[FON]
Start for Free

Privacy Policy

Version 1.0 – effective from 21.07.2026

The binding version of this Privacy Policy is the Polish one. This English version is provided for informational purposes only. In case of any discrepancy, the Polish version prevails.

Dear User,

Mykhaylo Vorobets, conducting sole proprietorship registered with CEIDG (hereinafter: "FON", "we", "Controller"), as the operator of the FON service – two bots in the Telegram messenger (@FON_RentFlatPL_ConfigBot and @FON_RentFlatPL_AlertBot) and the website fonbot.pl/en – makes every effort to ensure the security and confidentiality of your personal data.

This Privacy Policy is presented in the form of questions and answers. It describes what data we process, why, on what legal basis, for how long, with whom we share it, and what rights you have. We operate in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the Polish Personal Data Protection Act.

1. Who is the controller of your personal data?

The controller of your personal data is:

  • Mykhaylo Vorobets, conducting sole proprietorship (CEIDG),
  • correspondence address: ul. Lipowa 3D, 30-702 Kraków,
  • Tax ID (NIP): 6751781952,
  • Statistical ID (REGON): 525198955,
  • e-mail: contact@fonbot.pl.

In matters related to the protection of personal data, you can contact us by e-mail at contact@fonbot.pl or via a message to our @FON_Support Telegram contact account.

We have not appointed a Data Protection Officer, as we are not legally required to do so.

2. What personal data do we process?

We process the following categories of personal data:

a) Data retrieved automatically from Telegram – when you start using the Config Bot or the Alert Bot:

  • your Telegram user identifier (telegram_user_id),
  • your Telegram username (username), if set,
  • first and last name (first_name, last_name), as visible to Telegram bots,
  • language code set in Telegram (language_code).

b) Data generated while using the Service:

  • search settings (city, price range, number of rooms, area, additional filters),
  • account preferences and settings,
  • alert status (enabled / disabled, active / blocked),
  • history of bot interactions (commands, clicks, form responses),
  • registration date, dates and versions of Terms and Privacy Policy you have accepted,
  • marketing information allowing us to identify the source of user acquisition (ad_campaign_id).

c) Data provided voluntarily:

  • phone number – if you share it via Telegram's "Share phone number" feature when submitting a form to a Partner; we use the number to pass it to the Partner of your choice (each transfer requires your separate consent) and store it in our systems to the extent necessary to carry out that purpose, manage the deduplication mechanism, and defend claims if necessary,
  • data provided in Partner forms (as defined in each form),
  • information provided in correspondence and complaints,
  • e-mail address – if provided (e.g., for complaints or invoicing) or obtained from the Payment Operator in connection with the purchase of the Premium Plan – to send you a confirmation of the agreement and other information relating to the agreement that, under applicable law, requires a durable medium. We do not store this address permanently in our systems; if needed, we obtain it from the Payment Operator each time.

d) Data related to payments (Premium Plan):

  • Payment card data and transaction data are processed exclusively by the Payment Operator – Stripe Payments Europe, Ltd. FON does not store full card data. From Stripe, we receive transaction identifiers, payment status, amount, currency, and the last 4 digits of the card along with its type – solely for settlements and issuing accounting documents – as well as the e-mail address, for the purposes described in point c).

e) Technical data:

  • IP addresses and server logs (on OVH infrastructure), to the extent necessary for security, diagnostics, and abuse prevention,
  • browser and device data (user agent, device type) – if you use the fonbot.pl/en website.

Providing data is voluntary, but necessary to use the features of the Service that require it. If you do not wish your data to be processed, we are unable to provide the Service.

3. Where do we obtain your data from?

We obtain data:

  • directly from you – when you start using the bots, configure searches, fill in forms, send messages, make payments;
  • from the Telegram platform – user identifier and public Telegram profile data are provided to bots under the Telegram Bot API;
  • from the Payment Operator (Stripe) – to the extent necessary to settle and handle transactions (including the e-mail address provided at purchase).

