Privacy policy

Controller: Magnet Ltd, Ras Al Khaimah, United Arab Emirates (registration number 01010667). Sold by: IE Artem Polyanskiy, Georgia (Small Business), Tax ID (s/n): 305603825. Contact: support@magnets.tg.

Effective date: 11 September 2026. Version: 1.4 (international edition), effective from 28 October 2026, the day of its publication; notice of it is given on that day (Terms, Section 15.1). Clauses 3.10, 5.1(g), 6.8, 7.1, 7.2, 8.7, 10.1(g) and 11.2 (member network) apply only to Users who publish a card after the separate consent under Terms, clause 10A.3; the 30-day notice under Terms, Section 15.1 does not apply to them. Version 1.3 is effective from 28 October 2026, the day of its publication; notice of it is given on that day (Terms, Section 15.1). Clauses 1.1, 3.4, 3.5, 5.1(b) and 7.1 (auto top-up and payments in Telegram Stars) concern only the data of Users who turn on auto top-up or pay in Stars and apply to them from that day. Clause 8.6 (inactivity on the free plan) is published with this version for the first time; for a User who accepted the Terms before that day it applies 30 days after the notice. Should any other change nonetheless worsen the position of a User who accepted the Terms before that day, it applies to that User 30 days after the notice. Previous version: 1.3, effective 28 October 2026 (auto top-up and payments in Telegram Stars); version 1.2, effective 11 September 2026; version 1.1, effective 1 September 2026.

1. Who we are

1.1. This Privacy Policy explains how Magnet Ltd, a Company Limited by Shares registered with the Registrar of Companies, Innovation City Authority, Government of Ras Al Khaimah, United Arab Emirates (registration number 01010667, licence number 07010667) (the “Provider”, “we”) processes personal data of users of the WAM Agents service (the “Service”). The Provider operates the Service and its infrastructure and determines the purposes and means of the processing described below. Subscriptions are sold by IE Artem Polyanskiy (Georgia, Tax ID / s/n 305603825) on the Provider’s behalf, save for purchases paid in Telegram Stars, which the Provider sells itself (Terms, Section 10.2a); that entity does not determine how personal data is processed in the Service and acts as a separate controller only in respect of its own sales and accounting records.

1.2. For the purposes of the EU General Data Protection Regulation (GDPR), the Provider acts as the controller of the personal data described below. For Users in Turkey, the Provider acts as the data controller (veri sorumlusu) within the meaning of the Law on the Protection of Personal Data No. 6698 (KVKK). The Provider also processes personal data as a controller within the meaning of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

1.3. This Policy forms an integral part of the Terms of Service and uses the definitions established there.

2. Scope

2.1. This Policy covers the WAM Agents Service accessed through Telegram (@wamagentsbot and the personal bot allocated to the User) and the isolated Container in which the User’s Agent runs.

2.2. It does not cover third-party services the User connects to (for example, the User’s own LLM-provider account), which are governed by those third parties’ own privacy policies.

3. Personal data we process

3.1. Account and identification data: Telegram user identifier, Telegram username, Telegram language code, and preferred interface language.

3.2. Contact data: the email address the User provides for billing, receipts or support.

3.3. Credential data: the Bot Token (Telegram) and, for own-model plans, the OAuth Token (e.g. Anthropic), stored solely to operate the Service for the User.

3.4. Payment data: the User’s card and payment-instrument data are collected and processed by Creem acting as Merchant of Record (Section 7), not by the Provider. The Provider receives from Creem only transaction identifiers, payment status, plan and Subscription state, magnet balance and recurring-charge identifiers. The Provider does not process or store full card numbers or CVV codes. Payments in Telegram Stars (Terms, Section 10.2a) are processed by Telegram under its own terms; for them the Provider receives from Telegram only the payment identifier, the amount in Stars and the item purchased. For auto top-up (Terms, Section 10.1f) the Provider also keeps its settings: the pack, threshold, cap and payment method chosen, the state of auto top-up, the number of declined charges and the reason for a pause.

3.5. Consent records: the fact, time and text version of the User’s acceptance of the Terms; for the default-model plan, the fact and time of the User’s explicit consent to the cross-border transfer of data to the People’s Republic of China (Section 6); the fact, date and time, screen-text version and parameters of the User’s consent to auto top-up (Terms, Section 10.1f(b)); and the fact, date and time of a withdrawal of permission to use a saved payment method (Terms, Section 10.3a).

