Privacy Statement
Version 2.0 · Effective November 3, 2026
1. Who we are
This Privacy Statement explains how AMP Catalyst LLC, doing business as “Imba” (“Imba”, “we”, “us”), handles personal data.
AMP Catalyst LLC is a Delaware limited liability company (registration No. 7693186) with its registered office at 108 W. 13th Street, Suite 100, Wilmington, New Castle County, Delaware 19801, USA.
Imba is an AI-assisted, no-code platform for building and operating Telegram Mini Apps (the “Service”). Businesses and creators (“Customers”) use Imba to build their own Mini Apps (“Apps”) and offer them to their audiences (“End Users”).
Privacy contact and data protection officer: [email protected].
2. Our role depends on your relationship with us
| You are… | Imba’s role | Which privacy notice applies |
|---|---|---|
| A visitor to our website, or someone who contacts us | Controller | This Privacy Statement |
| A Customer (or a team member of a Customer) using the Service | Controller for your account, billing, support, and usage data | This Privacy Statement |
| An End User of an App built on Imba — for the operation of that App | Processor for the Customer who operates the App. The Customer is the controller | The Customer’s privacy policy. Please contact the App operator |
| An End User — for the limited purposes in Section 5 | Controller | This Privacy Statement, Section 5 |
| An affiliate or partner | Controller | This Privacy Statement |
If you are an End User: the business that runs the App you are using decides what data the App collects and how it is used — for example, its user database, forms, messages, promotions, games, and sales. Imba processes that data on the business’s behalf. Please read the business’s privacy policy and send requests about the App to that business. Section 5 explains the limited purposes for which Imba itself uses End User data.
3. Data we collect about Customers and website visitors
| Category | Examples | Source |
|---|---|---|
| Account data | Email and password (stored only as a hash) if you sign in with email; Telegram user ID, Telegram name, and Telegram username if you sign in with Telegram | You; Telegram |
| Billing data | Plan, invoices, billing address, tax ID, transaction history, last four digits and type of payment card. Full card details are processed by our payment processor, Stripe, or by the acquiring bank, and are not stored by Imba | You; Stripe; payment agents |
| Transaction Fee data | Amounts, dates, and status of transactions between you and your End Users processed through your App, as needed to calculate Transaction Fees | The Service; your payment provider integration |
| Bot credentials | Your Telegram bot token, stored encrypted | You |
| Content and AI data | App configurations and content, briefs and other inputs to AI features, generated outputs, files you upload | You; the Service |
| Usage data | Features used, actions, credits consumed, log data, device and browser information, IP address, online identifiers | Automatically; our analytics provider (Amplitude) |
| Communications | Support requests, feedback, survey responses | You |
| Website data | IP address, pages viewed, referrer, cookie identifiers — see our Cookie Statement | Automatically; cookies |
| Marketing data | Newsletter subscription, event registrations, campaign attribution | You |
4. Why we use Customer and visitor data
| Purpose | Data used | Legal basis (where required, e.g., under the GDPR) |
|---|---|---|
| Provide, operate, and support the Service | Account, content, AI, usage, bot credentials | Performance of contract |
| Billing, including Transaction Fees, and collections | Billing, Transaction Fee data | Performance of contract; legal obligation (tax and accounting) |
| Security, fraud prevention, and abuse detection | Account, usage, logs | Legitimate interests (protecting the Service and its users) |
| Enforce our Terms and Acceptable Use Policy | All relevant data | Legitimate interests |
| Product analytics to improve the Service, using Amplitude, including recordings of Website sessions (session replay) | Usage data, website data | Legitimate interests (improving the Service); consent for analytics cookies where required |
| Improve the Service and train Imba’s AI features using AI Training Data (Terms of Service, Section 12); not used for Enterprise plans | Content and AI data, usage data | Legitimate interests (improving the Service) |
| Service and administrative communications | Account | Performance of contract |
| Marketing about Imba | Account, marketing data | Consent where required; otherwise legitimate interests, with a right to opt out |
| Case studies about Customers and their Apps (Terms of Service, Section 11.6) | Customer’s name, logo, image (for individual creators and experts), App content, and App performance and economic metrics — no End User personal data | Performance of contract; legitimate interests |
| Comply with law and respond to lawful requests | Any relevant data | Legal obligation |
| Establish, exercise, or defend legal claims | Any relevant data | Legitimate interests |
| Corporate transactions (e.g., merger or acquisition) | Any relevant data | Legitimate interests |
5. End User data used for Imba’s own purposes
Most End User data is processed on behalf of Customers (see Section 2). Imba does not use End User data to train AI models and does not sell it. Imba uses certain End User data as an independent controller only for the purposes below.
