YOUR DATA

Privacy policy

Effective 2026-10-11

BigShortAds is a self-hosted application operated by one owner. The public pages provide information; only the administrator can connect accounts or operate the application. This policy applies to this installation and its configured integrations.

Information used

Depending on the features the owner activates, the application processes the owner's admin account and security activity; Telegram user and chat identifiers, Business connection permissions and messages; authorized knowledge posts; order and payment evidence; and recipient email addresses needed for Drive access.

This application uses YouTube API Services. With the owner's Google authorization it can read channel and video metadata, comments and optional channel Analytics reports. It stores access and refresh tokens to maintain that connection. Google account passwords are never requested. Google Drive delivery uses a separately configured service account and authorized folder and permission identifiers.

Purpose and sharing

Data is used for the enabled inbox, knowledge, channel reporting, reply and access-delivery features. Telegram and Google receive the requests needed to perform those features. The hosting provider stores this installation's data.

When AI features are enabled, selected message or comment text and relevant approved context may be sent to the configured DeepSeek API to generate a response. Credentials are excluded from AI context. Paid-group content additionally requires the owner's provider-sharing consent and an eligible recipient. Channel Analytics reports are displayed to the owner and are not sent to AI. The owner should enable AI only after reviewing the provider's data handling terms.

The application does not sell data, serve advertising or train general AI models. Its use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. See also the Google Privacy Policy.

Storage, cookies and retention

Secrets and sensitive stored content use application encryption. Access is restricted to the owner; operational metadata and some pending-message records remain in the database. Admin and installation pages use essential session and security cookies. Public pages use no third-party analytics, advertising cookies or external fonts.

The daily cleanup removes completed raw Telegram payloads after the configured short retention period, expired drafts and customer context, and expired Google report data. Google channel data is refreshed or removed within 30 days; disconnecting a channel removes its local API content and cancels unsent replies. The owner can shorten configured retention. Payment deduplication and security records may remain for their stated operational purpose without keeping message content.

Encrypted backups are controlled by the installation owner. Removed data can remain in an older backup until that backup expires or is removed; the owner must apply deletion and revocation records before restoring automation from a backup.

Control, revocation and deletion

The owner can pause automation, disconnect Google, delete local channel data and revoke access through Google Account permissions. Local disconnection attempts remote token revocation and reports whether Google confirmed it; access can always be revoked directly at Google. Revocation stops new access, and a rejected authorization pauses the channel.

People whose messages or delivery details are processed can contact the installation owner for access, correction or deletion. Google data deletion requests are handled within 7 days. The owner is responsible for lawful retention of payment records and for granting access only to authorized sources.

Contact

For privacy questions or deletion requests, contact noreply@bigshortads.com.

Changes

Changes to enabled services or data practices require this policy to be reviewed and updated. The policy version shown above identifies the notice accepted by the owner.