Privacy Policy

Effective November 15, 2026

1. Who we are

Assistly is an AI assistant: the website assistly.kz, the Telegram bot @assistly_app_bot and the user dashboard (together, the “service”). The service is provided by STEM School Almaty LLP, a limited liability partnership registered in the Republic of Kazakhstan (“we”). We are the owner and operator of your personal data within the meaning of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”.

• BIN (Business Identification Number): 230440036834
• Address: 350/1 Satpayev St., Pavlodar, Republic of Kazakhstan
• Director: Alina Bayramova
• Data protection contact: support@assistly.kz

This policy explains what data we receive, why, where we store it, who we share it with, and how to delete it. It applies together with our Terms of Service. This policy is published in Russian (assistly.kz/privacy), Kazakh (assistly.kz/kk/privacy) and English; if the versions differ, the Russian version prevails.

2. What data we receive

We receive only what you connect yourself. You can leave out or disconnect any source.

2.1. Account

• Sign in with Google (scopes openid, email, profile): your Google account ID, email address, name and profile picture.
• Telegram: your user ID, name, username and interface language — to send you messages and recognise you in the bot.
• Your invitation code, the consents you gave and when, and your assistant settings.

2.2. Gmail — read-only

Scope gmail.readonly. We read your emails: sender, recipients, subject, date, body, Gmail labels (for example, the Promotions and Social tabs) and attachments — for PDFs, only the text layer. We cannot send, delete or modify emails, and we do not mark them as read.

2.3. Google Calendar

Scope calendar.events. We read events in your calendars — for the morning briefing, to answer your questions and to avoid adding the same meeting twice. We create events (meetings from emails, reminders) and delete only events we created ourselves — when you tap a button or according to a setting you chose. We never modify or delete your own events.

2.4. iCloud

Your Apple ID and an app-specific password that you create for Assistly. With it we read your mail (IMAP) and calendars (CalDAV), and create and delete our own events. An app-specific password technically gives full access to the mailbox, so the restriction lives in our code: the mailbox is opened read-only, messages are not marked as read, and no commands that change the mailbox exist.

2.5. WhatsApp — experimental, opt-in

Assistly connects to your WhatsApp as a linked device (like WhatsApp Web) and receives messages from your chats, including groups, photos, PDFs and voice messages. When you connect, your phone sends the last month of history — you can opt out of this. We only read: we never send anything, never mark messages as read and never show you as “online”. A chat you have hidden is no longer processed.

2.6. What you send us

• Messages to the bot: text, voice messages (we transcribe them), photos and files — receipts, bills, notices, documents.
• Questions, requests, notes and tasks.
• Your profile questionnaire: city, family members, children's names and school years, work, languages you correspond in, what matters to you.
• Your ratings of notifications (“important”, “not important”, “spam”) and sender rules.

2.7. What the service derives

From this data the assistant produces email summaries, importance ratings and categories, events, reminders, spending records, bills to pay, document expiry dates, subscriptions and digests. These are your data too, and we treat them the same way.

2.8. Other people's data

Emails, chats and your questionnaire contain information about other people: senders, group members, your family, your children. We process it only to run your assistant and do not share it except as described in section 6. By entering information about other people (for example, your children) in the questionnaire, you confirm that you are entitled to share it.

2.9. Technical data

Error logs, mail-check times and AI usage — to run and protect the service. The assistly.kz website sets no cookies and uses no analytics, ad pixels or trackers. The user dashboard uses only the session cookie required to sign in. We collect no payment data: the beta is free.

3. Why we use it

We use data only for features you can see in Assistly:

• rating the importance of emails and messages, notifying you about important ones, preparing digests and briefings;
• adding meetings and reminders to your calendar;
• tracking bills, spending, subscriptions and document expiry dates;
• preparing the weekly school summary;
• answering your questions and searching your email, chats and notes;
• showing family items to the partner you added;
• helping you when you contact support;
• protecting the service and its users from abuse and complying with the law.

Your notification ratings tune only your own assistant. We do not use data for advertising, do not sell it, do not build profiles for third parties, do not use it to assess creditworthiness, and do not train AI models on it.

The legal basis for processing is the consent you give when you sign up. You can withdraw it at any time (how); we then stop processing and delete your data (section 9).

4. How AI processing works

To analyse an email, message, photo or voice message, or to answer a question, we send its content (together with the relevant part of your questionnaire) to an AI model through the OpenRouter service. The model returns a rating and extracted details: importance, summary, deadline, event, payment.

• Requests go only to model providers whose terms say they do not store requests or train models on them: we set a “deny data collection” flag on every request.
• Data is shared only for the duration of the request.
• The model does nothing on its own. It cannot send emails or delete or change anything in your mailbox: every action is performed by our code under fixed rules.
• The model can make mistakes. That is why anything the assistant added to your calendar or recorded can be undone with a button.

5. Where and how we store data

• The server is in Kazakhstan, with the hosting provider hoster.kz.
• Each user's data is kept separately: an isolated container and a separate database.
• Google tokens, iCloud passwords, access keys and the profile questionnaire are encrypted (AES-256-GCM) with a separate key for each user and decrypted only when used.
• Data travels only over encrypted connections (HTTPS/TLS). Backups are encrypted.
• For search, we store the text of emails (up to 20,000 characters per email; not for ads, newsletters, suspicious emails or sign-in codes) and WhatsApp messages. Before saving, we remove card numbers (except the last 4 digits), CVV codes, confirmation codes, passwords and IBANs from the text.
• The WhatsApp session file is stored on the server with restricted file permissions and is never included in backups.

