Version 2026-09-17. Operator: Доманська Дарина Юріївна, individual entrepreneur (ФОП) registered in Ukraine, tax number 3772111103, Україна, 09108, Київська обл., Білоцерківський р-н, місто Біла Церква,. Data enquiries: vtargetolog@gmail.com.
1. Three kinds of data, kept separate
RealStat ties an advertising click to a real Telegram subscription and reports it to the ad platform. That involves three distinct sets of data, and conflating them would misdescribe who is responsible for what:
- Our customers' data — people who signed up and pay for RealStat. Here we are the controller. Section 2.
- Subscriber data collected for attribution — the click, the join, the match between them and the conversion event sent to the ad account. Here we and the customer are joint controllers under Art. 26 GDPR. Sections 3 and 3.1.
- Welcome messages, broadcasts and exports. Here we are a processor: who is messaged, what is said and when is entirely the customer's decision. Section 3. The terms are in our DPA.
If you joined someone's Telegram channel and found your way here, sections 3, 3.1 and 6 are yours.
Why not simply "we are a processor". That would be easier to write and it would not be accurate. The channel owner decides why data is collected. But which data is collected, how a click is matched to a join, how identifiers are hashed before transmission and how long any of it is kept are determined by us, and the customer cannot change them. When two parties determine purposes and means together in that way, it is joint control, and the GDPR requires us to say so rather than pick the more comfortable word.
2. Customer data
What: email, name, password (stored as a hash, never in the clear), subscription and payment history, sign-in IP and timestamps, support correspondence.
Why: to provide the service, bill for it, contact you about it, and meet accounting obligations.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legal obligation for accounting records (Art. 6(1)(c)).
How long: while the account is active, plus 12 months. Payment records are kept for the period the law requires, regardless of account deletion.
We never see your card number — WayForPay handles payment, and we receive only the fact of payment and the last four digits.
3. Subscriber data (processed for our customers)
The channel owner chose to connect RealStat, and they are responsible for having a legal basis. For attribution we are joint controllers with them (section 3.1); for broadcasts and exports we are a processor acting on their instruction.
| Data | Source | Purpose |
|---|---|---|
Telegram chat_id, username, first and last name |
Telegram Bot API on joining | identify the subscriber, deliver the welcome message |
| Join, leave and block timestamps | Telegram Bot API | retention statistics |
fbclid, ttclid, _fbp, _ttp |
ad link parameters and landing page cookies | tie the subscription to a specific creative |
| IP address, user agent, landing URL | the HTTP request on click | matching, as required by Meta and TikTok |
| Campaign, ad set and ad names | ad platform URL macros | per-creative reporting |
What we do not do:
- we do not read channel content or subscribers' correspondence;
- we cannot obtain the list of people who subscribed before RealStat was connected — the Telegram Bot API does not provide it, and workarounds violate Telegram's rules;
- we cannot see whether a message was read — the Bot API has no read receipts;
- we do not sell data, and we share it only with the sub-processors listed in subprocessors.md.
Transfers to ad platforms. A confirmed subscription is sent to Meta's Conversions API and/or
TikTok's Events API — into the customer's own ad account, using the customer's own token.
Identifiers that require it (chat_id) are hashed with SHA-256 and cannot be reversed.
fbclid and ttclid are the platforms' own identifiers, which they issued in the first place.
Retention: clicks that never led anywhere are deleted after 7 days. Subscriber records are kept while the customer's account is active, plus 90 days. On the customer's instruction we delete sooner, within 30 days.
3.1. Joint control: who is responsible for what
The GDPR requires joint controllers to agree how responsibilities are divided and to publish the essence of that arrangement (Art. 26(2)). Here it is.
| What | Who |
|---|---|
| Legal basis for collecting subscriber data and transferring it to advertising platforms | channel owner |
| Telling you about the processing: their own privacy notice, naming RealStat and the transfer to ad accounts | channel owner |
| Collecting consent where consent is the basis, including the banner on their own landing page | channel owner |
| Content of welcome messages and broadcasts | channel owner |
| Which data is collected, how a click is matched to a join, hashing before transmission | RealStat |
| Retention periods and erasure | RealStat |
| Security of the platform | RealStat |
| Sub-processors | RealStat |
| Detecting a breach on the platform and notifying the channel owner | RealStat |
| Notifying the supervisory authority and affected people of a breach | channel owner, with our assistance |
| Answering your requests | channel owner as point of contact; we provide the tools and assist |
What this means for you. Under Art. 26(3) GDPR you may exercise your rights against each of the joint controllers, whatever we agreed between ourselves. You can go to the channel owner, or you can come to us, and we may not turn you away on the ground that "they are the responsible one". The table above describes our relationship with each other; it does not limit your rights.
In practice the channel owner is faster: they have erase and export buttons in the dashboard and they know the context of your subscription. But if you write to us at vtargetolog@gmail.com we will acknowledge within 5 working days and answer, together with them, inside the one-month period of Art. 12(3).
4. Cookies
On our site, only essential ones: the dashboard session and a saved language preference. We set no third-party advertising or analytics cookies.
The optional rs.js snippet a customer may place on their own landing page creates no
cookies. It only reads cookies the Meta and TikTok pixels already set (_fbp, _ttp) and
appends them to the link. Consent banners on that landing page are its owner's responsibility.
5. Recipients
Full list in subprocessors.md. In short: hosting (Contabo GmbH, Франція), Telegram, Meta, TikTok, WayForPay.
Meta and TikTok are US-established. Transfers rely on Standard Contractual Clauses and/or the EU-US Data Privacy Framework, and are made into the customer's own advertising account.
6. Your rights
Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority.
- RealStat customer? Write to vtargetolog@gmail.com. We respond within 30 days.
- Subscriber of someone's channel? The channel owner is quickest — they have the context and the erase and export buttons. But you may also come to us at vtargetolog@gmail.com: under Art. 26(3) GDPR we may not simply redirect you and stop there. We acknowledge within 5 working days, involve the channel owner, and answer within one month. For broadcasts and exports, where we are only a processor, the decision is the channel owner's — there we pass your request to them and act on their instruction.
7. Security
Credentials encrypted at rest with keys held outside the database; TLS everywhere; tokens never rendered back into the dashboard and stripped from logs and error messages; production access limited to named individuals; encrypted daily backups.
We do not claim to be unbreachable. We do commit to the measures above, and to telling you within 72 hours if something goes wrong in a way that affects you.
8. Children
RealStat is a business tool. We do not knowingly process data of anyone under 16.
9. Changes
We email customers 14 days before material changes take effect. The version date is at the top.