3.6. Service-operation metadata: per-Container activity logs, including timestamps, command types and short prompt previews (limited to 100 characters) for diagnostics and abuse detection. The Provider does not retain the full texts of prompts and responses outside the User’s Container (see clause 4.1).

3.7. Container telemetry: CPU, memory and disk usage, availability metrics, and Docker lifecycle events.

3.8. Agent configuration: policies, skills and other configuration artefacts placed within the writable working space of the Container.

3.9. Message content. The content of the User’s messages to the Agent is processed in transit to perform the Service. The User may, at their own discretion, place personal data — their own or that of third parties — into the Agent; on the default model this content is transmitted to DeepSeek as described in Section 6.

3.10. Member-network data (only for Users who have published a card — Terms, Section 10A): approved versions of the card and summary; the Telegram username, which the Provider checks against the account on every publication so that it can be given to the other side on mutual interest; participation settings — publication, search mode and the wording of whom the User is looking for (not shown to other Members); marks of interest and decline with the reason phrase and dates; pair state — mutual interest, “connection made” mark, block; the event queue for the User’s Agent; a log of cards shown to the User’s Agent and of pre-screening rejections (the query is stored only as a hash); a log of card actions — publication (as a record of the consent under Terms, clause 10A.3), take-down, deletion: dates and version numbers, without text; limit counters; reports — the User’s text and a reference to the card. In the User’s Container the Agent keeps a record of the User’s mutual-interest pairs for the “did you connect?” question. The Provider does not receive or store the conversations Members hold after mutual interest.

Cookies and similar technologies. The website stores necessary cookies to keep the site working; analytics and marketing cookies are used only after you allow them in the consent banner. Which cookies exist, what each category does and how to withdraw consent is described in our Cookie Policy.

4. Data we do not process

4.1. The User’s isolated Container (Hetzner) stores a message journal of the User’s chat with the Agent: Telegram user id, @username, message texts and voice transcripts. The journal is kept for up to 180 days, to keep context and find files the User sent; it is accessible only to the User’s Agent and is not shared with other users. Outside the Container, the Provider does not retain the full bodies of the User’s dialogues beyond ephemeral transit and the short metadata in clause 3.6.

4.2. For own-model plans, the full dialogue flows from the User’s Container to the LLM provider’s API using the User’s own OAuth Token and is governed by that provider’s privacy and retention policies. For that transfer the User acts as an independent controller; the Provider does not determine its content.

4.3. The Provider does not process full bank-card numbers, CVV codes or other sensitive cardholder data (clause 3.4).

5. Purposes and legal bases

5.1. The Provider processes personal data for the following purposes and on the following legal bases (GDPR Article 6; KVKK Articles 5 and 9):

(a) To provide the Service — registration, allocation and operation of the Container and Agent. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

(b) Billing, Subscription management, Free-plan accounts and magnet accounting, auto-renewal, auto top-up and refunds — payments operated through Creem as Merchant of Record or, for payments in Telegram Stars, through Telegram. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation (Art. 6(1)(c)).

(c) Support, incident response, security monitoring and abuse prevention. Legal basis: the Provider’s legitimate interests in operating a secure service (Art. 6(1)(f)).

(d) Cross-border transfer to the PRC for the default model (Section 6). Legal basis: the User’s explicit consent (Art. 6(1)(a)), which also constitutes the derogation under Art. 49(1)(a) and explicit consent (açık rıza) under KVKK Art. 9.

(e) Compliance with tax, accounting and other statutory obligations to which the Provider is subject. Legal basis: legal obligation (Art. 6(1)(c)).

(f) Service improvement in aggregated, de-identified form. Legal basis: legitimate interests (Art. 6(1)(f)).

(g) Member network (Terms, Section 10A) — showing the card, matching, passing the contact on mutual interest, protecting Members against abuse. Legal basis: the User’s consent given on publishing the card for showing the card to other Members (Art. 6(1)(a)); for the rest of the member-network processing, performance of a contract — the member-network service the User turns on by publishing the card (Art. 6(1)(b)); for protecting Members against abuse, legitimate interests (Art. 6(1)(f)).

5.2. Where processing relies on consent, the User may withdraw it at any time (Section 10); withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Default model (DeepSeek) and transfer to the PRC

6.1. The default flow. Unless the User attaches their own model, the Agent’s computations are performed via the Provider’s shared technical key against the API of Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (“DeepSeek”). This flow transmits data to DeepSeek’s servers in the People’s Republic of China (PRC), where it is processed and stored under PRC law.