A server administrator can technically access data on the server. Such access is limited to a small number of staff, is used only in the cases listed in section 8, and is logged.

6. Who we share data with

• OpenRouter, Inc. (USA) and AI model providers (USA, EU) — for processing at the time of the request, with no storage and no training (section 4).
• Telegram — delivers our messages to you: notifications, digests, answers. These contain summaries of your emails and messages. Telegram processes them under its own privacy policy.
• hoster.kz — hosts our server in Kazakhstan. It does not use the data.
• Your partner in “Family” — sees only family items (section 11), if you added one.
• Public authorities — only on a request based on law.
• A successor — if the business is reorganised or sold. We will tell you in advance, and will transfer Google data only with your consent.

No one else. We do not sell data, do not share it with ad networks or data brokers, and show no ads.

7. International transfers

Data is stored in Kazakhstan. To run the service, some data is transferred abroad: for the duration of processing — to OpenRouter and AI model providers in the USA and the EU; to deliver messages — to Telegram, whose servers are outside Kazakhstan. The level of personal data protection in these countries may differ from that in Kazakhstan.

We do this only with your separate consent, which you give when you sign up. The assistant cannot work without AI processing, so declining this consent means not using the service: you can withdraw it by deleting your account.

8. Google user data

This section describes how we handle data received through Google APIs, in line with the Google API Services User Data Policy and its Limited Use requirements.

What we request

• openid, email, profile — signing in to the dashboard: account ID, email address, name, picture.
• gmail.readonly — reading emails and attachments to find what matters, deadlines, meetings and bills, and to answer your questions. This scope does not allow changing your mailbox.
• calendar.events — reading your events, creating events from emails and reminders, and deleting only events we created.

We request Gmail and Calendar access separately from sign-in — only when you choose to connect them. Before that, we show you what we will read and who we will share it with, and ask for your explicit consent.

Our commitments

• We use Google user data only to provide the user-facing features you see in Assistly (section 3).
• We transfer it only as needed to provide those features — to AI providers through OpenRouter, with your explicit consent — and to comply with the law, to protect against abuse, or as part of a merger, acquisition or sale of the business with your consent.
• We do not use or transfer it for advertising, including personalised advertising, and we do not sell it — to ad networks, data brokers or anyone else.
• We do not use it to determine creditworthiness or for lending purposes.
• We do not use or transfer it to develop, improve or train generalised AI or machine-learning models — neither ourselves nor through our providers.
• No human reads your data, except: when you have given explicit permission for specific messages (for example, you ask support to look into a problem); when necessary for security purposes, such as investigating abuse or a vulnerability; when required by law; or when the data is aggregated and anonymised for internal operations.
• We keep Google tokens encrypted and only on our server. Once you disconnect Google, we stop receiving data.

You can revoke access at any time at myaccount.google.com/permissions. To delete data we have already received, see Delete data.

9. Retention

• We keep data for as long as your account is active.
• If you disconnect a source (Google, iCloud, WhatsApp), we immediately delete its token, password or session and stop receiving new data. Data already received stays in your assistant until you ask us to delete it or delete your account.
• After you delete your account, we erase all your data within 30 days, including backups.
• If the law requires us to keep certain records longer (for example, records of the consents you gave), we keep only those records and only for as long as the law requires.

10. Your rights

Under the laws of the Republic of Kazakhstan, you can:

• find out what data we hold about you and get a copy of it;
• ask us to correct, complete or block your data;
• ask us to delete your data;
• withdraw your consent to processing;
• complain about our actions to the authority responsible for personal data protection or to a court.

Email support@assistly.kz from the address linked to your account, or include your Telegram username. We may ask you to confirm the request in the bot to make sure it comes from you. We will reply within the time limits set by law. You can also disconnect sources and delete your account yourself — instructions.

11. Family

You can connect your spouse to your assistant. The partner is a separate user: they accept this policy and give their own consent to data processing.

• The partner sees only family items: emails about children, school and doctors (without access to the mailbox), family calendars, shared tasks, requests and family bills.
• The partner does not see the owner's full mailbox, spending or personal calendar.
• What the partner sends to the bot is stored in the owner's assistant, and the family part of it is visible to both.
• The owner can remove the partner with the /family command. The partner can leave and ask us to delete their data by emailing support@assistly.kz.

12. Age

Assistly is for people aged 18 and over. We do not knowingly collect data from children as users. Information about children contained in parents' emails or the questionnaire is processed with the consent of the parent as their legal representative.

13. Security and incidents

We protect data with encryption, isolation between users and restricted server access. If a breach affects your data, we will notify you and the competent authorities as and when required by law.

14. Changes to this policy

We publish each new version on this page with its effective date. We will notify you in Telegram in advance of significant changes. If a change affects how we use Google data or who we share it with, we will ask for your consent again.

15. Contact

STEM School Almaty LLP, BIN 230440036834
350/1 Satpayev St., Pavlodar, Republic of Kazakhstan
support@assistly.kz