Last updated: 7 July 2026
MemberBot is a service operated by BNN LTD, a company registered in the Republic of Kenya ("BNN", "we", "us"). This policy explains how we handle personal data, and applies to the MemberBot website and dashboard (the "Service"). We handle personal data in accordance with the Kenya Data Protection Act, 2019, and — for individuals in the European Economic Area and the United Kingdom — the GDPR/UK GDPR.
| Category | Examples | Why / lawful basis |
|---|---|---|
| Account | Name, email, workspace name, password (stored hashed) | To create and secure your account — performance of contract |
| Business / know-your-customer | Legal or business name, contact person, country, IP address at signup, terms-acceptance record | To operate the Service and meet legal and anti-abuse obligations — legal obligation & legitimate interests |
| Billing | Plan, subscription status, and billing identifiers. Payment details are handled by the payment provider you use — Paddle (card), PayPal, our crypto payment processor, or M-Pesa. We do not store full card numbers. | To bill your subscription — performance of contract |
| Usage & technical | Log data, IP address, device/browser info, actions in the dashboard | To run, secure, and improve the Service and prevent abuse — legitimate interests |
| Support | Messages you send us and their content | To provide support — performance of contract / legitimate interests |
To run a Customer's membership bot, the Service processes personal data about their members — for example Telegram user IDs, usernames and first names, subscription and payment records, phone numbers (where a member pays by M-Pesa), access grants, and messages needed to deliver access or provide bot support. The Customer is the controller of this data; we process it only to provide the Service to them, under the Data Processing Agreement. If you are a member of a community that uses MemberBot and have a privacy question, please contact that community's operator, who is the controller of your data.
To provide, secure, and improve the Service; to create and bill your subscription; to provide support and send service notices; to detect, investigate, and prevent abuse, fraud, and illegal content; and to comply with our legal obligations. We do not sell personal data, and we do not use it for third-party advertising.
We use a small set of trusted providers to run the Service. Each is bound by a data-processing agreement:
| Provider | Purpose |
|---|---|
| Paddle | Card subscription billing & Merchant of Record for card orders |
| PayPal | Subscription billing where you pay us by PayPal |
| NOWPayments | Cryptocurrency invoicing where you pay us in crypto |
| Safaricom (M-Pesa) | Mobile-money billing where you pay us by M-Pesa |
| DigitalOcean | Cloud hosting & database |
| Cloudflare | DNS, CDN/security, and encrypted off-site backups (R2) |
| Apple (iCloud) | Our support mailbox ([email protected]) |
| OpenAI | AI support assistant — only where you enable it |
| Telegram | The messaging platform the Service operates on |
Separately, any payment provider you connect (Stripe, M-Pesa, PayPal, Paystack, Flutterwave, Razorpay, Mercado Pago, NOWPayments, or Telegram Stars) processes your members' payments directly under its own terms; for those, that provider and you are the relevant controllers/processors — BNN does not receive or store your members' card or payment credentials.
Some of our providers process data outside Kenya (for example in the United States or European Union). Where we transfer personal data internationally we rely on appropriate safeguards — such as standard contractual clauses and each provider's own compliance frameworks — as required by the Kenya Data Protection Act and the GDPR.
We keep Customer and workspace data for as long as your account is active. After cancellation, data is retained for a limited recovery window and then deleted, except where we must keep certain records (for example billing or abuse records) to meet legal obligations. You can request export or deletion of your data at any time.
Subject to applicable law, you have the right to access, correct, and request deletion of your personal data; to restrict or object to certain processing; to data portability; and to withdraw consent where processing is based on consent. Under the Kenya Data Protection Act you also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). Individuals in the EEA/UK have equivalent rights under the GDPR and may complain to their local supervisory authority. To exercise any right, contact us at [email protected].
We use industry-standard measures including encryption in transit (TLS), tenant isolation enforced at the database level (row-level security), hashed passwords, and encrypted storage of sensitive credentials. No system is perfectly secure, but we work to protect your data and to notify you and the relevant authorities of any breach as required by law.
The dashboard uses essential local storage (for example to keep you signed in). We do not use third-party advertising or cross-site tracking cookies.
The Service is not directed to children, and you must be at least 18 to create a workspace. See our Acceptable Use Policy for our zero-tolerance stance on child sexual abuse material.
BNN LTD, Kenya. Privacy questions or requests: [email protected].
MemberBot is a service of BNN LTD. We may update this policy; material changes will be posted here with a new date.