Privacy Policy
This policy explains how we handle your personal data when you use the paid passport-appointment
notification tool (the “Service”) provided through the Telegram bot
@cherga_hunter_bot.
1. Data controller
PREMIUM SOFT VENTURES (registered sole-trader business; owner: Serhii Polishchuk), registered address 13 Ard na Greine, New Ross, Wexford, Y34 NH67, Ireland. Contact for privacy requests: support@premium-soft.ie.
2. What data we collect
- Telegram identifiers provided by Telegram when you use the bot: your Telegram user/chat ID, username (@handle) and first name.
- Service data: the cities you select, your session start/expiry dates, the alerts we send you, your responses in the bot (e.g. “I booked”), how many times you have started the Service, and any feedback you give. For the free demo we also record whether and when you used it (it is limited to one per user), the city assigned to it and how many demo alerts were sent, whether the single post-demo reminder has been sent to you, and whether you asked not to be reminded.
- Payment data: for each paid order we record the chosen cities, the amount, a payment reference code (
CH-…) and the order status. What follows depends on how you pay. A payment through Stripe — by card, Apple Pay or Google Pay, BLIK, Revolut (Revolut Pay) or PayPal — takes place on a Stripe page, no screenshot is needed, and we store only what Stripe reports back to us about the transaction: its identifier, the amount, the currency, the status, and the email address if you provide one on the payment page — we need this to reconcile the payment and in case it is disputed. For a bank transfer to Monobank (in hryvnia) we additionally store the payment screenshot you send us to verify it. In no case do we collect or store your card numbers, bank credentials or the login to your Revolut or PayPal account: you enter those solely on the side of Stripe, your bank, Revolut or PayPal. - Usage & attribution: aggregated, non-advertising analytics about how the Service is used — the steps you take in the bot (e.g. started, accepted the rules, selected cities, paid), timestamps, and a source tag identifying which link/channel you arrived from (e.g.
channel, or a campaign tag from an advertisement). We use this only to understand and improve the Service; we do not sell it or use it for third-party advertising. - Website analytics (cherga.app): page views and referrer, collected by Umami, which we host ourselves on our own server. Umami sets no cookies and does not track you across sites — which is why the site shows no cookie banner: there is nothing non-essential to consent to.
- «Щаслива черга» (the weekly draw), only if you choose to take part: the name you give us for it (a first name or a nickname is enough), when you joined, whether you won and — if you won — your gift and when you started it. The name you give is published: the winner's name in our Telegram channel @dp_document_slots and on cherga.app, and the names of the current week's participants on cherga.app — and, after each draw until the next one, the names of that draw's participants in its replay on the same page. We also record whether we sent you the one invitation to the draw and the one request for a review.
- Our Telegram community «Cherga Hunter · Спільнота» (@cherga_hunter), only if you join it: when you ask to join, the bot writes to you once with a single button to confirm you are a person, and we record your Telegram ID with the time you joined (until then, with the time you asked). Messages in the group are checked automatically against its rules — links, phone and card numbers, offers to sell a place. A message that breaks no rule is not stored by us. When one does, the bot deletes it and keeps a short record: your Telegram ID, name and username, which rule, what was done (a warning, a pause, a ban), the date, and the first 200 characters of the message. What you write in the group is visible to its readers — that is the group's purpose — and Telegram hosts it.
- Error diagnostics: when something goes wrong, a technical error report may be sent to Sentry (Functional Software, Inc.), which we use to find and fix faults. Such a report can include the identifier of the affected order or Telegram chat, because a fault has to be traceable to be fixed. It never includes payment credentials or the content of your messages.
3. Why we use it and our lawful basis (GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Provide the paid service you asked for (send alerts, manage your session) | Contract — Art. 6(1)(b) |
| Process and verify your payment | Contract — Art. 6(1)(b) |
| Prevent abuse and keep the Service running for everyone | Legitimate interests — Art. 6(1)(f) |
| Send you one reminder message about the Service after your free demo — never a sequence, and you can decline it in the bot at any time | Legitimate interests — Art. 6(1)(f) |
| Run the weekly draw you chose to enter, and publish the name you gave for it (§2) | Consent — Art. 6(1)(a); you can withdraw it at any time (§7) |
| Provide a won gift week | Contract — Art. 6(1)(b) |
| Run the community group: confirm that a person who asks to join is not a bot, and keep the group free of spam and fraud (offers to sell places, contact details, foreign links) | Legitimate interests — Art. 6(1)(f) |
| Send one invitation to the draw to someone who used the demo, and one request for a review after a gift or paid week has started | Legitimate interests — Art. 6(1)(f) |
4. Who we share it with
- Telegram (Telegram FZ-LLC) — the messaging platform that delivers the bot; your use of Telegram is also governed by Telegram's own privacy policy.
- Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) — our processor for payments by card, Apple Pay, Google Pay, BLIK, Revolut Pay and PayPal. You enter your payment details on Stripe's side and they never reach us; Stripe processes them as an independent controller under its own privacy policy.
- Revolut, PayPal, or the bank behind your BLIK code — only when you choose that method on Stripe's page. They receive from Stripe (not from us) what is needed to carry out the payment you confirm in their app or account, and act under their own terms.
- Monobank — handles a bank transfer in hryvnia under its own terms; we see only what we need to confirm your payment.
- Sentry (Functional Software, Inc.) — receives technical error reports, which may contain an order or chat identifier. Used to find and fix faults.
- Umami — website analytics, which we host ourselves on our own server. Receives page views and referrer, without cookies.
- Hetzner (Hetzner Online GmbH, Germany) — the Service's servers and database: your Telegram ID, name or username, sessions, orders and payment records. Hosting.
