Privacy — BotMekong and TovNa

Version 2026-09-14 · Plain English. French and Khmer (by Pich) follow when read by a native speaker. This page describes what the system does today, as measured in the code — not what we would like it to do. Published at botmekong.com/privacy; linked from TovNa's /help and /start, from the owner dashboard and from the sign-up page.

Who we are

BotMekong builds Telegram bots for small businesses in Cambodia, and TovNa (ទៅណា?), a free directory of places in Cambodian cities. Contact: contact@getbotmekong.com · Telegram @BotMekongSupport.

1. TovNa — the directory (what we keep about people who ask it questions)

This is decision D237 of our journal, applied word for word:

• What we keep: your Telegram identifier (we need it to answer you) · typed facts about what you did — what you asked for (a kind of place, a cuisine, a dish, an area), which listing you opened, what was not found, when you were handed to a business's bot · a turn counter. Never: the text of your messages, your name, your username, your phone number, your position. Your location, when you share it, lives 20 minutes in the session memory and nowhere else.
• How long: 90 days for those facts (a nightly purge). Your identifier lives as long as one fact does.
• "Forget me": send /forget — every fact about you is erased immediately, and the bot says so. No question, no delay.
• What they are used for: to answer the same person better, and to measure what the directory cannot serve yet. Never sold, never shown to a business owner by name. Offers are shown inside an answer, only when they match what you asked; TovNa never sends a message you did not ask for.
• The words we could not understand go to an anonymous pool — the sentence only, no identifier — for 30 days, so we can teach the bot new words. Nothing in that pool is tied to you.
• When you report a listing (Closed? · Wrong number · Hours changed · Wrong category): we keep the fact that your identifier made that report, so that several different people can confirm it before anything changes. /forget erases your reports too; a value that was already corrected on a listing stays, because it belongs to the listing.
• When you tap ✓ Looks right under a listing, or confirm someone else's report: we keep that fact tied to your identifier, for the same reason — one person counts once, and the ✓ you see on a listing means several different people confirmed it. Same 90 days, same /forget.
• Your language choice (Khmer, English or French, asked once at the first /start, changed any time with /langue): kept as one fact with your identifier, so we do not ask again. Same 90 days after your last visit, same /forget.
• Offers an owner has published are shown inside an answer, only when they match what you asked. We do not record who saw an offer.
• How you arrived (from a card left in a shop, a QR code, our website, Facebook, TikTok, a shared listing…) is counted as one anonymous arrival per channel per day — a number, never who.
• Inline mode (@TovNaBot … typed in any chat, 13 Sep 2026): Telegram sends us only the words you typed after @TovNaBot — never the chat, never the group's messages, never who else is there. We do not read or keep the identity of the person typing; the answer is the same for everyone. When a listing is sent into a chat we count one anonymous share (a number per day, nothing else), and when someone opens TovNa from that shared listing we count one anonymous arrival — that is how we measure whether sharing works. The listing sent into the chat contains only public facts (name, area, address, a map link).

2. Business bots — what we keep about a business's customers

When you write to a business's BotMekong bot (a restaurant, a shop, a school):

• The bot keeps a short conversation window: the last 6 exchanges, for 30 days of reading. Older messages are no longer read, and they are removed when the conversation is next updated. (Decision D91.) We do not yet run a separate scheduled deletion of conversations that are never updated again; this is stated here rather than hidden.
• Bookings and orders you place are kept by the business, with what you gave for them (name, phone, party size, what you ordered), because the business needs them to serve you. The business can delete them from its dashboard.
• Your phone number is masked in our technical logs (redaction); logs never carry a bot token or a full number.
• Schools are a red line: what a parent writes to a school's bot (children's names, ages, health notes) stays with that school; it is never used to rank, recommend or advertise anything, and never leaves the school's bot.

3. Business owners — their data is theirs

An owner's settings, menu, prices, hours, photos and customer records belong to the business. We hold them to run the bot and the dashboard. An owner can export or delete them by asking us; deleting the business deletes its users, customers, bookings and conversations. Claiming a listing. When you prove a listing is yours (the code on the card, or the phone number already on the listing confirmed from your own Telegram), we keep your Telegram identifier as the listing's owner, and an audit line for each change you make (the field, the old and new value, when — facts only). Two wrong proofs close the attempt. The sign-up page (botmekong.com/tovna/register/) keeps what you typed — the name of the place, its kind, its area, its phone, your Telegram username — and a hashed claim code, for 7 days: if you do not confirm from your Telegram in that time, the entry is deleted. The page sets no cookie; to keep robots out it counts submissions per internet address for one hour and one day (a counter, nothing else), and ignores forms filled too fast or in the hidden field. Reaching an owner about their listing. We may send a business ONE text message about its own listing, with a way to say no. We never message people who are looking for a place. The message goes to the phone number already shown on the listing, once and only once; replying STOP (or asking us) puts that number on a list we never contact again. We keep, for that, only the listing and a hash of the number — never the message thread.

4. Where the data lives, and who else touches it

• Hetzner (Germany) — our servers and database.
• Backblaze B2 — encrypted off-site backups.
• DeepSeek — understanding messages. A message sent to a business bot is sent to DeepSeek to be understood and answered; TovNa sends a message there only when its own dictionary could not read it (at most a few hundred per day), never with your identifier.
• Google Places API, Overture Maps, OpenStreetMap, Wikidata, Brave Search, Foursquare — sources of the places in TovNa. They receive our queries about places, never anything about you.
• A Cambodian SMS gateway (Plasgate) — carries the one text message to a business (§ 3): it receives that phone number and that text, nothing else, and only when we send it.
• Telegram — the messaging platform; its own privacy policy applies to your Telegram account.

5. What we never do

No advertising messages, no selling of data, no profiling for third parties, no reading of your messages by a person except to fix a problem you reported. The one exception is written in § 3: a single text message to a business about its own listing, with a way to say no. Every place TovNa shows carries the date it was last checked; where its data comes from is written in DATA.md.

6. Changes

Every new kind of data we decide to keep gets a numbered decision in our journal and a line on this page, in the same change.