Privacy policy
Effective from August 4, 2026
tShop (tshop.cc, the “service”, “we”) is a storefront builder for Telegram Mini Apps. This policy explains what data we collect when store owners and their customers use the service, and how we process, store, and protect it.
1. What data we collect
We collect data from two categories of users: store owners and their customers.
| Who | Data |
|---|---|
| Store owner | email or username, password hash, store name and description, design settings, Telegram bot token, and administrator Telegram ID |
| Customer | Telegram ID, name and username from Telegram, phone number and delivery details provided at checkout, order history, and cart |
| Technical data | files uploaded to the catalog (product images and logo), and technical server request logs |
We do not request or store bank-card data. Plan payments are processed by Telegram Stars on Telegram’s side, so payment details are not available to the service.
2. How we use data
- To create and operate the dashboard and store storefront;
- To process orders and connect customers with store owners;
- To send order notifications through the store bot;
- To support users and respond to requests;
- To secure the service and prevent abuse;
- To calculate and charge plan payments.
We do not use customer data for third-party advertising or sell it.
3. Legal bases for processing
Store-owner data is processed to perform the offer agreement for use of the service. Customer data is processed in the interests and on behalf of the owner of the relevant store, who acts as an independent controller of customer data; we act as the technical platform (processor) providing infrastructure for receiving and storing orders.
4. Sharing data with third parties
We do not share personal data with third parties except when:
- sharing order data with the store owner whose store received the customer’s order;
- sharing technical data required by Telegram for the Mini App and bot to work (in accordance with Telegram’s privacy policy);
- legal requirements and requests from authorized government bodies.
5. Telegram Mini App data
Stores operate as Telegram Mini Apps. When a store is opened in Telegram, the service receives the user’s Telegram ID, name, and username through Telegram WebApp’s standard authentication mechanism; the data is signed and verified. The Telegram bot token entered by the store owner in the dashboard is stored encrypted and used only to send order notifications.
6. Storage and retention
Data is stored while the owner’s store is active. When a store or account is deleted, data is removed from the service systems within a reasonable period, except information that must be retained by law (for example, financial records for plan payments). Backups are overwritten as part of the standard rotation cycle.
7. Security
Passwords are stored as hashes; access to the admin panel is protected by a separate session, and customer and owner sessions are isolated from one another and from other stores’ data. Telegram bot tokens are stored encrypted. We apply reasonable technical and organizational safeguards, but cannot guarantee that data transmitted over the internet will be completely secure.
8. Cookies and local storage
The service uses technical cookies for dashboard, admin-panel, and customer-session authentication. These cookies are required for the service to work and are not used for advertising tracking. If the store owner configures analytics code in the store, third-party analytics may also be used. The store owner is responsible for those settings.
9. User rights
You may request access to, correction of, or deletion of your data using the contacts below. Store owners can edit and delete data from their dashboard. Customers can contact the store owner or contact service support directly to request deletion of their data.
Cross-border data transfers and data-subject rights are governed by applicable law and the circumstances of the specific processing.
10. Children’s data
The service is not intended for people under 18. We do not knowingly collect data from minors. If you become aware of such a case, please contact us and we will delete the relevant data.
11. Policy changes
We may update this policy. The latest update date is shown at the top of the page. Material changes will be announced in the dashboard or on the service website.