Privacy notice

Draft prepared 14 October 2026. This notice explains how Bandly handles personal data for the Telegram Mini-App and the bandlyai.com website. It is not in force until the owner publishes it. The draft contact is hello@bandlyai.com.

Who we are

Bandly operates the Mini-App and this website. The legal entity name and address are not filled in on this draft. The owner will add them before publication. Until then, write to the contact address above.

Data we process

• Telegram identity: numeric user id, first name, and, when Telegram sends them, last name, username, and profile photo URL.
• Locale stored for the Mini-App. The website login currently records English as the locale.
• Mock content you submit: speaking audio, writing text, and reading or listening answers.
• Grading output: practice bands and comments stored with the attempt.
• Payment references Telegram shares after a Stars purchase, such as a charge id. We do not receive your card number.
• Technical logs such as a request id, used to operate and debug the API.

Website login

The landing page can embed Telegram’s Login Widget. If you use it, your browser sends the widget payload to Bandly so the server can check the signature and create or update your user record. The MVP does not open a website session and does not set a Bandly cookie for that login. The name you then see on the page, and the link that opens the Mini-App, stay in the page until you leave it.

The widget script is loaded from telegram.org. Telegram may process that request under its own terms. Bandly does not control Telegram’s cookies.

Why we process it

• To run the mock you asked for and to show your report and history.
• To grant the free first mock and to record Stars credits.
• To transcribe speaking audio and grade answers.
• To answer a support or deletion request.
• To protect the service against abuse.

Where a law requires a lawful basis, this draft relies on performing the service you requested, and on legitimate interests in keeping the service secure. The owner should confirm that basis for the countries they serve.

AI providers

Speaking audio and written answers are sent to the AI provider configured for transcription and grading. That provider processes the audio and text to produce a transcript and a practice report. The provider is an OpenAI-compatible service when that integration is switched on for grading. The practice report is not an official IELTS score. Bandly is not affiliated with IELTS, the British Council, IDP, or Cambridge. Do not include another person’s personal data in an answer. The owner will name the provider in the published notice if a single vendor is fixed.

Retention

This draft keeps the account, attempts, speaking audio, essays, and grading output while the Telegram account uses Bandly, and for up to 24 months after the last activity. After that, the data is deleted or de-identified. Charge identifiers may be kept longer when a refund dispute or a legal duty requires it. Support messages are kept long enough to resolve the request and for a short record of what was decided. The 24-month figure is a draft. The owner must confirm it before publication.

You can ask us to delete your data earlier by emailing the contact address. We will delete what we hold unless we have to keep a record for a dispute, fraud prevention, or the law. Deleting the Telegram account on Telegram’s side does not by itself delete Bandly’s copy. Write to us as well.

Sharing

We share data with Telegram (identity and Stars payments), with the AI provider (audio and text needed to grade), and with the host that runs the API and database. We do not sell personal data. We do not pass card details, because we never receive them.

International transfers

The host and the AI provider may process data outside the country you live in. The owner will describe the safeguard (for example a contract clause) before publication.

Children

Bandly is not directed at children under 16. We do not knowingly keep an account for a child under 16. If you believe we have, contact us and we will delete it.

Security

The website login checks Telegram’s signature on the server and rejects payloads older than 24 hours. Access to the database is limited to the service. No method is perfect. Please do not send a bot token or a password to the contact mailbox.

Your requests

You can ask for a copy of the account data we hold, a correction, or deletion, at the contact address. You can also complain to a regulator. This draft does not name one, because the owner’s establishment country is not set.

Changes

The published notice will replace this draft. The date at the top will change when it does.

Contact

Privacy requests and questions: hello@bandlyai.com. The related Terms of use cover credits and refunds.