform actions in the personal account |
| Anti-fraud data | risk score, triggered indicators, links to other accounts through a matching fingerprint, device or IP address, moderator decisions and notes | automatically, at registration and on significant actions |
| AI assistant requests | request text, context, the counter of credits spent | when you use AI features |
| Technical logs | IP address, User-Agent, request address and time, response code, error details | on every request to the server |
| Web analytics data | pages viewed, referral source, browser and device details, approximate location derived from the IP address, on-page actions (scrolling, cursor movement, clicks), page load speed, the analytics service's cookie identifiers | when you visit the site — only with your consent (section 11) |
| Cookies and local storage | see section 11 | when you use the site |
3.2The Operator does not process special categories of personal data (concerning health, religious or political beliefs, biometrics) and does not request identity documents or phone numbers. Bank card details and other data needed to make a payment are entered on the payment provider's page: they are processed by the provider under its own rules and are not passed to the Operator.
3.3The technical browser fingerprint and the hardware identifier are used exclusively for licence control and to counter abuse: multiple registrations, circumvention of the free plan's limits, abuse of the bonus and partner programme — including checking that a referred user is not using the device of the referrer or of another account, and that one reward is not obtained repeatedly from one device. They are not used for advertising profiling and are not passed to advertising networks.
3.4The Operator uses automated risk assessment (anti-fraud). Its result may lead to refusal of registration, restriction of features or blocking. Such a decision can always be reviewed by a human: submit a support request or send an e-mail to the address given in section 14, and the decision will be checked manually.
4. Purposes and legal bases of processing
4.1The Operator processes data only for the purposes and on the bases listed below:
| Purpose | Data | Legal basis |
|---|---|---|
| Registration and maintenance of the account, access to the plan and modules | account data, verification data, device data | performance of a contract with the data subject |
| Accepting and recording payments, confirming the rights purchased | payment data, account data | performance of a contract; legal requirements on financial record-keeping |
| Licence and device-count control | device data, browser fingerprint | performance of a contract; legitimate interest in protecting the exclusive right |
| Countering fraud, multiple registrations and abuse | browser fingerprint, anti-fraud data, activity log, technical logs | legitimate interest in ensuring the security of the service and protecting the rights of the Operator and of users |
| Running the bonus and partner programme: crediting points and rewards, checking tasks, issuing rewards, balance exchange and payouts | bonus and partner programme data; to check that referred users are unique — device data, browser fingerprint and anti-fraud data | performance of a contract; legitimate interest in protecting the programme from abuse |
| Recording visits through partner and referral links and crediting a registration to whoever brought it | the link code and the fact that it was followed; keeping the code in your browser between visits — section 11 | legitimate interest in settling with partners for the users they bring; keeping the code in the browser — only with your consent (section 11) |
| User support, answering requests and commercial enquiries, correspondence, including by e-mail | requests and correspondence, account data | performance of a contract, or steps taken at your request before entering into one; legitimate interest — where the person writing is not a user, including a representative of an organisation |
| Operation of the AI assistant | AI assistant requests | performance of a contract; consent of the data subject when voluntarily using the feature |
| Sending service notifications (about payments, security, changes to the terms) | account data | performance of a contract; legal requirements |
| Informational and promotional mailings about the product | account data | consent of the data subject, which can be withdrawn at any time |
| Analysing visits and improving the site | web analytics data | consent of the data subject, given in the cookie settings and withdrawable at any time (section 11) |
| Protecting rights in disputes, responding to lawful demands of competent authorities | any of those listed in section 3 | legitimate interest; legal requirements |
4.2Processing for these purposes includes collection, recording, organisation, accumulation, storage, updating, use, transfer to processors, anonymisation, blocking, erasure and destruction — both automated and without the use of automation.
4.3The Operator does not take decisions producing legal effects solely on the basis of automated processing without the possibility of human involvement (clause 3.4).
5. Consent and its withdrawal
5.1Consent to the processing of personal data on the terms of this Policy is given by ticking the box at registration and is confirmed by subsequent use of Multogram. The consent is specific, informed, conscious and unambiguous.