We do not obtain your data from other public sources or third parties. The rules for processing Advertisers' data obtained from publicly available listing platforms are described in point 4.

4. Do we process data of Advertisers (persons publishing Listings)?

The Service provides Users with notifications about publicly available property rental Listings published on external listing platforms (in particular OLX, Otodom, Gratka). The content of a Listing may contain personal data of an Advertiser who is a natural person, so we process this data in a maximally minimized manner:

  • we do not store Advertisers' contact details (names, phone numbers, e-mail addresses) or the content of Listing descriptions – this data is automatically filtered out before the Listing is saved in our systems;
  • we save and provide Users only with the basic parameters of the Listing (including the title, price and rent, location, area, number of rooms, floor, amenities), a link to the Listing on the source platform, and links to the photos published there (we do not store copies of the photo files); we retain these parameters for the period necessary to provide the Service (including detecting duplicates and outdated offers);
  • contact with the Advertiser and the full content of the Listing are available only on the source platform to which we redirect.

The legal basis for this processing is Art. 6(1)(f) GDPR – the legitimate interest of the Controller and of Users, consisting of informing them about publicly available rental offers together with a link to where they were published. Because we do not store Advertisers' contact details, we are unable to provide them with individual information about the processing; this Privacy Policy, being publicly available, fulfills the information obligation in the manner provided for in Art. 14(5)(b) GDPR. An Advertiser may contact us at any time at contact@fonbot.pl, including to object to the processing (Art. 21 GDPR).

5. For what purposes and on what legal basis do we process your data?

Purpose of processing Legal basis (GDPR)
Providing the Service (account, alerts, searches, service communication) – Free Plan and Premium Art. 6(1)(b) GDPR – performance of a contract
Handling payments and subscriptions in the Premium Plan Art. 6(1)(b) GDPR – performance of a contract
Providing on a durable medium the contract confirmation and other legally required information relating to the agreement (e.g., about changes to the Service) – Premium Plan Art. 6(1)(c) GDPR – legal obligation (Consumer Rights Act)
Issuing invoices and receipts, maintaining tax and accounting documentation Art. 6(1)(c) GDPR – legal obligation (e.g., VAT Act, Accounting Act)
Handling complaints, requests, and correspondence Art. 6(1)(b) and (c) GDPR
Transferring data to Partners based on the lead-generation form Art. 6(1)(a) GDPR – your consent
Processing and storing the phone number for the purpose of transferring it to the selected Partner Art. 6(1)(a) GDPR – your consent
Internal analytics (ELK/Kibana), usage statistics, improving Service quality, abuse detection, Service security Art. 6(1)(f) GDPR – legitimate interest of the Controller
Direct marketing of own services – analysis, selection and preparation of content Art. 6(1)(f) GDPR – legitimate interest of the Controller
Sending marketing messages by electronic means, including promotional communications within the bots, to persons who have given consent Art. 6(1)(a) GDPR – consent; Art. 398 of the Act of 12 July 2024 – Electronic Communications Law
Displaying advertising and promotional content in the Free Plan (without profiling – the same content for all Free Plan Users) Art. 6(1)(f) GDPR – legitimate interest (maintenance and monetization of the free plan)
Analytics of the fonbot.pl website (including planned deployment of Google Analytics or similar tools) Art. 6(1)(a) GDPR – consent (cookies)
Establishment, pursuit, and defense of legal claims Art. 6(1)(f) GDPR – legitimate interest

Where processing is based on consent, you may withdraw it at any time – withdrawal does not affect the lawfulness of processing carried out before it.

