Sign in with TelegramMemberPilot is operated by ANVOG LLC, a New Mexico limited liability company with its place of business at 1396 Flatbush Ave, Brooklyn, NY 11210. In this policy, "we" and "MemberPilot" mean ANVOG LLC.
MemberPilot is subscription and access infrastructure for paid Telegram channels and groups. Creators connect their own Telegram community and their own payment account. We automate plans, memberships, access and digital delivery on top of them. That architecture is the reason this policy reads the way it does: most of what looks like sensitive data in a payments product never reaches us, because it stays with Telegram or with the payment provider.
Questions, requests and complaints: support@memberpilot.bot.
Two different relationships
There are two kinds of people in MemberPilot, and we hold different amounts of information about each.
Creators sign in to MemberPilot, connect a channel or group, connect a payment account and sell access. We are the controller for creator account data.
Customers do not have a MemberPilot account. They open a public checkout link, pay on the payment provider's own hosted page, and get into the creator's Telegram chat through our bot. For customer data, we act both as a service provider to the creator (running their memberships) and, for a narrower set of purposes such as fraud prevention, service-fee accounting and our own records, as a controller in our own right. The creator decides what they sell and to whom. We do not.
A customer can optionally confirm their Telegram account on a creator's public community page, so that the page can show them the membership they already hold, let them get back into the chat, and let them cancel a renewal. This is not an account: it creates no login, no password and no record of them beyond what already existed from their purchase, and it gives them access to nothing except their own memberships. See Buyer sessions below.
What we collect
From creators
Identity. Telegram is the primary sign-in. When a creator authorizes MemberPilot through Telegram's OpenID flow, Telegram returns a stable subject identifier, a Telegram user ID, a username, a display name and a profile picture URL. We store those on the creator's profile. Creators who sign in by email instead give us an email address, and receive a one-time code.
Every field of this is listed back to the creator in Settings → Account, which is the whole of what we hold about them personally. The display name is editable there. Nothing else on that screen is, because nothing else on it is ours to change: a Telegram username belongs to Telegram, and the linked Telegram account decides where this account's operational alerts are delivered.
Workspace and settings. Workspace name and URL slug, reporting currency, service fee rate, notification preferences, grace period, expiry behavior, renewal reminder schedule, and whether access codes are enabled.
Payment account connections. For Stripe, the connected account ID, the country, the default currency, whether charges and payouts are enabled, and any onboarding requirements Stripe reports as outstanding. For NOWPayments and CCPayment, the API credentials the creator pastes in (see Payment credentials below).
How a creator pays us. If a creator sells through a crypto provider, our service fee cannot be split at checkout and becomes a balance they owe us. There are two ways to settle it, and we hold different things for each.
By card. Stripe stores the card. We keep the Stripe customer ID, the payment method ID, the card brand, the last four digits and the expiry month and year, so the creator can see which card is on file.
In USDT. The creator pays a hosted invoice on MemberPilot's own CCPayment merchant account. We keep our own record of that charge: the amount, the currency, its status, which fee rows it covers, the CCPayment invoice link while it is payable, when it expires, and the coin symbol that actually arrived. We do not receive or store a wallet address, a transaction hash, or anything else that identifies the payer on chain — the transfer happens between the creator and CCPayment, and what we ask CCPayment afterwards is whether the order was paid.
From customers
Telegram identity. When someone interacts with the MemberPilot bot or joins a creator's chat through us, Telegram gives us their user ID, username, first and last name, language code, and whether they have ever messaged the bot (which is what decides whether we are allowed to message them back). This sits in one global identity record so that a person buying from three creators has one bot experience, plus one workspace-scoped customer record per creator. Creators can only ever read their own workspace's records. One creator cannot see that a buyer also subscribes to another creator.
Email address, but only when the payment provider passes one to us at checkout.
Country, but only the two-letter country code, and only when a payment provider reports it. We never infer country from a username, a phone prefix, a language setting or a name.
Attribution. If a checkout link carries a source or campaign parameter, we store it so the creator can tell which link produced the sale.
Payment information
We are not the merchant of record and we do not process cards. Checkout happens on the payment provider's own hosted page. Card numbers, CVCs, billing addresses, bank details and crypto wallet addresses never touch MemberPilot's servers or database.