5.2Consent may be withdrawn at any time: submit a request through the personal account or send an e-mail to [email protected]. Withdrawal of consent ends the processing and entails the deletion of the account, since access to Multogram cannot technically be provided without processing the data listed.
5.3After consent is withdrawn or the account is deleted, the Operator may continue to store certain data to the extent necessary to comply with legal requirements, to confirm payments made and to protect its rights in the event of a dispute — for the periods set out in section 6.
5.4Withdrawal of consent to promotional mailings does not affect processing for other purposes and is done via the link in the e-mail or by contacting support.
5.5Consent to the use of optional cookies — analytics and marketing — is requested separately from the consent referred to in clause 5.1: in the banner the site shows on your first visit, including to a visitor without an account. Refusing them does not restrict access to the site or to the personal account. This consent can be changed or withdrawn at any time in the cookie settings — via the "Cookie settings" link at the bottom of the site's pages, in the documentation sidebar or under "Settings" in the personal account. Withdrawing it does not have the consequences set out in clause 5.2 and does not affect the lawfulness of processing carried out before the withdrawal. The procedure is described in detail in section 11.
6. Retention periods
6.1Data is kept no longer than the purposes of processing require:
| Data | Retention period |
|---|---|
| Account data and device data | for as long as the account exists and 30 days after its deletion |
| Payment data and purchase records | 3 years from the date of payment — the general limitation period |
| Bonus and partner programme data | for as long as the account exists; records of partner earnings, payouts and exchanges — 3 years from the date of the operation |
| Account activity log | 12 months |
| Browser fingerprint and anti-fraud data | up to 24 months from the last activity |
| Requests and correspondence | 12 months after the request is closed or after the last e-mail in the correspondence |
| Claims and correspondence about them | 3 years from the reply to the claim — the general limitation period |
| Contracts with organisations and correspondence about them | for the term of the contract and 3 years after its performance; a commercial enquiry that did not lead to a contract — 12 months after the last e-mail |
| Server technical logs | 90 days |
| AI assistant requests | to the extent necessary to account for the credits spent and to prevent abuse |
| Web analytics data | Google Analytics — 14 months from collection; identifiers in your browser — for the periods given in section 11 |
6.2When the period expires, data is deleted or anonymised. Anonymised information may be kept indefinitely for statistical purposes: it cannot be used to identify anyone.
6.3Activity log entries are kept after the account is deleted, but their link to the deleted user is severed — the user identifier is cleared.
8. Cross-border data transfers
8.1The Operator's servers and database are located in Iceland (European Economic Area). If you are outside that country, the processing of your data is a cross-border transfer, the terms of which are described in this section.
8.2Iceland is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) and is part of the European Economic Area, where the GDPR applies directly. The receiving country therefore ensures adequate protection of data subjects' rights.
8.3By accepting this Policy, you consent to the cross-border transfer of your personal data to that country, and to the recipients of the categories listed in section 7 in the countries named in the same table, for the purposes described there. Consent may be withdrawn under section 5.
8.4Some of the recipients listed in section 7 are located outside the European Economic Area. Transfers to countries for which the European Commission has adopted an adequacy decision (in particular Switzerland) are based on that decision; to the United States — to recipients certified under the EU–U.S. Data Privacy Framework, on the basis of the European Commission's adequacy decision of 10 July 2023, and to other recipients on the basis of the European Commission's standard contractual clauses; to other countries — on the basis of standard contractual clauses or another mechanism provided for by the applicable law. Where no such mechanism exists, a transfer takes place if it is necessary for the performance of a contract with you — for example, to carry out the payment you chose — or on the basis of your explicit consent given in clause 8.3.
9. Your rights and how to exercise them
9.1You have the right to:
- obtain confirmation that your data is processed and information about the legal basis, purposes, the data processed, retention periods and recipients;
- obtain a copy of your data, including in a machine-readable format (data portability);
- have inaccurate or incomplete data corrected;
- have data blocked or erased where it is processed unlawfully or is no longer needed for the purposes of processing (the "right to be forgotten");
- withdraw consent to processing;
- object to processing based on legitimate interest;
- have a decision taken by automated means reviewed by a human;
- challenge the Operator's actions before a supervisory authority or a court.