5.1 What data.
- Telegram data made available to Apps by Telegram: Telegram user ID, first and last name, username, language, profile photo, and Telegram Premium status. Imba does not receive End Users’ phone numbers.
- Interaction data: App opens, screens viewed, actions taken, Coin activity, quiz, game, and referral activity.
- Transaction metadata: amount, date, and status of purchases (no payment card data).
- Technical data: device type, platform, IP address, and log data. Imba does not determine End Users’ location.
5.2 Purposes.
| Purpose | Description | Legal basis (where required) |
|---|---|---|
| Billing and plan limits | Counting monthly active End Users and calculating Transaction Fees owed by Customers | Legitimate interests |
| Notices when an App is unavailable | If an App is withdrawn because its operator has not paid Imba (Terms of Service, Section 8.12), Imba may show End Users who open the App a page saying that the App is unavailable, that questions should go to the operator, and presenting other Apps built on Imba, and may send them messages through the App’s bot. Messages suggesting other Apps are sent only where the law allows, including with the End User’s consent where required | Legitimate interests (informing End Users of a service interruption and of available alternatives); consent where required by law |
| Platform insights | Creating aggregated, anonymized statistics that do not identify any individual or App | Legitimate interests |
| Legal compliance | Responding to lawful requests and enforcing our policies | Legal obligation; legitimate interests |
5.3 Your right to object. If you are an End User, you can object to Imba’s processing in Section 5.2 based on legitimate interests — including receiving suggestions of other Apps — by contacting [email protected] with your Telegram username or ID and the name of the App. Where the law requires us to stop, we will.
6. Who we share data with
We do not sell personal data for money. We share it only as described below.
| Recipient | Why |
|---|---|
| Hosting provider: Hetzner Online GmbH (Germany), servers located in Finland | Hosting and storage of the Service and its data |
| Network and security provider: Cloudflare, Inc. (USA) | Delivering traffic to the Website, Dashboard, and Apps, and protecting them against attacks. All traffic passes through Cloudflare |
| AI model gateway: OpenRouter, Inc. (USA) | Routing requests to AI models. Inputs and relevant context, including App configuration, content, and analytics data in aggregated, anonymized form, are sent through OpenRouter to the AI model providers below |
| AI model providers, reached through OpenRouter: OpenAI (USA); Anthropic PBC (USA); Google LLC (USA) | Generating outputs for AI features. We have configured our OpenRouter account so that providers may not use Inputs and Outputs to train their models and do not retain them |
| Product analytics: Amplitude, Inc. (USA) | Analyzing how the Website is used, including recordings of Website sessions, so that we can improve the Service. Amplitude receives usage data, device and browser information, IP address, and online identifiers |
| Fonts: Google LLC — Google Fonts (USA) | Delivering fonts to the Dashboard. Google receives your IP address and browser information |
| Payment processor: Stripe, Inc. (USA) and its affiliates | Processing payments for subscriptions and Credits; card data is handled by Stripe directly |
| Payment agents engaged by Imba in certain countries | Accepting payments for plans and Credits on Imba’s behalf. They receive only the internal user ID, the selected plan, and the transaction status. Card details are entered directly in the acquiring bank’s payment form and are not received by Imba or the agent |
| Telegram | Operating Mini Apps and bots on Telegram’s platform. Telegram processes data under its own privacy policy |
| Customers | End User data processed for a Customer is made available to that Customer through the Service |
| Professional advisers | Lawyers, auditors, and accountants, under confidentiality |
| Authorities | Where required by law or to protect rights, safety, and property |
| Acquirers | In connection with a merger, acquisition, financing, or sale of assets, under confidentiality |
7. International transfers
Imba’s primary infrastructure is located in Finland (EU). Imba is a U.S. company, and some of our personnel, AI model providers, and other service providers are located outside your country, including in the United States (see Section 6).
Where we transfer personal data internationally, we use safeguards required by applicable law, such as European Commission Standard Contractual Clauses (with the UK Addendum or Swiss adaptations where relevant), adequacy decisions, or equivalent mechanisms under local law. You can request a copy of the relevant safeguards at [email protected].