What we record for each payment is metadata: the provider's payment ID, the amount in minor units, the currency, our service fee, the amount actually received where a crypto payer sent a different amount than the invoice, the shortfall or excess in that case (see section 10 of the Terms), the asset or network the provider reported when we have it, how the creator marked an excess as returned and when, the provider's fee where it is reported to us, any refunded amount, the amount converted into the creator's reporting currency along with the conversion rate and source, the country code if the provider supplied one, whether the payment was live or in test mode, and timestamps. The same fields, plus an event type, are appended to a permanent transaction ledger that is never edited. A refund adds a negative row rather than changing the original. An underpaid crypto order can be updated on the same ledger row if a later deposit on that order brings it to paid.
Payment credentials
Stripe uses Connect, so there is no secret for us to hold. We store an account ID.
NOWPayments and CCPayment have no equivalent handshake. The creator pastes an API key and an IPN secret (NOWPayments), or an APP ID and an APP Secret (CCPayment). We encrypt those with AES-256-GCM before writing them, store only the ciphertext, and keep the encryption key in the server environment rather than in the database, so read access to the database alone does not produce a usable credential. The credential rows are unreadable by every browser client at every permission level, including the creator's own. Credentials are decrypted in memory, per request, only to sign a call to that provider.
Telegram community information
For each connected channel or group: the Telegram chat ID, chat type, title, public username if it has one, description, member count, the file identifier for the chat picture, and what rights the MemberPilot bot currently holds there.
We also keep a membership roster: for each person we know about in a chat, their Telegram user ID, username, display name, current Telegram membership status, whether they are present, whether they are an administrator, whether they hold a valid entitlement, when they joined, when they left, and if we removed them, when and why. This roster is honest about its own limits. Telegram's Bot API has no call that lists the members of a chat, so we can only accumulate the roster from membership events as they happen and from people we invited ourselves. Anyone who joined before MemberPilot was installed and has not moved since is invisible to us.
Digital products
Nothing is uploaded to MemberPilot. A digital product is a reference to messages
that already live in a Telegram chat the creator controls. We store the source
chat ID, the message ID, an optional forum thread ID and message link, the
position in delivery order, the media type, the file name and size Telegram
reports, and whether the message is still reachable. Delivery is a Telegram
copyMessage call, so the file moves inside Telegram's own infrastructure. We
never download, store, re-upload or inspect the contents.
Access codes
The code itself, a normalized form used for lookup, a public redemption token, the duration and redemption limits, and one record per successful redemption containing the redeeming Telegram user ID and the date access runs to. Failed attempts are logged with the Telegram user ID, the code that was tried and the outcome, and are used for one purpose: throttling anyone trying to guess codes.
Operational records
Provider webhooks are recorded by provider, event ID, event type and a hash of the payload. We do not keep the payload. Background jobs record their type, target and outcome. Audit events record what happened, who did it and to which record, against a fixed allow-list of metadata fields, with a second filter that blocks anything whose field name looks like a credential.
What we do not collect
We want to be specific here, because most privacy policies are vague about it and because the absence is deliberate.
- No IP addresses. We do not log, store or process the IP address of any creator, customer or visitor.
- No user-agent strings, device identifiers or browser fingerprints.
- No analytics. There is no Google Analytics, no Plausible, no PostHog, no Mixpanel, no Segment, no Hotjar and no error-monitoring service running on this site or in the app.
- No advertising pixels, no conversion tracking, no retargeting, no cross-site attribution.
- No precise location.
- No message content from Telegram chats. The bot uses Telegram's privacy mode. We see slash-commands directed at the bot, membership events, join requests, and messages a creator deliberately sends to the bot to set up a digital product. We do not read the conversation in anyone's channel or group.