9.2To exercise any of these rights, submit a request through the personal account or send an e-mail to [email protected] from the e-mail address registered to your account. If the request comes from another address, the Operator may ask for additional information to identify the requester — solely so as not to disclose someone else's data to an outsider.
9.3The Operator replies within 10 working days of receiving the request. If the request requires additional verification or identification of the requester, the period may be extended by no more than 5 working days, and the requester is told the reasons. If the law applicable to you sets a shorter period, that period applies.
9.4Some rights can be exercised without contacting the Operator: changing the e-mail address and the password, renaming and unbinding devices, and deleting the account are done in the personal account.
9.5A complaint about the Operator's actions can be lodged with a data protection supervisory authority: where the Operator's infrastructure is located — the Icelandic Data Protection Authority (Persónuvernd); where you live or where the alleged infringement took place — the competent supervisory authority of that country. Lodging a complaint with a supervisory authority does not deprive you of the right to judicial protection.
9.6If the data protection laws of US states apply to you — including California's (the CCPA as amended by the CPRA) — you also have the right to know what categories of data about you are collected, from what sources, for what purpose and to whom they are disclosed, and to opt out of the sale of personal data, of its sharing for cross-context behavioural advertising ("sharing") and of targeted advertising. The Operator does not sell personal data, including that of persons under 16, does not share it for such advertising and does not use it for targeted advertising. The Global Privacy Control signal sent by your browser is honoured as a refusal of optional cookies (section 11). You may make a request yourself or through an authorised agent under clause 9.2; exercising these rights has no adverse consequences for you — no refusal of service, different prices or different quality of service.
10. Data security
10.1The Operator takes legal, organisational and technical measures to protect data against unauthorised access, destruction, alteration, blocking, copying and dissemination:
- data transmitted between your device and the servers is protected by TLS;
- passwords are stored only as irreversible hashes and cannot be recovered, even by the Operator;
- hardware identifiers and fingerprint parameters are stored in hashed form;
- staff access is role-based and granted on the principle of least privilege;
- staff actions in the administration panel are recorded in an audit log;
- backups are made, and protection against automated attacks and password guessing is in place;
- server software is updated regularly.
10.2No system provides absolute protection. The Operator does not guarantee the complete absence of risk, but undertakes to act in good faith and to respond to incidents promptly.
10.3In the event of an incident posing a threat to the rights of data subjects, the Operator notifies the competent supervisory authority of the incident within 24 hours of its detection and provides further details of its causes and consequences within 72 hours. Affected users are notified without undue delay.
10.4For your part, you must use a strong, unique password, not give third parties access to your account, and notify the Operator immediately of any sign that your access has been compromised.
12. Minors
12.1Multogram is not intended for persons under the age of 18, and the Operator does not knowingly collect their data.
12.2If you become aware that an account has been created by a person under the age of 18, please report it to [email protected]. Such an account will be blocked and the associated data deleted within a reasonable time.
13. Changes to the Policy
13.1The Operator may amend the Policy. The current version is always published on the site with its number and effective date.
13.2The Operator gives at least 14 days' notice, by e-mail or in the personal account, of material changes affecting the data processed, the purposes of processing or the scope of your rights.
13.3Continuing to use Multogram after a new version takes effect constitutes agreement with it. If you disagree, you may withdraw your consent and delete your account under section 5.
14. Contacts
14.1For any questions about the processing of personal data and to exercise your rights: [email protected]. For other enquiries: general and legal enquiries and abuse reports — [email protected]; user support — [email protected]; corporate and volume purchases — [email protected]; partnerships and the bonus and affiliate programme — [email protected].
14.2Requests are accepted electronically — at the addresses above or through the support system in the personal account. This means of communication is recognised as proper; the reply is sent to the e-mail address from which the request came.
14.3This version 1.4 is in force from 14 October 2026.