Privacy Policy

Who we are

HeadHack replies to incoming Telegram messages on your behalf while you are busy, helps you work with documents, organize email, and find meeting times. Website: headhack.ru. The application is available as a Telegram Mini App and a web application. This policy also applies to the HeadHack App and HeadHack Calendar OAuth applications.

For questions about your data, contact info@cropxai.com or use the Messages section in the application to contact support.

What data we collect

• Telegram profile: your identifier, name, and username. Telegram provides these when you open the application so that we can identify whose settings to use.
• Assistant settings: instructions, reply style, facts about you, knowledge-base documents, and meeting schedules. You provide this information yourself.
• Conversations in which the assistant operates: incoming message text and replies. This lets the assistant respond in context and lets you see what it wrote.
• Payment data: order number, product or plan, amount in rubles, status, Robokassa transaction identifier and payment method, receipt and refund data. HeadHack does not receive or store full card details, including card numbers or CVC codes.
• Recurring-payment consent and withdrawal history: the version and URL of the offer, time, account, and technical details of the action. We use these records to prevent charges without explicit consent and to resolve disputed transactions.
• Technical records: usage for replies, errors, and the time of your last sign-in.

Data from connected Google services

Connecting a service is your choice and always a separate action. HeadHack has no access until you click Connect.

• Google Drive (drive.file): you choose an individual file in Google Picker. HeadHack obtains access to the selected files, their metadata, and their contents so that you can attach a file to a message or add it to the assistant's knowledge base. Browsing your entire Drive inside HeadHack is disabled. Previously authorized connections may retain drive.readonly until you reconnect. Although drive.file permits changes to selected files, HeadHack does not modify or delete the source files.
• Google Calendar (calendar.freebusy): we retrieve only busy intervals for your primary calendar through FreeBusy and exclude them from the working hours you set. Event titles, descriptions, participants, and contents are not needed for this. Previously authorized connections may retain calendar.readonly until you reconnect. We do not create, edit, or delete events.
• Gmail (gmail.readonly): when you run an email skill, we read the headers and snippets of recent unread messages to prepare a summary, identify important items, and suggest next actions. If you enable personal writing-style learning, we also read the text of your sent messages to personalize your assistant's settings. This integration does not send, modify, delete, or mark email messages as read.

How we handle Google data

• HeadHack's use of Google user data is subject to the Google API Services User Data Policy, including its Limited Use requirements.
• When you select a file, the server receives its metadata and, when required by your action, downloads or exports the selected document. A document added to the knowledge base, its extracted text, or its link is stored until you delete it. Email-skill results and personal writing-style settings may be stored in the application's history. Disconnecting a connector stops further access but does not by itself delete previously created results and documents.
• Access credentials are stored in encrypted form and are used only for actions you request in the application.
• We do not sell Google data or use it for advertising. HeadHack does not use data obtained through Google Workspace APIs, including original, aggregated, or derived data, to create, train, or improve general, non-personalized artificial intelligence or machine learning models. Personalizing your own assistant's writing style is not training a general model.
• Our team does not read your files or emails, except when you provide them in a support request so that we can investigate a problem.

How we protect data

We apply technical measures to protect data from Google and other connected services. Access is provided after authentication and within the account owner's permissions.

• Connections between your browser and headhack.ru, and requests to Google APIs, are protected by HTTPS/TLS.
• Connector secrets, including OAuth refresh tokens and stored access tokens, are encrypted on the server using AES-256-GCM. A separate encryption key is derived for each owner using HKDF; the ciphertext is also bound to the owner's identifier. Google access credentials are not shared with language-model providers.
• Requests for settings and data are checked on the server. Data and connections belong to a specific owner; signing in as another user does not grant access to them.
• OAuth callbacks are checked using a signed state parameter with a limited lifetime to bind consent to the connection initiated by the owner.
• Secrets are decrypted on the server to contact the corresponding service. They are not displayed in the application interface.