Cookies and similar technologies
Every cookie MemberPilot sets is required for sign-in to work. There are no analytics cookies, no advertising cookies and no cookies set for our own convenience, which is why there is no consent banner: there is nothing to consent to.
| Cookie | Purpose | Lifetime |
|---|---|---|
mp_tg_state | Anti-forgery value for the Telegram sign-in round trip | 10 minutes |
mp_tg_verifier | PKCE code verifier for the same round trip | 10 minutes |
mp_tg_nonce | Replay protection on the returned Telegram ID token | 10 minutes |
mp_tg_instant_token | Hands the verified session to the browser once | 2 minutes |
| InstantDB session cookie | Keeps a signed-in creator signed in | Set by InstantDB |
mp_buyer_state, mp_buyer_verifier, mp_buyer_nonce, mp_buyer_next | The same anti-forgery values for a customer confirming their Telegram account on a community page | 10 minutes |
mp_buyer | Remembers which Telegram account a customer confirmed, so a community page can show them their own membership | 30 days |
All of these are HTTP-only and are scoped to the sign-in routes where possible.
Buyer sessions
mp_buyer holds one thing: a Telegram user ID, signed so it cannot be edited. No
name, no username, no email, no browsing history. It is created only when a
customer presses "Continue with Telegram" on a community page, and it is used for
exactly two decisions: which of their own memberships to show them, and which
Telegram invite to reissue to them. Both are re-checked against our records on the
server before anything happens.
It is not a MemberPilot account. It creates no user record, gives access to no creator's dashboard, and stores nothing new about the person holding it. It expires after 30 days, and "Sign out" on the page deletes it immediately.
Confirming a Telegram account this way asks Telegram for identity only. It does not grant our bot permission to message anyone.
sessionStorage holds two things, both on the creator's own device and neither
sent to us: the email address typed on the sign-in screen, so a page refresh does
not lose it, and a demo-mode flag used on internal preview screens. The one-time
code is never stored.
Video embeds. Marketing pages on this site embed product walkthroughs from
YouTube using the youtube-nocookie.com domain, and load thumbnail images from
i.ytimg.com. When one of those pages loads, your browser makes a request to
Google, which means Google receives your IP address and can see which page you
were on. We receive nothing from those requests. If you would rather not make
them, block those two domains or use a browser that blocks third-party frames.
No YouTube embed appears anywhere inside the signed-in product or on checkout.
Why we process this, and on what basis
| What we do | Why | Legal basis under GDPR |
|---|---|---|
| Sign creators in, run their workspace | To provide the service they asked for | Performance of a contract |
| Grant, renew, expire and remove Telegram access | It is the product | Performance of a contract |
| Record payments, fees and refunds | To show a creator their revenue and to bill our own service fee | Contract, and legitimate interests in running the business |
| Deliver digital products and re-deliveries | It is the product | Performance of a contract |
| Throttle access-code guessing, deduplicate webhooks, keep an audit trail | To stop fraud and abuse and to be able to reconstruct what happened | Legitimate interests |
| Send operational Telegram messages (access granted, renewal due, payment failed, connection broken) | To make the service work and to warn people before access ends | Contract, and legitimate interests |
| Keep transaction and audit records after an account closes | Tax, accounting and dispute defense | Legal obligation, and legitimate interests |
We do not use anyone's data to train machine learning models, we do not sell it, we do not share it for cross-context behavioral advertising, and we do not profile people for marketing.
Who we share it with
We share the minimum each provider needs to do its job. Every one of them is listed, with what it receives and where it is, on the subprocessor page.
Telegram. Everything about access runs through Telegram's Bot API: invite links, join request approvals, removals, bot messages and digital delivery. Your use of Telegram is governed by Telegram's own terms and privacy policy, not this one. MemberPilot is an independent service and is not affiliated with or endorsed by Telegram.
Payment providers. Stripe, NOWPayments or CCPayment, depending on what the creator connected and what the buyer chose. The customer transacts with the provider directly. Each provider is an independent controller of the payment data it collects, under its own privacy policy.
Two of them also appear on the other side of the relationship, when a creator pays us the service fee they owe: Stripe, if they put a card on file, and CCPayment, if they choose to settle in USDT. In that direction the creator is the payer and MemberPilot is the merchant. CCPayment receives the invoice amount, the currency, the order identifier and our callback URL, and is an independent controller of whatever the creator gives it to make the transfer.
InstantDB. Our database, authentication and realtime layer. All application data described above lives there. Sign-in emails are sent by InstantDB's email partner, Postmark.
Hosting. The application runs in a container on a virtual server we operate through Coolify, hosted by netcup GmbH in Nuremberg, Germany.