6.2. Data transferred. The following are transferred to DeepSeek: the content of the Agent’s system and user messages, the images the User sends (first-line image understanding), the content of the model’s responses, request metadata (timestamps, model identifier, token counts), and the network metadata of the outbound connection from the Container (the IP address of the Provider’s hosting infrastructure in Germany). The Provider does not embed direct identifiers (Telegram identifier, name, email) in these requests; the User acknowledges, however, that message content may include personal data placed in the Agent at the User’s own discretion.

6.3. No adequacy; legal basis for the transfer. The PRC has not received an adequacy decision from the European Commission, and the level of protection there differs materially from that under EU/EEA and Turkish law. The transfer therefore takes place on the basis of the User’s explicit consent, given by an affirmative action when registering for the Service on the default model (on any plan) after this disclosure is presented (GDPR Art. 49(1)(a); KVKK Art. 9). Without that consent the default flow cannot be provided. The User may withdraw consent at any time (clause 6.7).

6.4. DeepSeek’s processing and retention. Under DeepSeek’s own Terms of Use and Privacy Policy: data is stored on servers in the PRC; the retention period is stated as “as long as necessary”, with no fixed calendar limit; and DeepSeek’s terms permit it to use the transmitted inputs and outputs to provide and improve its services and, under its Open Platform Terms, to train its models. These conditions are set by DeepSeek and cannot be modified by the Provider, which also does not control the timing of deletion on DeepSeek’s side.

6.5. Regulatory context the User should be aware of:

(a) Italy — in January 2025 the Italian authority (Garante) ordered restrictions on the distribution of the DeepSeek application in Italy over data-protection concerns.

(b) Germany — in 2025 the Berlin data-protection commissioner referred to Apple and Google a request concerning DeepSeek’s disclosure of safeguards for transfers to the PRC.

(c) EU investigations — formal proceedings concerning DeepSeek have been announced by the authorities of France (CNIL), Ireland (DPC), Belgium (APD) and the Netherlands (AP).

(d) DeepSeek self-restriction — effective 8 April 2026, DeepSeek applies network restrictions on direct access from the United States.

(e) Sanctions — as of the effective date of this Policy, DeepSeek is not on the OFAC SDN list, the BIS Entity List, or under EU restrictive measures. The regulatory environment may change, and the Provider will give notice of material changes.

6.6. No bilateral DPA. As of the effective date, DeepSeek does not publish a standard data-processing agreement; the engagement rests on DeepSeek’s Terms of Use and Open Platform Terms in their current form. The Provider will update this Policy and the Subprocessors page if a bilateral DPA is concluded.

6.7. How to avoid the transfer. The User may, at any time: (a) attach their own model via the /claude command, routing traffic to the chosen provider (e.g. Anthropic in the USA) under the User’s own account; or (b) withdraw the consent of clause 6.3 — in which case the default flow ceases and the User either switches to an own-model plan or cancels the Subscription with a pro-rata refund under the Refund & Cancellation policy. The Provider recommends that the User not place third parties’ personal data or special-category data into an Agent running on the default model.

6.8. Member network. For pre-screening in the member network (Terms, clause 10A.6(b)), the summaries of Members’ cards, without identifiers, and the wording of whom the searching User is looking for are sent to DeepSeek via a dedicated technical key of the Provider. Full cards, usernames and identifiers are not sent. Clauses 6.4–6.6 apply to this flow; the legal basis of this transfer is set out in clause 7.2.