6. How long do we store your data?

We store your data only as long as necessary to achieve the purposes for which it was collected:

  • account data and Service usage data – for the term of the Agreement and, after its termination, for the limitation period for mutual claims under Art. 118 of the Civil Code (as a rule, up to 6 years; for claims related to our business activity – 3 years), counted from the end of the year in which the Agreement ended;
  • settlement data, invoices, accounting documents – for the period required by tax and accounting law (as a rule, 5 years from the end of the tax year in which the tax obligation arose);
  • data processed based on consent (e.g., phone number for Partner forms, marketing consent, analytics cookies) – until consent is withdrawn or the purpose no longer exists;
  • data transferred to a Partner – once transferred, the Partner becomes a separate controller and retains data in accordance with its own policy; in our systems we retain the fact and date of transfer, the Partner identifier, the scope of transferred fields, and the User's phone number – for the purpose of managing the deduplication mechanism (30 days) and establishing, pursuing, or defending claims – for the period necessary for those purposes;
  • complaint data – for the time necessary to resolve the complaint and the claim-limitation period;
  • server logs and security data – as a rule, up to 12 months from registration, unless longer retention is needed to establish, pursue, or defend claims;
  • blocked accounts (e.g., for abuse) – for as long as necessary to prevent further abuse.

After these periods, data is deleted or anonymized.

7. With whom do we share your data?

We share data only to the extent necessary to operate the Service, and only with entities providing adequate guarantees of data protection. With entities processing data on our behalf, we conclude data processing agreements; Partners (point b) receive data as separate controllers, solely on the basis of your consent, and the rules regarding the Telegram platform are described in point 8:

a) Infrastructure and tool providers:

  • OVH SAS / OVHcloud – VPS infrastructure provider and e-mail hosting service (hosting the Service and the contact@fonbot.pl mailbox); servers located in the European Union;
  • Telegram FZ-LLC / Telegram Messenger Inc. – the messenger platform through which the FON bots operate;
  • Stripe Payments Europe, Ltd. – Premium Plan payment processing;
  • Google – provider of the mailbox (Gmail) to which correspondence sent to contact@fonbot.pl is delivered.

b) Lead-generation Partners:

  • cleaning companies, movers, real-estate agencies, mortgage advisors, insurance brokers, relocation companies, entities providing tenant support services, and others – only when you independently and knowingly send a query to them via a form in the Config Bot. Each such transfer requires your separate, explicit consent. We inform you of the identity of the specific Partner to whom data will be transferred at the time you send the query. Once data is transferred, the Partner becomes a separate controller.

c) Analytics tools (planned):

  • Google Analytics or similar tools – in relation to fonbot.pl/en, once deployed and only upon your cookie-banner consent. On the effective date of this Policy, these tools are not yet in use; we will inform you of their deployment by updating this Privacy Policy.

d) Law firms, accounting offices, legal and financial advisors – to the extent necessary to perform services for the Controller, under confidentiality obligations.

e) Public authorities and authorized entities – in cases and to the extent required by law (e.g., courts, prosecutor's office, the President of UODO, tax authorities).

Displaying advertising content in the Free Plan does not involve sharing your personal data with advertisers – ads are not personalized based on your data, and advertisers only provide us with the ad content.

We do not sell your personal data.

8. Do we transfer data outside the European Economic Area (EEA)?

The infrastructure we use (OVH) – including the Service's servers and the mailbox for the contact@fonbot.pl address – is located in the European Union.

However, some providers we cooperate with may process data in third countries:

  • Telegram – platform infrastructure is located in various locations, including outside the EEA;
  • Stripe – entity group with offices in, e.g., the US and Ireland; some data may be processed in the US;
  • Google – handling of correspondence delivered to the Gmail mailbox and, once deployed, analytics tools; Google group entities operate in, e.g., the US (Google LLC holds EU-US Data Privacy Framework certification).

Regarding Stripe and Google, we ensure that transfers take place only on the basis of mechanisms providing an adequate level of protection required by the GDPR, in particular:

  • European Commission adequacy decisions (e.g., EU-US Data Privacy Framework for certified US entities),
  • Standard Contractual Clauses approved by the European Commission,
  • other legally recognized safeguards.

Regarding Telegram, you use the platform based on your own relationship with its provider (by accepting Telegram's terms of service and privacy policy). Data processed by Telegram as the messenger operator is subject to its own rules, which we have no influence over; we communicate with you solely through the Telegram Bot API and do not enter into a separate data transfer agreement with Telegram.