- Amazon Web Services (Amazon S3) — encrypted backup copies of that database, so that nothing you paid for is lost if a machine fails.
- Vercel (Vercel Inc.) — when you open
cherga.app: your IP address and the technical details of the request. Website hosting.
That is the complete list. We do not share your data with the passport service ДП «Документ», any government body, advertisers, or data brokers. We do not sell your data, and we do not use it for automated decision-making or profiling.
5. International transfers
Telegram operates globally, so your Telegram interaction data may be processed outside the European Economic Area under the safeguards Telegram applies.
Stripe processes payments through its Irish entity (Stripe Payments Europe, Ltd.), but may transfer data to other Stripe group companies outside the EEA under Standard Contractual Clauses (SCCs) approved by the European Commission.
Sentry is a US company, but error reports are processed on EU infrastructure
(ingest.de.sentry.io) under its Data Processing Addendum and the same Standard
Contractual Clauses. Umami runs on our own server in Germany, so that data does
not leave the EU at all.
Hetzner hosts the Service in Germany, inside the EU. Database backups
are stored with Amazon Web Services in the United States (us-east-1), and
Vercel, which serves the website, is a US company: both transfers rely on the EU‑US
Data Privacy Framework, in which both companies participate, and on the EU Standard Contractual
Clauses in their data processing terms.
6. How long we keep it
| Data | Kept for |
|---|---|
| Your account and session data in the bot | while you use the Service, and up to 12 months after your last session, so a returning user is recognised and the one-per-person demo cannot be reused |
| Payment records (order, amount, transaction reference) | 7 years, as Irish accounting and tax law requires |
| Payment screenshots for bank transfers | deleted once the payment is confirmed and the dispute window has passed — at most 90 days |
| Error reports in Sentry | 90 days, then deleted automatically |
| Database backups (Amazon S3) | daily copies for 30 days, hourly copies for 24 hours, then overwritten or deleted |
| Website analytics (Umami) | aggregated statistics, not linked to you |
| The name you gave for the draw | on the website's list of participants until that week's draw, and in that draw's replay until the next draw; the winner's name in the channel post, the website's list of winners and our database with your account data (up to 12 months after your last session) — or until you ask us to remove it |
| Community group: the time you joined, and the record of a rule breach (§2) | the join time while you are a member and up to 12 months after, like your account data; a breach record — kept in our private moderation chat in Telegram for up to 12 months, or until you ask us to remove it — a ban stays in Telegram's list of banned members until it is lifted |
| Slot-availability statistics (city, time) | indefinitely — these describe the passport service, not you, and contain no link to any person |
We delete your data on request wherever we have no legal obligation to keep it. Where an obligation applies — payment records — we restrict the data instead of deleting it, and delete it when the period ends.
7. Your rights
Under the GDPR you have the right to access, rectification,
erasure, restriction, objection, and
data portability, and to lodge a complaint with the Irish Data Protection
Commission (dataprotection.ie). To exercise any right, message the bot or
email support@premium-soft.ie. We reply within
30 days, free of charge. Deleting your data is a single request — you do not
have to give a reason, and refusing to give one cannot be held against you.
The right to object deserves a specific note, because two things here run on legitimate interests rather than on your consent: the single post-demo reminder, and error diagnostics. You can decline the reminder inside the bot with one tap, at any time, without losing the Service.
In the community group you can delete your own messages at any time; you can also ask us to delete them, to lift a pause or a ban you think is a mistake, or to remove the record of a breach — message the bot or support@premium-soft.ie.
Taking part in «Щаслива черга» rests on your consent, and you can withdraw it at any time by messaging the bot or support@premium-soft.ie: we take you out of the draw and remove your name from the website and from our channel post. A gift you have already won stays yours.
8. Security & children
We collect the minimum the Service needs. The database is held on a single operator-controlled machine, is not exposed to the internet, and is backed up in encrypted form; access is limited to the operator. Payment credentials never reach us at all (see §4).
The Service is not directed at children under 16 and we do not knowingly collect their data.
8a. What we deliberately do not do
Stated plainly, because in this field people are right to ask:
- We never ask for, receive or store passport data or any personal documents.
- We never log in anywhere on your behalf and never make a booking for you.
- We do not sell, rent or share your data with data brokers or advertisers.
- We do not profile you or make automated decisions with legal effects about you.
- We are not affiliated with ДП «Документ» and do not act on its behalf.
9. Changes & contact
We may update this policy; the version/date above will change and material changes are notified via the bot. Contact: support@premium-soft.ie.
Change history
| Version | Date | What changed |
|---|---|---|
| 1.11 | 17 October 2026 | The community group «Cherga Hunter · Спільнота»: the join check in the bot, automatic moderation of its rules, what a breach record holds (the first 200 characters of the message) and how long it is kept |
| 1.10 | 15 October 2026 | «Щаслива черга»: after each draw, until the next one, the website replays it with the names of its participants |
| 1.9 | 15 October 2026 | «Щаслива черга», the weekly draw: the name a participant gives and where it is published, the lawful bases, retention and how to withdraw; one invitation to the draw and one request for a review |
| 1.8 | 6 October 2026 | BLIK and Revolut payments now go through Stripe and need no screenshot; PayPal added as a payment method through Stripe; a bank transfer with a screenshot remains for Monobank only |
| 1.7 | 25 September 2026 | Named Hetzner (hosting), Amazon Web Services (database backups, stored in the US) and Vercel (website hosting) as processors, with the transfers and the backup retention |
| 1.6 | 7 September 2026 | Named Sentry and Umami as processors; retention given as concrete periods instead of "a short buffer"; added §8a and the note on the right to object |
| 1.5 | 27 August 2026 | Added card payments via Stripe |
| 1.4 | 23 August 2026 | The demo replaced the free trial |