Privacy Policy

This Privacy Policy explains how Overgroups collects and processes personal data through overgroups.com and the Service, in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

2. What personal data we process

Account data

When you create an account we process your email address, your name, and an encrypted (hashed) password. We never store your password in readable form.

Group and member data

When you connect a Telegram group and manage its members, we process data about those members on your behalf, which may include their Telegram user ID and username, first and last name, profile photo, email address, invitation links, message content used to generate summaries, and access and activity logs (for example joins, removals and status changes).

Payment data

We process two separate types of payment data, and in neither case do we store full card numbers (card details are handled directly by Stripe under their security standards):

• Your platform subscription: the fee you pay us to use the Service is processed through Stripe. We store identifiers such as your customer and subscription references to manage your account.
• Your members' payments: your members subscribe and pay you directly through your own connected Stripe account. We do not receive, hold or process that money and we charge no commission on it. We only store the identifiers and subscription status needed to grant or revoke their access to your Telegram group.

Technical and usage data

When you use the Service we process limited technical data such as your IP address and browser type, handled by our hosting provider in server logs to keep the Service secure and running. We do not use third-party analytics or tracking tools. See our Cookie Policy for details.

3. Purposes and legal bases

• Providing the Service (creating your account, connecting Telegram, managing members): performance of a contract (art. 6.1.b GDPR).
• Billing your platform subscription through Stripe: performance of a contract.
• Generating AI summaries of group messages through OpenAI: performance of the feature you request, and where applicable your consent.
• Security, fraud prevention and Service improvement: our legitimate interest (art. 6.1.f GDPR).
• Legal and accounting obligations (for example invoicing): compliance with a legal obligation (art. 6.1.c GDPR).

4. Our role: controller and processor

In respect of your own account and billing data, we act as data controller. In respect of the personal data of the members of the Telegram groups you manage, you are the data controller and we act as a data processor on your behalf. You are responsible for having a lawful basis to process your members' data and for informing them appropriately.

5. Service providers and recipients

We share personal data only with providers that help us run the Service, acting as our processors or as independent controllers under their own terms:

• Stripe (payment processing): stripe.com/privacy.
• Telegram (group and channel management): telegram.org/privacy.
• OpenAI (AI message summaries): openai.com/policies/privacy-policy.
• Our hosting provider, which stores the Service data on our behalf.

We do not sell your personal data.

6. International data transfers

Some providers, such as Stripe and OpenAI, may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy mechanism like the EU to US Data Privacy Framework.

7. Data retention

We keep your account and member data for as long as your account is active and you use the Service. After you close your account, we delete or anonymise personal data, except where we must retain certain records to comply with legal obligations (for example, billing and tax records for the period required by law).

8. Your rights

You may exercise the following rights at any time by contacting us at hello@overgroups.com:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure of your data.
• Restriction of processing.
• Objection to processing.
• Data portability.
• Withdrawal of consent at any time, without affecting prior processing.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including encryption of credentials and access controls. No method of transmission or storage is completely secure, but we work to protect your information.

10. Children

The Service is not directed to children. You must be at least 14 years old to create an account, in line with Spanish law, and have the legal capacity to enter into a contract.

11. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. Significant changes will be communicated through the Service where appropriate.

12. Contact

For any question about this policy or your personal data, contact us at hello@overgroups.com.