Google data and artificial intelligence

For an email summary or an answer about a selected document that you request, the relevant text may be sent to the model provider together with instructions. Checking calendar availability and excluding busy intervals from working hours are performed by ordinary code on the HeadHack server. Personal writing-style settings apply only to your own assistant.

The application uses DeepSeek API and Gemini API. The own-AI section can also connect ChatGPT, Grok, OpenAI API, Anthropic API, Gemini API, DeepSeek API, Kimi, Qwen, Groq, and xAI API. Selecting a connection does not by itself establish the corresponding provider's data-use terms.

Google Limited Use requirements do not allow Google data to be transferred to a provider that uses it to train general models. To process such data, the terms of the specific API and the settings of the account being used must exclude training general models on the submitted data and results. The user's consent to processing does not by itself waive this restriction.

Data from connected Yandex and Mail.ru services

The same rule applies as with Google: there is no access until you click Connect. Permissions are requested for the specific action of attaching a file from your mailbox or cloud drive to a reply.

• Yandex Disk (cloud_api:disk.read): we read the file list so that you can choose a file, and the selected file's contents so that you can send it to a contact or add it to the knowledge base. We do not modify or delete files.
• Yandex Mail (mail:imap_ro): through IMAP, we read only messages with attachments and the attachments themselves so that you can attach a file from an email to a reply. We do not send, modify, or delete messages.
• Mail.ru Mail (mail.imap): the same access and scope of processing, reading messages with attachments for the attachment you send yourself.
• Mailbox address (login:email for Yandex, userinfo for Mail.ru): used to show which account is connected in the application.
• Attachments are not stored; they pass through the server when sent. Access credentials are stored encrypted and used only for actions you request. Our team does not read your emails.

How to revoke access

• In the application: Settings → Connectors → Disconnect next to the service.
• In Google: myaccount.google.com/permissions.
• In Yandex: id.yandex.ru/security/services.
• In Mail.ru: account.mail.ru/user/access.
• After disconnection, access credentials are removed from our storage.

Who we share data with

Only providers needed to operate the service, and only to the extent required for the specific action:

• Telegram: to receive incoming messages and send replies.
• Robokassa: to accept payments, perform recurring charges you have authorized, process refunds, and issue fiscal receipts. We transmit the order number, amount, payment purpose, and line items. You enter the receipt email address on Robokassa's side. Robokassa retains payment data under its own policy and for the periods required by law.
• Language-model providers: to prepare reply text. They receive conversation text and your knowledge base, but not service access credentials.
• Hosting: the server on which the application runs.

How long we retain data

• Settings and the knowledge base: while you use the service.
• Conversations: until you remove the connection.
• Service access credentials: until you disconnect the service.
• Orders, payments, refunds, fiscal statuses, and consent history are retained in our protected database during the agreement and afterward for the periods required by law for tax accounting, refunds, and dispute resolution.
• After account deletion, data not needed to comply with the law or resolve a dispute is deleted within 30 days.

Consent to personal data processing

By continuing to use HeadHack after reading this policy, you freely, of your own will and in your own interest, consent to Низамов Ирек Ильгамович, tax identifier (INN) 164906925003, processing the data listed above.

Processing purposes: entering into and performing the agreement, providing the service, accepting and refunding payments, issuing receipts, maintaining consent history, handling support requests, protecting the account, and complying with legal requirements.

Consent covers collection, recording, organization, accumulation, storage, updating, retrieval, use, transfer to the providers listed in this policy, restriction, and deletion by automated and non-automated means.

You may withdraw consent by emailing info@cropxai.com. Withdrawal does not affect the lawfulness of processing already performed or require deletion of data we must retain by law. Without the necessary data, we will be unable to continue providing the service.

Your rights

You can request a copy, correction, or deletion of your data. Contact info@cropxai.com; we will respond within 30 days.