7. International transfers and subprocessors

7.1. The Provider engages the following processors and recipients:

Recipient	Role	Location
Creem (Armitage Labs OÜ)	Merchant of Record — payment processing, billing documents, tax collection and remittance	Estonia (EU/EEA)
Hetzner Online GmbH	Hosting of Containers and Agent runtime	Germany (EU/EEA)
Hetzner Online GmbH	Member-network server (Terms, Section 10A)	USA (Ashburn, Virginia)
Telegram FZ-LLC	Message transport via the Telegram Bot API; payments in Telegram Stars, which Telegram processes under its own terms (clause 3.4)	UAE
Deepgram, Inc.	Speech-to-text for voice, audio and video messages	USA
Hangzhou DeepSeek Artificial Intelligence Co., Ltd.	Default-model inference and first-line image understanding (Section 6); pre-screening of member-network card summaries via a dedicated key (clause 6.8)	PRC
OpenAI, L.L.C.	Fallback image understanding for images the User sends, used only when DeepSeek vision is unavailable, on the default-model plan; speech synthesis for voice replies (default voice)	USA
Perplexity AI, Inc.	Web search performed at the User’s request, on the default-model plan	USA
Replicate, Inc.	Image generation performed at the User’s request; speech synthesis for voice replies (last-resort fallback)	USA
MiniMax (Nanonoble Pte. Ltd.)	Speech synthesis for the Agent’s voice replies with richer voices, at the User’s request	Singapore
Composio (Sampark Inc)	Integrations with third-party services the User connects by link (Gmail, Google Calendar, Google Docs, Google Drive and other apps); performs the actions the User requests in those apps	USA
Anthropic PBC	Own-model (Claude) inference via the User’s own OAuth Token; the User is an independent controller for this flow	USA

7.2. Transfer mechanisms. Transfers to recipients within the EU/EEA (Creem, Hetzner) do not require a transfer mechanism. For recipients outside the EU/EEA: the transfer to DeepSeek (PRC) relies on the User’s explicit consent (Section 6); transfers to Telegram (UAE), to MiniMax (Singapore) and to Deepgram, OpenAI, Perplexity, Replicate and Composio (USA) are necessary for the performance of the contract requested by the User (GDPR Art. 49(1)(b)) and, where applicable, are covered by appropriate safeguards. Member-network data (clause 3.10) is stored on a server in the USA operated by Hetzner Online GmbH; this storage relies on the standard contractual clauses in the Provider’s data processing agreement with Hetzner (GDPR Art. 46(2)(c)) and, for Users in Turkey, on the standard contract under KVKK Art. 9. Card summaries, without identifiers, and search wordings are sent to the PRC for pre-screening (clause 6.8) on the basis of the Member’s explicit consent to that transfer given on publishing the card after being informed of its risks (Terms, clause 10A.3(b); GDPR Art. 49(1)(a); KVKK Art. 9). Except for the storage of member-network data in the USA under the standard contract referred to above, for Users in Turkey transfers abroad are made on the basis of explicit consent under KVKK Art. 9. The current list of subprocessors is published at Subprocessors.

8. Retention

8.1. Account data and Container configuration are retained for as long as the User’s account exists, on any plan.

8.2. On cancellation of the Subscription (auto-renewal turned off, clause 12.2 of the Terms), Container data is not destroyed: after the paid period ends the Agent moves to the Free plan, and the Container keeps the User’s working files and remaining magnets. Container data is deleted on account deletion (/delete, clause 8.3).

8.3. On account deletion (/delete), all records associated with the User are removed from the Provider’s systems, except: (a) accounting and tax data whose retention is required by the law applicable to the Provider, and by Georgian law in respect of the sales records of the selling entity; (b) limited log records needed to investigate security incidents — up to 90 days; and (c) data that has been irreversibly anonymised.

8.4. Backups are rotated on a cycle of no more than 30 days.

8.5. DeepSeek side. The retention and deletion of data transferred to DeepSeek under the default model are determined by DeepSeek’s Privacy Policy (clause 6.4) and are not controlled by the Provider.

8.6. Inactivity on the free plan. Where a User on the free plan sends the Agent no messages for 30 consecutive calendar days, the Provider sends a notice through @wamagentsbot; 7 calendar days after the notice without resumed interaction (by messaging the Agent, tapping the button in the notice or running /start), the Container data — conversation history, working files, Agent configuration — is deleted. Account data, the Telegram bot identifiers, the magnet balance and referral links are retained until account deletion (clause 8.3); the Container can be created anew with /start, and the previously deleted data is not restored. This clause does not apply to the paid plan while the Subscription is in force.