You may request copies of applicable safeguards (where applicable) by e-mailing contact@fonbot.pl.

9. Do we make automated decisions, including profiling?

We do not make decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.

We apply automated mechanisms to match Listings to your search criteria and to detect abuse – these are necessary for the Service to function but do not determine your rights or obligations. You always control your search configuration yourself.

Advertising content displayed in the Free Plan is not selected based on profiling – we present the same content to all Free Plan Users regardless of their data.

10. Cookies and similar technologies

The Telegram bots themselves do not use cookies, because interaction takes place inside the Telegram application rather than in a browser.

Cookies may be used on our website fonbot.pl/en:

  • essential (technical) cookies – necessary for the correct operation of the website; processed on the basis of Art. 6(1)(f) GDPR (legitimate interest) and Art. 399 of the Electronic Communications Act; no consent required;
  • analytics cookies (e.g., Google Analytics – once deployed) – used to measure traffic and analyze user behavior; processed only with your consent expressed via the cookie banner;
  • marketing cookies (if deployed in the future) – also only with consent.

You can change your cookie preferences at any time via the website settings or your browser. Disabling certain cookies may limit website functionality.

11. How do we protect your data?

We apply technical and organizational measures proportionate to risk, in particular:

  • transmission encryption (TLS/HTTPS, encrypted communication with the Telegram Bot API),
  • hosting in a trusted, professional data center (OVH, EU),
  • regular backups,
  • logging and monitoring (ELK/Kibana),
  • environment separation (production/testing),
  • data-minimization policy – we process only data necessary for the purpose,
  • strong authentication,
  • restricted circle of persons authorized to process data,
  • incident response in accordance with the GDPR (including notifying PUODO within 72 hours where required by law).

12. What are your rights?

Under the GDPR, you have the following rights:

a) Right of access (Art. 15 GDPR) – to receive information on the data we process and a copy.

b) Right to rectification (Art. 16 GDPR) – to correct inaccurate or incomplete data.

c) Right to erasure (Art. 17 GDPR, "right to be forgotten") – to request erasure where there is no further legal basis for processing.

d) Right to restrict processing (Art. 18 GDPR) – in specific cases.

e) Right to data portability (Art. 20 GDPR) – to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (for data processed under consent or contract).

f) Right to object (Art. 21 GDPR) – to object to processing based on legitimate interest; for direct marketing – at any time, and we will stop such processing.

g) Right to withdraw consent – where processing is based on consent, you may withdraw it at any time; this does not affect prior lawfulness.

How to exercise these rights? Send an e-mail to contact@fonbot.pl with a description of your request, or write to our @FON_Support Telegram contact account. We will respond without undue delay, no later than within one month of receiving the request (extendable in complex cases by another 2 months – we will inform you).

Not all rights are absolute – in certain cases, the law requires us to continue processing data (e.g., retaining invoice data under tax law).

13. Can you file a complaint?

Yes. If you believe we process your data unlawfully, you have the right to file a complaint with the supervisory authority, which in Poland is:

President of the Personal Data Protection Office (PUODO) Stawki 2, 00-193 Warsaw, Poland Website: https://uodo.gov.pl

Before doing so, we encourage you to contact us directly (contact@fonbot.pl) – we will do our best to resolve any matter promptly and fairly.

14. Can we change the Privacy Policy?

Yes. The Privacy Policy may be updated as the Service, law, or technology evolves. The current version of the Privacy Policy is always published at fonbot.pl/en/privacy with a version number and effective date. A link to the Privacy Policy is also available in the welcome message of the Config Bot (response to the /start command).

If the change affects processing based on your consent, we may ask you to give consent again.

We encourage you to review the Privacy Policy periodically. Continued use of the Service after the changes take effect means you have taken note of them.

15. Contact

For any matter related to your personal data, write to us:

  • E-mail: contact@fonbot.pl
  • Telegram contact: @FON_Support
  • Correspondence address: ul. Lipowa 3D, 30-702 Kraków

We care to keep your data safe and our communication clear.