Privacy policy

Scan My Bags, Telegram bot @ScanMyBagsBot, and this website. Last updated: [date]

1. Who is responsible

[Name, address, exactly as in the Impressum]
Email: support@scanmybags.xyz

2. What the bot does

Scan My Bags checks crypto tokens and portfolios using public blockchain and market data. You send wallet addresses, token addresses or tickers in a Telegram chat; the bot replies with an automated scan.

3. Which data we process, and why

a) Your Telegram account (stored). Your Telegram user ID (a number; we do not store your name, username or phone number); the date you started the bot and, if you came via a link, the link's campaign code; whether and when you accepted the terms and agreed to the immediate start of Premium; your Premium status, daily usage counters and settings (morning screen, green-only view). Purpose: providing the bot, the free daily allowances and Premium. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

b) Purchases (stored). Plan, number of Stars, date and Telegram's payment reference. Payments are made in Telegram Stars and processed by Telegram; we receive no card, bank or other payment details. Purpose: delivering Premium, refunds, bookkeeping. Legal basis: Art. 6(1)(b) and (c) GDPR; records are kept for the period required by tax law (in Germany up to 10 years).

c) What you send to scan (not stored). Wallet addresses, token addresses, tickers and amounts are used only to create your scan. They are held in the bot's working memory for up to 30 minutes, so a scan can be shown in full after buying Premium, and are never written to the database or to log files. Wallet addresses can be personal data, because a wallet can belong to you. Legal basis: Art. 6(1)(b) GDPR.

d) Anonymous usage statistics (stored). Counts such as "a scan with 12 tokens was made at 14:03", without your user ID or any address. Purpose: understanding usage and capacity. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

4. Data providers

To read public data, the bot sends requests to these providers. The requests contain only addresses, never your Telegram ID.

Some providers are located outside the EU (USA). [Legal basis for transfers to third countries, e.g. EU-US Data Privacy Framework certification of the provider or standard contractual clauses.]

The bot runs on a server of DigitalOcean [region, e.g. Frankfurt, Germany]. Telegram processes your messages under its own privacy policy: telegram.org/privacy.

5. This website

This website is a static page served by Cloudflare [check: Cloudflare Pages]. Cloudflare processes your IP address and technical request data to deliver the page and protect it from attacks (legitimate interest, Art. 6(1)(f) GDPR). We set no cookies, use no analytics and load no external fonts or scripts.

6. How long we keep data

Account data (3a): until you delete it with /forgetme in the bot or ask us to. Purchases (3b): as long as required by tax law. What you send to scan (3c): at most 30 minutes, in memory only. Daily database backups are kept for 14 days.

7. Your rights

You can ask for access, correction, deletion, restriction and data portability, and object to processing based on legitimate interest. /forgetme in the bot deletes your account data immediately (purchase records stay as required by law). For anything else, email support@scanmybags.xyz.

You can also complain to a data protection authority, for example Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), datenschutz.hessen.de.

8. No automated advice

Scans are automated research based on public data, not financial advice and not a recommendation to buy, hold or sell.