8.7. Member network. (a) The card, summary and participation settings are kept until the User deletes them. Taking the card down hides it but does not delete it. Unanswered interest fades after 30 days; blocks and declines have no time limit. (b) When the card is deleted — through the Agent, by request via /support or on account deletion (clause 8.3) — the following are deleted: the text of all versions of the card and summary, participation settings, the Telegram username stored for the network, the User’s own marks of interest and decline, the event queue, the view and pre-screening logs in both directions, and pairs without mutual interest. The following are kept: the record of a pair in which interest was mutual — dates and the “connection made” and block marks, without a reference to the deleted side and without its reason phrase; a decline or block set by the other side — with the User’s internal identifier, so that the other side’s choice still applies if the User publishes again (the User’s own reason phrase and marks are removed from that record); and a service record of the card without text — its status and the version numbers to which such declines and blocks are tied. These records are kept to protect Members against abuse and for statistics (legitimate interests, clause 5.1): the record of the other side’s decline or block for as long as that decline or block stands — until the other side lifts it or deletes its own card; the record of a pair with mutual interest is detached from the deleted side. Publishing again creates a new card. On account deletion, the records referred to in this point and in point (c) are kept in addition to the exceptions in clause 8.3. (c) Reports are tied to the account, survive deletion of the card and are kept for 1 (one) year from submission. Limit counters survive deletion of the card at the User’s request, so that deleting and re-publishing does not reset limits, and are deleted on account deletion; otherwise they are deleted once the period following the one they relate to has ended. A report made via /support is kept as a support request. (d) The Telegram username, summary and reason phrase given to the other side on mutual interest remain with that side in Telegram and in its Container; the Provider cannot withdraw them. Deletion under point (b) does not reach the copies of summaries and search wordings previously sent to DeepSeek for pre-screening: their retention and use are governed by DeepSeek’s terms (clause 6.4). (e) The pair records in the User’s Container (clause 3.10) are deleted when the card is deleted through the Agent and together with the Container data. Information about other Members that the Agent has told the User remains in the User’s conversation history and Agent memory and is deleted together with them.

9. Security

9.1. The Provider applies technical and organisational measures proportionate to the risk, including: (a) per-User Container isolation (Linux namespaces with cap_drop: ALL, read_only: true, no-new-privileges: true, tmpfs-mounted home, non-root execution); (b) volume encryption in foreign infrastructure (LUKS or equivalent); (c) access control on the least-privilege principle; (d) transport encryption (TLS); (e) monitoring, log rotation and incident response; and (f) pseudonymisation of user identifiers in the execution tier, except the message journal in the User’s own Container (clause 4.1).

9.2. The Bot Token and OAuth Token are treated as confidential. The User remains responsible for revoking them (via BotFather or the LLM provider) on any suspected compromise.

10. Your rights

10.1. Subject to applicable law, the User has the right to: (a) access their personal data; (b) rectify inaccurate data; (c) erase data (“right to be forgotten”); (d) restrict or object to processing; (e) data portability; and (f) withdraw consent — including the consent to the PRC transfer for the default model — at any time; and (g) take down their member-network card at any time and delete member-network data through the Agent or request its deletion (clause 8.7) — taking the card down stops it being shown, and deleting it ends participation in the network, subject to the records kept under clause 8.7(b) and (c); neither withdraws a contact already given to the other side on mutual interest.

10.2. The User is not subject to decisions producing legal or similarly significant effects taken solely by automated means (Section 11).

10.3. Requests are made to support@magnets.tg or via @wamagentsbot. The Provider responds without undue delay and in any event within one month, extendable where permitted by law.

10.4. Complaints. A User in the EU/EEA may lodge a complaint with their local supervisory authority. A User in Turkey may apply to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

11. Automated decision-making

11.1. The Provider does not use the User’s personal data to take automated decisions producing legal or similarly significant effects without human involvement. Agent actions are performed under the User’s control (Terms, Section 7).

11.2. Member network. The member network uses the automated processing described in Terms, clause 10A.6: a contact check of the card, pre-screening of summaries by the DeepSeek model, and automatic withdrawal of a card after reports from several different Members within a set period. Pre-screening determines which cards the Agent receives and in what order, and may mean that the User’s card is not shown to someone; decisions about meeting are made by the Users themselves. The User may object to this processing via /support or support@magnets.tg and request human review; taking the card down stops it being shown, and deleting the card ends this processing entirely (clause 10.1(g)).

12. Children

12.1. The Service is not directed to persons under 16 years of age. If the Provider becomes aware that a person under 16 is using the Service, the relevant personal data will be deleted unless its retention is required by law.

13. Changes to this Policy

13.1. The Provider may update this Policy. Notice of material changes is given via @wamagentsbot, by email, or by in-product announcement, at least 30 days before the effective date (Terms, Section 15).

14. Contact

14.1. Controller: Magnet Ltd, Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates (registration number 01010667). Data-protection enquiries: support@magnets.tg. Full details of every entity involved are set out in the Imprint.