8. How long we keep data
| Data | Retention |
|---|---|
| Account data | For the life of the account. You can ask us to delete your account at [email protected]; we delete it within 30 days of the request, and from backups in the ordinary course of backup rotation |
| Billing and tax records | As required by tax and accounting law, typically 7 years |
| Customer Content and End User data processed for Customers | For the life of the account. Deleting an App or bot in the Dashboard deactivates it; its data is deleted together with the account or earlier on request. After termination, deleted within 60 days, and from backups in the ordinary course of backup rotation, subject to legal holds |
| Inactive accounts (no login, change, or payment for more than 12 months) | Deleted irreversibly with all their data after 30 days’ notice |
| Bot tokens | Kept while the account exists; deleted with the account or earlier on request |
| Inputs to AI features (texts of requests) | 90 days |
| Conversations in AI chat | 2 hours |
| AI Training Data | For as long as needed to develop and improve AI features; data already incorporated into trained models may not be removable |
| Platform insights | Aggregated and anonymized; may be kept indefinitely |
| Logs and security data | Up to 12 months |
| Marketing data | Until you unsubscribe or withdraw consent; suppression lists kept to honor opt-outs |
| Support communications | Support is provided in Telegram. Imba does not keep separate copies; conversations are stored by Telegram under its own policy |
9. Security
We use technical and organizational measures appropriate to the risk to protect personal data against unauthorized access, disclosure, alteration, and loss. No system is perfectly secure. If we become aware of a data breach that affects your personal data, we will notify you and the relevant authorities where required by law.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data;
- restrict or object to processing, including processing based on legitimate interests;
- data portability;
- withdraw consent at any time, where processing is based on consent;
- not be subject to decisions based solely on automated processing that significantly affect you (Imba does not make such decisions about Customers or End Users);
- lodge a complaint with your data protection authority.
To exercise your rights, email [email protected]. We may need to verify your identity. We will respond within the time required by applicable law, typically within one month.
End Users: for data processed by an App on behalf of the business that operates it, please contact that business. If you contact us, we will forward your request to the business where appropriate.
11. Children
The Service is intended for businesses and is not directed to children. Customers must be at least 18. We do not knowingly collect personal data from children under 13, or under the age of digital consent in their country if higher, for our own purposes. Customers are responsible for ensuring that their Apps comply with laws protecting children. If you believe a child has provided personal data to Imba, contact [email protected].
12. Marketing
We may send Customers information about Imba’s products, features, and events. You can unsubscribe at any time using the link in our emails or by contacting us.
We do not send marketing messages to End Users, except the notices about an unavailable App and the suggestions of other Apps built on Imba described in Section 5.2, sent only where the law allows.
13. Regional disclosures
The following supplements this Privacy Statement for residents of specific regions. If it conflicts with the rest of this Statement, the regional disclosure prevails for residents of that region.
European Economic Area, UK, and Switzerland (GDPR, UK GDPR, FADP). Legal bases are set out in Sections 4 and 5.2. You may complain to your local supervisory authority.
Brazil (LGPD). You have the rights under Art. 18 LGPD, including confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and revocation of consent. You can exercise them by contacting [email protected].. You may complain to the ANPD.
India (DPDP Act 2023). You may access, correct, complete, and erase your personal data, nominate another person to exercise your rights, and seek grievance redressal by contacting [email protected]. Where processing is based on consent, you may withdraw it at any time.
Indonesia (PDP Law). You have the rights under Law No. 27 of 2022, including access, correction, deletion, withdrawal of consent, and objection to automated decision-making.
Turkey (KVKK). You have the rights under Article 11 of Law No. 6698. Cross-border transfers are made in accordance with Article 9.
Saudi Arabia (PDPL) and United Arab Emirates (PDPL). You have the rights to be informed, access, correction, and destruction under applicable law. Cross-border transfers follow applicable transfer regulations.
Malaysia (PDPA, as amended). You may access and correct your personal data and withdraw consent. Where required, we will notify you of data breaches. Data protection officer: [email protected].
Mexico (LFPDPPP). You may exercise your ARCO rights — Access, Rectification, Cancellation, and Opposition — by contacting [email protected]. Where Mexican law requires consent for a purpose described in this Statement, we will request it.
Argentina (Law 25,326). You may access your data free of charge at intervals of no less than six months unless you show a legitimate interest, and request correction or deletion. The supervisory authority is the Agency for Access to Public Information (AAIP).
Nigeria (NDPA 2023). You have the rights under the Nigeria Data Protection Act, including access, correction, deletion, portability, and objection. You may complain to the Nigeria Data Protection Commission.
Kazakhstan, Uzbekistan, Azerbaijan. We process personal data in accordance with applicable national law. Where consent is required, including written or electronic consent for collection or cross-border transfer, it will be requested.
United States (state privacy laws, e.g., California). We do not sell personal information for money. We do not use advertising cookies or pixels and do not “share” personal information for cross-context behavioral advertising. You may have rights to know, delete, correct, and opt out, and the right not to be discriminated against for exercising them. Contact [email protected].
14. Changes to this Statement
We may update this Privacy Statement from time to time. For material changes, we will notify Customers by email or in the Service before the changes take effect. The current version is always available on our website.
15. Contact
AMP Catalyst LLC (Imba), 108 W. 13th Street, Suite 100, Wilmington, DE 19801, USA. Privacy and data protection officer: [email protected]
Versions
- Version 2.0 · November 3, 2026 (current)