Beyond these, we disclose information only when the law requires it, when we need to respond to a valid legal process, or when it is necessary to investigate fraud or protect someone's safety. If MemberPilot is ever acquired or merged, account data would transfer with the business, and we would say so here before it took effect.
Where data goes
MemberPilot is operated from the United States. Application data is stored with InstantDB in the United States, and the application server is in Germany. Telegram, Stripe, NOWPayments and CCPayment operate internationally and move data according to their own policies.
For anyone in the European Economic Area, the United Kingdom or Switzerland: your information is transferred to the United States. Where a transfer needs a legal mechanism, we rely on the European Commission's Standard Contractual Clauses as incorporated into our providers' data processing terms. Ask us and we will tell you what applies to your account.
How long we keep it
Account, workspace, community, offer and customer records are kept while the account is open.
Payment records, the transaction ledger, platform fee records and audit events are kept after that, because they are financial and accountability records. We keep them for at least seven years, which matches ordinary US tax record-keeping practice and outlasts the window for chargebacks and disputes.
Short-lived operational rows clear themselves much faster: sign-in cookies expire in minutes, checkout sessions expire in two hours, community connect sessions and digital-product setup sessions expire on a timer, and access-code attempt records exist only for a fifteen-minute rate-limiting window.
To be straight about it: MemberPilot does not currently run an automated deletion job when an account goes quiet. Deletion happens when someone asks. See below.
Security
- Payment provider credentials are encrypted with AES-256-GCM before they are written, and the key lives outside the database.
- Payments are only ever confirmed from a cryptographically verified provider webhook. The checkout success page does not grant access, because a URL a buyer can visit is a URL a buyer can visit twice.
- Money and access can only be written by server code. A browser client cannot create or alter a payment, transaction, subscription, entitlement, fee or audit record at any permission level.
- Workspaces are isolated at the database rule layer, not just in the interface.
- Telegram invites are single-use, short-lived and use join requests, so a forwarded link does not let anyone in.
- The global Telegram identity table is invisible to every browser client, so no creator can observe another creator's relationship with the same person.
No system is perfectly secure, and we are not going to claim otherwise. If you find a security problem, email support@memberpilot.bot and we will respond.
Your rights
Wherever you live, you can ask us to:
- tell you what we hold about you,
- correct it,
- delete it,
- give you a copy in a portable format,
- stop processing it, or object to processing based on legitimate interests.
Email support@memberpilot.bot from the address on the account, or contact us through the MemberPilot bot from the Telegram account in question, so we can tell it is you. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.
Two of those rights do not need us at all. Creators can read everything we hold about them personally in Settings → Account, and correct their display name there, without asking anyone. They can export their own customer list as a CSV from Settings → Export on the same terms.
Deleting an account. There is no self-serve delete button, and Settings → Account says so rather than implying otherwise. Ask by email. We will delete the profile, workspace, communities, offers, customer records, entitlements and stored payment credentials. Two things survive, and you should know which: the financial transaction ledger and the audit trail, retained as described above and stripped of direct identifiers where we can do so without destroying their purpose. Data already held by Telegram or by a payment provider is not ours to delete. Ask them directly.
If you are in California, you have the rights above under the CCPA as amended by the CPRA, including the right to know what categories we collect and disclose, and the right not to be discriminated against for exercising them. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no opt-out link, because there is nothing to opt out of. The categories we collect are identifiers, commercial information and internet activity limited to the strictly necessary cookies described above. Residents of Colorado, Connecticut, Virginia, Texas, Oregon and other states with comparable laws have equivalent rights and can use the same email address.
If you are in the EEA or the UK, you also have the right to lodge a complaint with your national supervisory authority. We would rather you told us first.
Children
MemberPilot is not for anyone under 18. We do not knowingly collect information from children. Creators must not use MemberPilot to sell to minors. If you believe a child has given us information, email support@memberpilot.bot and we will delete it.
Changes
If we change this policy we will update the dates at the top of this page. For changes that meaningfully affect what we collect or who we send it to, we will notify account holders by email or through the MemberPilot bot before the change takes effect.
Contact
ANVOG LLC 1396 Flatbush Ave Brooklyn, NY 11210 United States